Entrust KeyControl is a proprietary KMS which KES supports using for storing secrets. K E S C l i e n t K E S S e r v e r E n t r u s t K e y C o n t r o l Prerequisites This procedure was written and tested against Entrust KeyControl v10.1. The provided instructions may work against other KeyControl versions. This procedure assumes you have prior experience with Entrust products and have followed their documentation, best practices, and other published materials in deploying the KeyControl service.

The AIStor Security Token Service (STS) APIs allow applications to generate temporary credentials for accessing the AIStor Server. The STS API is required for AIStor Servers configured to use external identity managers, as the API allows conversion of the external IDP credentials into AWS Signature v4-compatible credentials. STS API endpoints AIStor supports the following STS API endpoints:

Operations

The following page includes the full contents of the AIStor Custom Resource Definition V1 (Alpha) CustomResourceDefinition. The KeyManagerSpec spec provides the specification for Key Manager resources. API Reference Packages aistor.min.io/v1alpha1 aistor.min.io/v1alpha1 Package v1alpha1 is the v1alpha1 version of the Enterprise Operator API.

The mc support top disk command displays current drive statistics. Syntax Example The following command displays the current disk usage and performance on the alias myaistor.

The mc idp openid accesskey commands allow you to list, delete, or display information about OIDC access key pairs on the AIStor deployment. This command works against access keys created by an OIDC user after authenticating to AIStor. Authenticated users can create access keys with the AIStor console, or with the mc admin accesskey create command. An authenticated user cannot create access keys for another OIDC user. AIStor also supports using AssumeRoleWithWebIdentity to generate temporary access keys using the Security Token Service.

The mc ilm tier ls command shows the remote tiers configured on a deployment. The mc ilm tier list command has equivalent functionality to mc ilm tier ls. Syntax Example The following example outputs a list of the existing remote tiers on the myaistor deployment.

The mc ilm tier update command modifies an existing configured remote tier. Syntax Example The following example updates the credentials for an existing remote tier called S3TIER on the myaistor deployment.

The mc idp openid accesskey info outputs information about the specified access key(s). This command works against access keys created by an OIDC user after authenticating to AIStor. Authenticated users can manage their own long-term Access Keys using the AIStor Console. AIStor supports using AssumeRoleWithWebIdentity to generate temporary access keys using the Security Token Service. Example and syntax Example The following example outputs details for the access key mykey from the myaistor deployment:

The mc ls command lists buckets and objects on an AIStor deployment. You can also use mc ls to list objects on S3-compatible services. Syntax Example The following command lists all objects in a bucket on the myaistor deployment: