This tutorial explains how to setup a KES Server to use Azure Key Vault as the persistent key store: K E S C l i e n t K E S S e r v e r A z u r e K e y V a u l t Azure Key Vault Azure Key Vault is a managed KMS service that provides a secret store that can be used by KES.

AWS Secrets Manager works as a key-value store for secrets like passwords, access tokens, and cryptographic keys. AWS encrypts these secrets with the AWS Key Management Service (AWS-KMS). This tutorial shows how to set up a KES server that uses AWS Secrets Manager as a persistent key store protected by AWS-KMS: K E S C l i e n t K E S S e r v e r A W S S e c A r W e S t - s K - M M S a n a g e r AWS Secrets Manager Prerequisite You need an AWS access key and AWS secret key pair with sufficient IAM policy permissions to create, retrieve, and delete secrets with AWS Secrets Manager. Create AWS Access/Secret Key Pair.

AIStor Key Manager AIStor Key Manager is a robust key management server (KMS) designed to store cryptographic keys. K...

This section provides documentation on the AIStor Key Encryption Service (KES). AIStor KES is a maintained fork of the MinIO KES project under MinIO’s enterprise license. For new or long-term deployments, consider using AIStor Key Manager to replace KES. Migrate from KES Community Edition to AIStor KES on Linux The following procedure describes how to migrate from the deprecated KES Community Edition (KES CE) to the latest stable AIStor KES release. This procedure assumes an existing KES CE cluster running latest available release.

The mc ilm rule import command imports an object lifecycle management configuration and applies it to an AIStor bucket. The mc ilm rule import command imports from STDIN by default. You can input the contents from a .json file, such as one produced by mc ilm rule export. The following command imports the lifecycle management configuration from mydata-lifecycle-config.json and applies it to the mydata bucket on the myaistor deployment:

The mc ilm tier check command displays the configuration for remote tier on a deployment. Syntax Example The following example displays the configuration for an existing remote tier called WARM-TIER on the myaistor deployment.

The mc idp openid disable command stops your AIStor deployment from using an existing OIDC configuration. Example and syntax Example The following example disables the server configurations defined as test_config on the myaistor deployment.

The mc ilm tier rm command removes an remote tier that has not been used to transition any objects. The mc ilm tier remove command has equivalent functionality to mc ilm tier rm Once a tier has transitioned objects, it cannot be permanently returned to the original tier. To temporarily return objects to the original tier, use mc ilm restore.

Description The mc inventory commands allow you to configure and manage inventory jobs on an AIStor deployment. Inventory jobs generate reports of objects in a bucket based on specified filters and schedules. Added in RELEASE.2025-12-20T04-58-37Z mc inventory and its subcommands require AIStor Client RELEASE.2025-12-19T20-11-44Z or later and AIStor Server RELEASE.2025-12-20T04-58-37Z or later. Subcommands mc inventory includes the following subcommands:

The mc idp ldap accesskey create allows you to add LDAP access key pairs. Syntax EXAMPLE The following example creates a new access key pair with the same policy as the authenticated user on the myaistor alias: