This tutorial explains how to setup a KES Server to use Azure Key Vault as the persistent key store: K E S C l i e n t K E S S e r v e r A z u r e K e y V a u l t Azure Key Vault Azure Key Vault is a managed KMS service that provides a secret store that can be used by KES.

AWS Secrets Manager works as a key-value store for secrets like passwords, access tokens, and cryptographic keys. AWS encrypts these secrets with the AWS Key Management Service (AWS-KMS). This tutorial shows how to set up a KES server that uses AWS Secrets Manager as a persistent key store protected by AWS-KMS: K E S C l i e n t K E S S e r v e r A W S S e c A r W e S t - s K - M M S a n a g e r AWS Secrets Manager Prerequisite You need an AWS access key and AWS secret key pair with sufficient IAM policy permissions to create, retrieve, and delete secrets with AWS Secrets Manager. Create AWS Access/Secret Key Pair.

AIStor Key Manager AIStor Key Manager is a robust key management server (KMS) designed to store cryptographic keys. K...

This section provides documentation on the AIStor Key Encryption Service (KES). AIStor KES is a maintained fork of the MinIO KES project under MinIO’s enterprise license. For new or long-term deployments, consider using AIStor Key Manager to replace KES. Migrate from KES Community Edition to AIStor KES on Linux The following procedure describes how to migrate from the deprecated KES Community Edition (KES CE) to the latest stable AIStor KES release. This procedure assumes an existing KES CE cluster running latest available release.

The following procedure adds a server pool to an existing AIStor cluster running on bare-metal infrastructure. Each pool expands the total available storage capacity of the cluster while maintaining the overall availability of the cluster. A new pool is a set of new nodes and drives that meet the cluster’s erasure set requirements and parity levels. You can use MinIO’s Erasure Code Calculator to check the Erasure Code Stripe Size (K+M) of your new pool to confirm that it meets the EC:M value of current cluster. MinIO strongly recommends seeking an architecture review from MinIO Engineering through SUBNET to analyze potential performance impacts before committing to a new pool for your cluster.

The mc admin accesskey edit command modifies the configuration of an access key associated to the specified user. The command requires that at least one attribute of the access key change. Otherwise, the command exits with an error message. Syntax Example The following command applies a new policy and secret key to the myuserserviceaccount access key on the myaistor deployment:

Required release version This command is available in AIStor Client RELEASE.2025-03-31T22-38-30Z or later. The functionality requires AIStor RELEASE.2025-03-27T23-09-45Z or later. The mc admin accesskey sts-revoke command removes security token service (sts) credentials associated with an account. Revoke all STS tokens for an account, or specify the type(s) of STS tokens to revoke for an account.

Description The mc admin config command manages configuration settings for the AIStor Server. Examples Syntax mc admin config set Sets a configuration key on the AIStor deployment. Configurations defined by environment variables override configurations defined by this command.

The mc admin kms key command performs cryptographic key management operations through the AIStor Key Encryption Service (KES). Syntax mc admin kms key create Creates a new master key on a Key Management System (KMS).

This page documents upgrade procedures for AIStor Server deployments on bare-metal Linux infrastructure. All AIStor software supports non-disruptive upgrades with zero downtime. In optimal environments, cluster-wide upgrades typically complete in under 500 milliseconds with large clusters (1000+ nodes) completing in less than 5 seconds. Upgrade AIStor using DEB or RPM Use these steps to upgrade an AIStor deployment where the server process is managed by systemctl, such as those created using the AIStor DEB/RPM packages.