This tutorial explains how to setup a KES Server to use Azure Key Vault as the persistent key store: K E S C l i e n t K E S S e r v e r A z u r e K e y V a u l t Azure Key Vault Azure Key Vault is a managed KMS service that provides a secret store that can be used by KES.

AWS Secrets Manager works as a key-value store for secrets like passwords, access tokens, and cryptographic keys. AWS encrypts these secrets with the AWS Key Management Service (AWS-KMS). This tutorial shows how to set up a KES server that uses AWS Secrets Manager as a persistent key store protected by AWS-KMS: K E S C l i e n t K E S S e r v e r A W S S e c A r W e S t - s K - M M S a n a g e r AWS Secrets Manager Prerequisite You need an AWS access key and AWS secret key pair with sufficient IAM policy permissions to create, retrieve, and delete secrets with AWS Secrets Manager. Create AWS Access/Secret Key Pair.

AIStor Key Manager AIStor Key Manager is a robust key management server (KMS) designed to store cryptographic keys. K...

This section provides documentation on the AIStor Key Encryption Service (KES). AIStor KES is a maintained fork of the MinIO KES project under MinIO’s enterprise license. For new or long-term deployments, consider using AIStor Key Manager to replace KES. Migrate from KES Community Edition to AIStor KES on Linux The following procedure describes how to migrate from the deprecated KES Community Edition (KES CE) to the latest stable AIStor KES release. This procedure assumes an existing KES CE cluster running latest available release.

Description The mc inventory commands allow you to configure and manage inventory jobs on an AIStor deployment. Inventory jobs generate reports of objects in a bucket based on specified filters and schedules. Added in RELEASE.2025-12-20T04-58-37Z mc inventory and its subcommands require AIStor Client RELEASE.2025-12-19T20-11-44Z or later and AIStor Server RELEASE.2025-12-20T04-58-37Z or later. Subcommands mc inventory includes the following subcommands:

The mc idp openid add command creates an OIDC IDP server configuration. You can run the command multiple times to set up multiple OpenID providers. When adding multiple OpenID providers, only one can be a JWT claim-based provider. All others must be role-based providers. Example and syntax Example The following example creates the configuration settings for the myaistor deployment as defined in a new test-config setup for Dex integration.

The mc legalhold command sets, removes, or retrieves the object legal hold (WORM) settings for object(s). Subcommands mc legalhold includes the following subcommands: Subcommand Description clear Removes the current legal hold setting for an object or objects. info Returns the current legal hold setting for an object or objects. set Enables legal hold Write-Once Read-Many (WORM) object locking on an object or objects.

The mc legalhold clear command removes the current legal hold setting for an object or objects. Syntax Removing the legal hold on object(s) does not remove any other GOVERNANCE Mode and COMPLIANCE Mode retention settings in place for the object(s) Example The following command removes the legal hold on all objects in the mydata bucket on the myaistor server.

The mc replicate resync command resynchronizes all objects in the specified AIStor bucket to a remote replication target. This command requires first configuring the remote bucket target using the mc replicate add command. You must specify the resulting remote ARN as part of running mc replicate resync. This command supports rebuilding an AIStor deployment using an active-active replication remote as the “backup” source. See the following tutorials for more information on active-active replication.

The mc idp openid ls command lists all OIDC configurations for your AIStor deployment. Example and syntax Example The following example outputs a list of all OIDC configuration sets defined for the myaistor deployment.