This tutorial explains how to setup a KES Server to use Azure Key Vault as the persistent key store: K E S C l i e n t K E S S e r v e r A z u r e K e y V a u l t Azure Key Vault Azure Key Vault is a managed KMS service that provides a secret store that can be used by KES.

AWS Secrets Manager works as a key-value store for secrets like passwords, access tokens, and cryptographic keys. AWS encrypts these secrets with the AWS Key Management Service (AWS-KMS). This tutorial shows how to set up a KES server that uses AWS Secrets Manager as a persistent key store protected by AWS-KMS: K E S C l i e n t K E S S e r v e r A W S S e c A r W e S t - s K - M M S a n a g e r AWS Secrets Manager Prerequisite You need an AWS access key and AWS secret key pair with sufficient IAM policy permissions to create, retrieve, and delete secrets with AWS Secrets Manager. Create AWS Access/Secret Key Pair.

AIStor Key Manager AIStor Key Manager is a robust key management server (KMS) designed to store cryptographic keys. K...

This section provides documentation on the AIStor Key Encryption Service (KES). AIStor KES is a maintained fork of the MinIO KES project under MinIO’s enterprise license. For new or long-term deployments, consider using AIStor Key Manager to replace KES. Migrate from KES Community Edition to AIStor KES on Linux The following procedure describes how to migrate from the deprecated KES Community Edition (KES CE) to the latest stable AIStor KES release. This procedure assumes an existing KES CE cluster running latest available release.

MinIO Client SDK provides higher level APIs for MinIO and Amazon S3 compatible cloud storage services. For a complete list of APIs and examples, please take a look at the Dotnet Client API Reference. This document assumes that you have a working VisualStudio development environment. Install from NuGet To install MinIO .NET package, run the following command in Nuget Package Manager Console.

The mc encrypt set encrypt command sets or updates the default bucket Server-Side Encryption (SSE) mode. AIStor automatically encrypts objects written to that bucket using the specified SSE mode. mc encrypt set supports only SSE-KMS and SSE-S3 encryption types. Syntax Example The following command sets the default encryption configuration for a bucket:

The mc idp openid ls command lists all OIDC configurations for your AIStor deployment. Example and syntax Example The following example outputs a list of all OIDC configuration sets defined for the myaistor deployment.

The mc idp ldap accesskey create allows you to add LDAP access key pairs. Syntax EXAMPLE The following example creates a new access key pair with the same policy as the authenticated user on the myaistor alias:

The mc idp openid add command creates an OIDC IDP server configuration. You can run the command multiple times to set up multiple OpenID providers. When adding multiple OpenID providers, only one can be a JWT claim-based provider. All others must be role-based providers. Example and syntax Example The following example creates a named configuration called DEX for the myaistor deployment for Dex integration.

The mc idp ldap accesskey commands allow you to list, delete, or display information about LDAP access key pairs on the AIStor deployment. This command works against access keys created by an AD/LDAP user after authenticating to AIStor. Create AD/LDAP service accounts with the mc idp ldap accesskey create command. Authenticated users can manage their own long-term Access Keys using the AIStor Console. AIStor supports using AssumeRoleWithLDAPIdentity to generate temporary access keys using the Security Token Service.