This tutorial shows how to setup a KES server that uses Google Cloud Secret Manager as a persistent key store. K E S C l i e n t K E S S e r v e r G o o g l e C l o u d S e c r e t M a n a g e r Google Cloud Secret Manager The Google Cloud Secret Manager is a key-value store for secrets, such as passwords, access tokens, and cryptographic keys.

This page provides information about KES configuration options for a KES Client and a KES Server. KES Client As a basic standard configuration, a KES client needs to know the KES server endpoint KES client’s own client certificate Corresponding private key to the client certificate You can provide these values in different ways, such as through environment variables at the command line or through a Software Development Kit.

The AIStor Security Token Service (STS) AssumeRoleWithWebIdentity API endpoint generates temporary access credentials using a JSON Web Token (JWT) returned from a configured OIDC Identity Provider (IDP). This page documents the AIStor Server AssumeRoleWithWebIdentity endpoint. For instructions on implementing STS using an S3-compatible SDK, refer to the documentation for that SDK. The AIStor STS AssumeRoleWithWebIdentity API endpoint is modeled after the AWS AssumeRoleWithWebIdentity endpoint and shares certain request/response elements. This page documents the AIStor-specific syntax and links out to the AWS reference for all shared elements.

This tutorial shows how to setup a KES server that uses Vault’s K/V engine as a persistent and secure key store: K E S C l i e n t K E S S e r v e r V a u l t Prerequisites To start a development server or interact with Vault using the Vault CLI, download the Vault binary.

AIStor Key Manager supports installation on to Linux and Kubernetes infrastructures. Hardware and host configuration The following table lists the minimum requirements for a Key Manager server CPU Single-Socket Server-grade CPU with support for AES-NI instruction sets. Memory 8GiB available Storage 10GiB SSD or NVMe Network 10GbE low-latency interface Security standards typically discourage storing encryption keys on the same hosts as the encrypted data. As such, consider deploying Key Manager onto physical or virtual hosts that are fully separated or independent from the AIStor Object Store clusters they support.

AWS Secrets Manager works as a key-value store for secrets like passwords, access tokens, and cryptographic keys. AWS encrypts these secrets with the AWS Key Management Service (AWS-KMS). This tutorial shows how to set up a KES server that uses AWS Secrets Manager as a persistent key store protected by AWS-KMS: K E S C l i e n t K E S S e r v e r A W S S e c A r W e S t - s K - M M S a n a g e r AWS Secrets Manager Prerequisite You need an AWS access key and AWS secret key pair with sufficient IAM policy permissions to create, retrieve, and delete secrets with AWS Secrets Manager. Create AWS Access/Secret Key Pair.

The pages in this section document settings for configuring AIStor to work with identity and access management (IAM) solutions. There is a page of settings for each of the IAM methods AIStor supports. Active Directory / LDAP OpenID Connect MinIO Identity Management Plugin MinIO Access Management Plugin

This page covers settings that control behavior related to AIStor bucket notifications. You can establish or modify settings by defining: an environment variable on the host system prior to starting or restarting the AIStor Server. Refer to your operating system’s documentation for how to define an environment variable. a configuration setting using mc admin config set. If you define both an environment variable and the similar configuration setting, AIStor uses the environment variable value.

This section provides documentation on the AIStor Key Encryption Service (KES). AIStor KES is a maintained fork of the MinIO KES project under MinIO’s enterprise license. For new or long-term deployments, consider using the AIStor Key Manager to replace KES. Migrate from KES CE to AIStor KES on Linux The following procedure describes how to migrate from the deprecated KES Community Edition (KES CE) to the latest stable AIStor KES releases. This procedure assumes an existing KES CE cluster running latest available release.

This page documents settings for configuring an NATS service as a target for Bucket Notifications. See Publish Events to NATS for a tutorial on using these settings. You can establish or modify settings by defining: an environment variable on the host system prior to starting or restarting the AIStor Server. Refer to your operating system’s documentation for how to define an environment variable. a configuration setting using mc admin config set. If you define both an environment variable and the similar configuration setting, AIStor uses the environment variable value.