This page provides information about KES configuration options for a KES Client and a KES Server. KES Client As a basic standard configuration, a KES client needs to know the KES server endpoint KES client’s own client certificate Corresponding private key to the client certificate You can provide these values in different ways, such as through environment variables at the command line or through a Software Development Kit.

This tutorial shows how to setup a KES server that uses Google Cloud Secret Manager as a persistent key store. K E S C l i e n t K E S S e r v e r G o o g l e C l o u d S e c r e t M a n a g e r Google Cloud Secret Manager The Google Cloud Secret Manager is a key-value store for secrets, such as passwords, access tokens, and cryptographic keys.

This tutorial shows how to setup a KES server that uses Vault’s K/V engine as a persistent and secure key store: K E S C l i e n t K E S S e r v e r V a u l t Prerequisites To start a development server or interact with Vault using the Vault CLI, download the Vault binary.

This page documents settings for configuring an POSTGRES service as a target for Bucket Notifications. See Publish Events to PostgreSQL for a tutorial on using these settings. You can establish or modify settings by defining: an environment variable on the host system prior to starting or restarting the AIStor Server. Refer to your operating system’s documentation for how to define an environment variable. a configuration setting using mc admin config set. If you define both an environment variable and the similar configuration setting, AIStor uses the environment variable value.

The AIStor Security Token Service (STS) AssumeRoleWithWebIdentity API endpoint generates temporary access credentials using a JSON Web Token (JWT) returned from a configured OIDC Identity Provider (IDP). This page documents the AIStor Server AssumeRoleWithWebIdentity endpoint. For instructions on implementing STS using an S3-compatible SDK, refer to the documentation for that SDK. The AIStor STS AssumeRoleWithWebIdentity API endpoint is modeled after the AWS AssumeRoleWithWebIdentity endpoint and shares certain request/response elements. This page documents the AIStor-specific syntax and links out to the AWS reference for all shared elements.

Description The mc admin service command can restart or unfreeze AIStor servers. mc admin service affects all AIStor servers in the target deployment at the same time. The command interrupts in-progress API operations on the AIStor deployment. Use caution when issuing this command to a deployment.

The mc admin user info command returns detailed information of an AIStor user on the target AIStor deployment. To manage external Identity Provider users, see OIDC or AD/LDAP. Syntax Example The following command returns details of user myuser on the myminio AIStor deployment:

Description The mc admin cluster bucket command and its subcommands provide tools for manually importing and exporting AIStor bucket metadata. This metadata includes configurations related to features like lifecycle management rules. You can use this metadata as a snapshot of the bucket configuration for restoration later, such as part of or backup/restore operations.

Each AIStor server process exposes unauthenticated endpoints for probing server uptime and deployment high availability for simple healthchecks. These endpoints return an HTTP status code indicating whether the underlying resource is healthy or satisfies read/write quorum. The server exposes no other data through these endpoints. AIStor liveness Use the following endpoint to test if the specified AIStor server is up and ready to serve requests:

AIStor requires an active and unexpired MinIO Commercial License. Accessing your license The license is available in SUBNET. Log in to https://subnet.min.io. From the Deployments screen, select License Key. Select the copy button to the right of license key string.