Key Encryption Service Settings

The following environment variables control how the MinIO Server interacts with the Key Encryption Service (KES) when managing encryption and keys.

Note

These settings do not have configuration setting options for use with mc admin config set.

Define any of these environment variables in the host system prior to starting or restarting the MinIO process. Refer to your operating system’s documentation for how to define an environment variable.

Important

Each configuration setting controls fundamental MinIO behavior and functionality. MinIO strongly recommends testing configuration changes in a lower environment, such as DEV or QA, before applying to production.

MINIO_KMS_KES_ENDPOINT: The endpoint for the MinIO Key Encryption Service (KES) process to use for supporting SSE-S3 and MinIO backend encryption operations.

MINIO_KMS_KES_KEY_FILE

The private key associated to the the MINIO_KMS_KES_CERT_FILE x.509 certificate to use when authenticating to the KES server. The KES server requires clients to present their certificate for performing mutual TLS (mTLS).

See the KES wiki for more complete documentation on KES access control.’

MINIO_KMS_KES_CAPATH: Allows validation of the KES Server Certificate for a Self-Signed or Third-Party CA <Certificate Authority>. Specify the path to the location of the CA <Certificate Authority> certificate for your KES deployment.

MINIO_KMS_KES_CERT_FILE

The x.509 certificate to present to the KES server. The KES server requires clients to present their certificate for performing mutual TLS (mTLS).

The KES server computes an identity from the certificate and compares it to its configured policies. The KES server grants the minio server access to only those operations explicitly granted by the policy.

See the KES wiki for more complete documentation on KES access control.

MINIO_KMS_KES_KEY_NAME

The name of an external key on the Key Management system (KMS) configured on the KES server and used for performing en/decryption operations. MinIO uses this key for the following:

Encrypting backend data (IAM, server configuration).
The default encryption key for Server-Side Encryption with SSE-KMS.
The encryption key for Server-Side Encryption with SSE-S3.

Important

Enabling SSE on a MinIO deployment automatically encrypts the backend data for that deployment using the default encryption key.

MinIO requires access to KES and the external KMS to decrypt the backend and start normally. The KMS must maintain and provide access to the MINIO_KMS_KES_KEY_NAME. You cannot disable KES later or “undo” the SSE configuration at a later point.

MINIO_KMS_KES_ENCLAVE

Use this optional environment variable to define the name of a KES enclave. A KES enclave provides an isolated space for its associated keys separate from other enclaves on a stateful KES server.

If not set, MinIO does not send enclave information. For a stateful KES server, this results in using the default enclave.