mc admin kms key

The mc admin kms key command manages the master keys that a MinIO AIStor deployment uses for Server-Side Encryption (SSE).

The command operates on the key manager configured for the target deployment, either MinIO KMS or the legacy Key Encryption Service (KES).

Key creation is not available when the deployment uses a static key (MINIO_KMS_SECRET_KEY or MINIO_KMS_SECRET_KEY_FILE). A static key implements only a subset of the KMS API. Use MinIO KMS or KES to create and manage keys.

Syntax

mc admin kms key create

Creates a new master key on the deployment’s key manager.

mc admin kms key create TARGET [KEY_NAME]

The command accepts the following arguments:

  • TARGET

    The alias of a configured MinIO AIStor deployment.

  • KEY_NAME

    The name of the new master key. Omit this argument to create the deployment’s default key.

For example, the following command creates a master key named data-bucket-encryption-key on the deployment aliased object-store:

mc admin kms key create object-store data-bucket-encryption-key

Use the created key to enable bucket-default SSE-KMS or to encrypt individual objects.

mc admin kms key status

Reports whether the deployment can perform encryption and decryption with a master key.

mc admin kms key status TARGET [KEY_NAME]

The command accepts the following arguments:

  • TARGET

    The alias of a configured MinIO AIStor deployment.

  • KEY_NAME

    The name of a master key. Omit this argument to check the deployment’s default key.

The command returns output similar to the following:

Key: data-bucket-encryption-key
   - Encryption ✔
   - Decryption ✔

Use this command to verify that the deployment can reach its key manager and use the specified key.

mc admin kms key list

Lists the master keys available to a MinIO AIStor deployment.

mc admin kms key list TARGET

The command accepts the following argument:

  • TARGET

    The alias of a configured MinIO AIStor deployment.