Table of Contents
MinIO requires clients authenticate using AWS Signature Version 4
protocol with support for the deprecated
Signature Version 2 protocol. Specifically, clients must authenticate by
presenting a valid access key and secret key to access any S3 or MinIO
administrative API, such as
S3-compatible SDKs, including those provided by MinIO, typically include
built-in helpers for creating the necessary signatures using an access key
and secret key.
MinIO supports both internal and external identity management:
IDentity Provider (IDP)
Provides built-in identity management functionality.
Supports managing identities through an OpenID Connect (OIDC) compatible service.
Supports managing identities through an Active Directory or LDAP service.
Once authenticated, MinIO either allows or rejects the client request depending on whether or not the authenticated identity is authorized to perform the operation on the specified resource.
MinIO uses Policy-Based Access Control (PBAC) to define the authorized actions and resources to which an authenticated user has access. Each policy describes one or more actions and conditions that outline the permissions of a user or group of users. By default, MinIO denies access to actions or resources not explicitly referenced in a user’s assigned or inherited policies. MinIO manages the creation and storage of policies and does not support external authorization management.
MinIO PBAC is built for compatibility with AWS IAM policy syntax, structure, and behavior. The MinIO documentation makes a best-effort to cover IAM-specific behavior and functionality. Consider deferring to the IAM documentation for more complete documentation on IAM, IAM policies, or IAM JSON syntax.
MinIO supports end-to-end encryption of objects over-the-wire (network encryption) and on read/write (at-rest).
MinIO supports Transport Layer Security (TLS) encryption of incoming and outgoing traffic.
TLS is the successor to Secure Socket Layer (SSL) encryption. SSL is fully deprecated as of June 30th, 2018. MinIO uses only supported (non-deprecated) TLS protocols (TLS 1.2 and later).
See Transport Layer Security (TLS) for more complete documentation.
MinIO supports Server-Side Object Encryption (SSE) of objects, where MinIO uses a secret key to encrypt and store objects on disk (encryption at-rest). MinIO SSE requires Transport Layer Security (TLS). See Encryption and Key Management for more complete documentation.