Silo Client Administration

• 1: mc admin accesskey
• 2: mc admin accesskey create
• 3: mc admin cluster bucket import
• 4: mc admin cluster iam import
• 5: mc admin policy attach
• 6: mc admin prometheus generate
• 7: mc admin scanner status
• 8: mc admin user add
• 9: mc admin user svcacct add
• 10: mc admin accesskey disable
• 11: mc admin cluster bucket
• 12: mc admin cluster bucket export
• 13: mc admin cluster iam export
• 14: mc admin policy create
• 15: mc admin prometheus metrics
• 16: mc admin scanner trace
• 17: mc admin user disable
• 18: mc admin user svcacct disable
• 19: mc admin cluster iam
• 20: mc admin policy detach
• 21: mc admin user accesskey edit
• 22: mc admin user enable
• 23: mc admin user svcacct edit
• 24: mc admin accesskey enable
• 25: mc admin config
• 26: mc admin policy entities
• 27: mc admin user info
• 28: mc admin user svcacct enable
• 29: mc admin accesskey info
• 30: mc admin decommission
• 31: mc admin policy info
• 32: mc admin user ls
• 33: mc admin user svcacct info
• 34: mc admin accesskey ls
• 35: mc admin group
• 36: mc admin policy ls
• 37: mc admin user rm
• 38: mc admin user svcacct ls
• 39: mc admin accesskey rm
• 40: mc admin heal
• 41: mc admin policy rm
• 42: mc admin user sts info
• 43: mc admin user svcacct rm
• 44: mc admin info
• 45: mc admin user svcacct
• 46: mc admin kms key
• 47: mc admin logs
• 48: mc admin policy
• 49: mc admin prometheus
• 50: mc admin rebalance
• 51: mc admin replicate
• 52: mc admin scanner
• 53: mc admin service
• 54: mc admin trace
• 55: mc admin update
• 56: mc admin user

mc admin [FLAGS] COMMAND [ARGUMENTS]

bash +o history
mc config host add <ALIAS> <ENDPOINT> ACCESS_KEY SECRET_KEY
bash -o history

mc admin info <ALIAS>

1 - mc admin accesskey

These commands replace the MinIO IDP functionality of the mc admin user svcacct command and its subcommands.

Description

The mc admin accesskey command and its subcommands create and manage Access Keys for internally managed users on a MinIO deployment.

Each access key is linked to a user identity and inherits the policies attached to its parent user or those groups in which the parent user has membership. Each access key also supports an optional inline policy which further restricts access to a subset of actions and resources available to the parent user.

mc admin user svcacct only supports creating access keys for MinIO-managed accounts.

To create access keys for Active Directory/LDAP-managed accounts, use mc idp ldap accesskey and its subcommands. To manage access keys for OpenID Connect-managed users, log into the MinIO Console and generate the access keys through the UI.

mc admin accesskey command has the following subcommands:

2 - mc admin accesskey create

Syntax

The mc admin accesskey create command adds a new access key and secret key pair for an existing MinIO user.

mc admin accesskey create        \
   myminio/ myuser               \
   --access-key myuseraccesskey  \
   --secret-key myusersecretkey  \
   --policy /path/to/policy.json

mc [GLOBALFLAGS] admin accesskey create                    \
                                 ALIAS                     \
                                 [USER]                    \
                                 [--access-key string]     \
                                 [--secret-key string]     \
                                 [--policy path]           \
                                 [--name string]           \
                                 [--description string]    \
                                 [--expiry-duration value] \
                                 [--expiry date]

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

USER

mc-cmd

Optional

The username of the user to which MinIO adds the new access key. If not specified, MinIO generates an access key/secret key pair for the authenticated user.

--access-key

mc-cmd

Optional

A string to use as the access key for this account. Omit to let MinIO autogenerate a random 20 character value.

Access Key names must be unique across all users.

--description

mc-cmd

Optional

Add a description for the access key. For example, you might specify the reason the access key exists.

--expiry

mc-cmd

Optional

Set an expiration date for the access key. The date must be in the future. You may not set an expiration date that has already passed.

Allowed date and time formats:

• 2024-10-24
• 2024-10-24T10:00
• 2024-10-24T10:00:00
• 2024-10-24T10:00:00Z
• 2024-10-24T10:00:00-07:00

Mutually exclusive with --expiry-duration.

--expiry-duration

mc-cmd

Optional

Length of time for which the accesskey remains valid. Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h”.

The following expires the credentials after 30 days:

--expiry-duration 720h

Mutually exclusive with --expiry.

--name

mc-cmd

Optional

Add a human-readable name for the access key.

--policy

mc-cmd

Optional

The readable path to a policy document to attach to the new access key, with a maximum size of 2048 characters. The attached policy cannot grant access to any action or resource not explicitly allowed by the parent user’s policy or group policies

--secret-key

mc-cmd

Optional

The secret key to associate with the new account. Omit to let MinIO autogenerate a random 40-character value.

Global Flags

This command supports any of the global flags.

Examples

Create access key / secret key pair for the authenticated user

The following command generates a new, random access key and secret key pair for the user currently logged in to MinIO deployment at the alias myminio. The access key and secret key have the same access policies as the authenticated user.

mc admin accesskey create myminio/

Create a custom access key / secret key pair for the authenticated user

The following command creates a new access key and secret key pair for the user currently logged in to MinIO at the alias myminio. The access key and secret key have the same access policies as the authenticated user.

mc admin accesskey create myminio/ --access-key myaccesskey --secret-key mysecretkey

Create an access key / secret key pair for another user with limited duration

The following command creates a new access key and secret key pair for a user, miniouser on the alias myminio. The access key and secret key have the same access policies as miniouser. The credentials remain valid for 24 hours after creation.

mc admin accesskey create myminio/ miniouser --expiry-duration 24h

Create access key / secret key pair for the authenticated user that expires

The following command generates a new and random access key and random secret key pair for the user currently logged in to MinIO deployment at the alias myminio. The access key and secret key have the same access policies as the authenticated user. The credentials expire on the fifteenth day of January, 2025.

mc admin accesskey create myminio/ --expiry 2025-01-15

The date specified must be a future date. For valid datetime formats, see the --expiry flag.

Create access key / secret key pair for a different user with custom access

The following command creates a new access key and secret key pair for the user, miniouser on the alias myminio. The access key and secret key have a more limited set of access than miniouser, as specified in the policy JSON file.

mc admin accesskey create myminio/ miniouser --policy /path/to/policy.json

The specified policy file must not grant access to anything to which miniouser does not already have access.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

3 - mc admin cluster bucket import

Description

The mc admin cluster bucket import command imports bucket metadata as created by the mc admin cluster bucket export command.

You can use this command to manually restore the metadata to the specified bucket on a MinIO deployment.

If you specify only the deployment as the target, this command applies the metadata objects to all matching buckets on the target.

mc admin cluster bucket import myminio ~/minio-metadata-backup/myminio-cluster.zip

mc [GLOBALFLAGS] admin cluster bucket import  \
                                    ALIAS[/BUCKET] \
                                    METADATA.ZIP

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

METADATA.ZIP

mc-cmd

Required

The path to the metadata file to import.

Use mc admin cluster bucket export to export bucket metadata for use with this command.

BUCKET

mc-cmd

Optional

The bucket to apply the imported metadata to.

Global Flags

This command supports any of the global flags.

4 - mc admin cluster iam import

Description

The mc admin cluster iam import command imports IAM metadata as created by the mc admin cluster iam export command.

You can use this command to manually restore IAM metadata settings for a MinIO deployment.

mc admin cluster iam import myminio ~/minio-metadata-backup/myminio-cluster.zip

mc [GLOBALFLAGS] admin cluster iam import  \
                                   ALIAS \
                                   IAM-METADATA.ZIP

Starting with RELEASE.2023-05-04T18-10-16Z, mc admin cluster iam import adds support for aliases ending with a trailing forward slash ALIAS/. Prior to this release, the command would fail when provided a trailing forward slash.

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

IAM-METADATA.ZIP

mc-cmd

Required

The path to the IAM metadata file to import.

Use the mc admin cluster iam export to export IAM metadata for use with this command.

Global Flags

This command supports any of the global flags.

5 - mc admin policy attach

Syntax

Attaches one or more IAM policies to either a MinIO-managed user or a group.

Exactly one --user or one --group is required.

mc admin policy attach myminio readonly --user james

mc admin policy attach                       \
                TARGET                       \
                POLICY                       \
                [POLICY...]                  \
                [--user USER | --group GROUP]

Parameters

The mc admin policy attach command accepts the following arguments:

TARGET

mc-cmd

Required

The alias of a configured MinIO deployment with the user or group for which you want to attach one or more policies.

POLICY

mc-cmd

Required

The name of the policy to attach to either the user or the group.

You may attach multiple policies at once by separating each policy name with a space.

MinIO deployments include the following built-in policies by default:

• readonly
• readwrite
• diagnostics
• writeonly

--user

mc-cmd

Optional

The username of the identity you want to attach the policy or policies to. You may only list one user.

You must include either the --user flag or the --group flag. You may not use the --user flag at the same time as the --group flag.

--group

mc-cmd

Optional

The name of the group identity you want to attach the policy or policies to. You may only list one group.

All users with membership in the group inherit the policies associated to the group.

You must include either the --group flag or the --user flag. You may not use the --group flag at the same time as the --user flag.

Global Flags

This command supports any of the global flags.

Examples

Attach the readonly policy to user james on the deployment at alias myminio.

mc admin policy attach myminio readonly --user james

Attach the audit-policy and acct-policy policies to group legal on the deployment at alias myminio.

mc admin policy attach myminio audit-policy acct-policy --group legal

6 - mc admin prometheus generate

Description

The mc admin prometheus generate command generates a metrics scraping configuration file for use with Prometheus.

For more complete documentation on using MinIO with Prometheus, see How to monitor MinIO server with Prometheus

Starting with MinIO Server RELEASE.2024-07-15T19-02-30Z and MinIO Client RELEASE.2024-07-11T18-01-28Z, metrics version 3 (v3) provides additional endpoints and metrics. To generate a v3 scrape configuration use the --api_version v3 option.

MinIO recommends new deployments use version 3 (v3). Existing deployments can continue to use metrics version 2

mc admin prometheus generate myminio bucket

mc [GLOBALFLAGS] admin prometheus generate                                        \
                                  ALIAS                                           \
                                  [TYPE]                                          \
                                  [--api_version v3]                              \
                                  [--bucket <bucket name>]

Parameters

ALIAS

mc-cmd

Required

The alias of a configured MinIO deployment for which the command generates a Prometheus-compatible configuration file.

--api-version

mc-cmd

Optional

To generate a scrape configuration for v3 metrics, include an --api-version v3 parameter. v3 is the only accepted value.

Omit --api-version to generate a v2 metrics configuration.

--bucket

mc-cmd

Optional

Only valid for v3 metrics.

For v3 metric types that return bucket-level metrics, specify a bucket name. Requires --api-version.

--bucket works for the following v3 metric types:

• api
• replication

The following example generates a configuration for API metrics from the bucket mybucket:

mc admin prometheus generate ALIAS api --bucket mybucket --api-version v3

TYPE

mc-cmd

Optional

The type of metrics to scrape.

Valid values for metrics version 3 are:

• api
• audit
• cluster
• debug
• ilm
• logger
• notification
• replication
• scanner
• system

If not specified, a v3 command returns all metrics.

Valid values for metrics version 2 are:

• bucket
• cluster
• node
• resource

If not specified, a v2 command returns cluster metrics. Cluster metrics include rollups of certain node metrics.

Global flags

This command supports any of the global flags.

Examples

Generate a default metrics v3 config

Use mc admin prometheus generate --api-version v3 to generate a scrape configuration that collects all v3 metrics for a MinIO deployment:

mc admin prometheus generate ALIAS --api-version v3

• Replace ALIAS with the alias of the MinIO deployment.

The output resembles the following:

scrape_configs:
- job_name: minio-job
  bearer_token: [auth token]
  metrics_path: /minio/metrics/v3
  scheme: http
  static_configs:
  - targets: ['localhost:9000']

Generate a v3 metrics config for another type

To generate a configuration for another metric type, specify the type. The following generates a scrape configuration for v3 cluster metrics:

mc admin prometheus generate ALIAS cluster --api-version v3

• Replace ALIAS with the alias of the MinIO deployment.

The output resembles the following:

scrape_configs:
- job_name: minio-job-cluster
  bearer_token: [auth token]
  metrics_path: /minio/metrics/v3/cluster
  scheme: http
  static_configs:
  - targets: ['localhost:9000']

To generate a configuration for a different metric type, replace cluster with the desired type.

Generate a v3 bucket replication metrics config

The following example generates a scrape configuration for v3 replication metrics of bucket mybucket:

mc admin prometheus generate ALIAS replication --bucket mybucket --api-version v3

• Replace ALIAS with the alias of the MinIO deployment.

The output resembles the following:

scrape_configs:
- job_name: minio-job-replication
  bearer_token: [auth token]
  metrics_path: /minio/metrics/v3/bucket/replication/mybucket
  scheme: https
  static_configs:
  - targets: [`localhost:9000`]

Generate a v3 config for bucket API metrics

The following example generates a scrape configuration for v3 API metrics for bucket mybucket:

mc admin prometheus generate ALIAS api --bucket mybucket --api-version v3

• Replace ALIAS with the alias of the MinIO deployment.

The output resembles the following:

scrape_configs:
- job_name: minio-job-api
  bearer_token: [auth token]
  metrics_path: /minio/metrics/v3/bucket/api/mybucket
  scheme: https
  static_configs:
  - targets: [`localhost:9000`]

Generate a default metrics v2 config

By default, mc admin prometheus generate generates a scrape configuration for v2 cluster metrics:

mc admin prometheus generate ALIAS

• Replace ALIAS with the alias of the MinIO deployment.

The output resembles the following:

scrape_configs:
- job_name: minio-job
  bearer_token: [auth token]
  metrics_path: /minio/v2/metrics
  scheme: http
  static_configs:
  - targets: ['localhost:9000']

Generate a v2 config for other metric types

To generate a configuration for another metric type, specify the type. The following generates a scrape configuration for v2 bucket metrics:

mc admin prometheus generate ALIAS bucket

7 - mc admin scanner status

Description

The mc admin scanner status command displays a real-time summary of scanner information for a MinIO Server.

This command has an alias of mc admin scanner info.

mc admin scanner status myminio

Overall Statistics
------------------
Last full scan time:   0d0h15m; Estimated 2879.79/month
Current cycle:         (between cycles)
Active drives: 0

Last Minute Statistics
----------------------
Objects Scanned:       3 objects; Avg: 67.611µs; Rate: 4320/day
Versions Scanned:      3 versions; Avg: 2.506µs; Rate: 4320/day
Versions Heal Checked: 0 versions; Avg: 0ms
Read Metadata:         3 objects; Avg: 40.817µs, Size: 395 bytes/obj
ILM checks:            3 versions; Avg: 714ns
Check Replication:     3 versions; Avg: 892ns
Verify Deleted:        0 folders; Avg: 0ms
Yield:                 18ms total; Avg: 6ms/obj

mc admin scanner status ALIAS
                       [--bucket <string>]     \
                       [--interval <value>]   \
                       [--max-paths <value>]  \
                       [-n <integer>]         \
                       [--nodes <string>]

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment for which to display scanner API operations.

--bucket

mc-cmd

Optional

Filter scanner statistics to the specified bucket.

--interval

mc-cmd

Optional

The number of seconds to wait between status request refreshes. If not specified, the status refreshes every 3 seconds.

--max-paths

mc-cmd

Optional

The maximum number of active paths to show. Use -1 for an unlimited number of paths.

Limiting the number of paths shown can reduce the scrolling of the console window when there are a large number of drives being scanned.

If not specified, the results return for an unlimited number of active paths.

-n

mc-cmd

Optional

The number of status requests to return before automatically exiting. Use 0 to return an unlimited number of status results.

If not specified, the results continuously refresh at the specified interval until manually exited.

--nodes

mc-cmd

Optional

Returns scanner status information for the specified node(s). Specify multiple nodes as a comma-separated list.

Global Flags

This command supports any of the global flags.

8 - mc admin user add

Syntax

The mc admin user add command adds a new MinIO user to the target MinIO deployment.

To manage external Identity Provider users, see OIDC or AD/LDAP.

mc admin user add myminio newuser newusersecret

mc [GLOBALFLAGS] admin user add        \
                            ALIAS      \
                            ACCESSKEY  \
                            SECRETKEY

Parameters

ACCESSKEY

mc-cmd

Required

The access key that uniquely identifies the new user, similar to a username.

ALIAS

mc-cmd

Required

The alias of a configured MinIO deployment on which to create the new user.

SECRETKEY

mc-cmd

Required

The secret key for the new user. Consider the following guidance when creating a secret key:

• The key should be unique
• The key should be long (Greater than 12 characters)
• The key should be complex (A mixture of characters, numerals, and symbols)

Global Flags

This command supports any of the global flags.

Example

Create a New User

Use mc admin user add to create a user on a MinIO deployment:

   mc admin user add ALIAS ACCESSKEY SECRETKEY

• Replace ALIAS with the alias of the MinIO deployment.
• Replace ACCESSKEY with the access key for the user.
• Replace SECRETKEY with the secret key for the user. MinIO does not provide any method for retrieving the secret key once set.

Specify a unique, random, and long string for both the ACCESSKEY and SECRETKEY. Your organization may have specific internal or regulatory requirements around generating values for use with access or secret keys.

Behavior

New Users Have No Default Policies

Newly created users have no policies by default and therefore cannot perform any operations on the MinIO deployment. To configure a user’s assigned policies, you can do either or both of the following:

• Use mc admin policy attach to associate one or more policies to the user.
• Use mc admin group add to associate the user to the group. Users inherit any policies assigned to the group.

For more information on MinIO users and groups, see User Management and Group Management. For more information on MinIO policies, see MinIO Policy Based Access Control.

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

9 - mc admin user svcacct add

Syntax

The mc admin user svcacct add command adds a new access key to an existing MinIO or AD/LDAP user.

mc admin user svcacct add                       \
   --access-key "myuserserviceaccount"          \
   --secret-key "myuserserviceaccountpassword"  \
   --policy "/path/to/policy.json"              \
   myminio myuser

mc [GLOBALFLAGS] admin user svcacct add             \
                                    [--access-key]  \
                                    [--secret-key]  \
                                    [--policy]      \
                                    [--comment]     \
                                    ALIAS           \
                                    USER

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

USER

mc-cmd

Required

The username of the user to which MinIO adds the new access key.

• For MinIO-managed users, specify the access key for the user.
• For Active Directory/LDAP users, specify the Distinguished Name of the user.
• For OpenID Connect users, use the MinIO Console to generate access keys.

--access-key

mc-cmd

Optional

A string to use as the access key for this account. Omit to let MinIO autogenerate a random 20 character value.

Access Key names must be unique across all users.

--comment

mc-cmd

Optional

This option has been removed. Use --description or --name instead.

--description

mc-cmd

Optional

Add a description for the service account. For example, you might specify the reason the service account exists.

--expiry

mc-cmd

Optional

Set an expiration date for the service account. The date must be in the future, you may not set an expiration date that has already passed.

Allowed date and time formats:

• 2023-06-24
• 2023-06-24T10:00
• 2023-06-24T10:00:00
• 2023-06-24T10:00:00Z
• 2023-06-24T10:00:00-07:00

--name

mc-cmd

Optional

Add a human-readable name for the service account.

--policy

mc-cmd

Optional

The path to a policy document to attach to the new access key, with a maximum size of 2048 characters. The attached policy cannot grant access to any action or resource not explicitly allowed by the parent user’s policies.

--secret-key

mc-cmd

Optional

The secret key to associate with the new account. Omit to let MinIO autogenerate a random 40-character value.

Global Flags

This command supports any of the global flags.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

10 - mc admin accesskey disable

Syntax

The mc admin accesskey disable command disables an existing access key for a MinIO IDP user.

mc admin accesskey disable myminio myuserserviceaccount

mc [GLOBALFLAGS] admin accesskey disable         \
                                 ALIAS           \
                                 SERVICEACCOUNT

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

SERVICEACCOUNT

mc-cmd

Required

The access key to disable.

Global Flags

This command supports any of the global flags.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

11 - mc admin cluster bucket

Description

The mc admin cluster bucket command and its subcommands provide tools for manually importing and exporting MinIO bucket metadata.

This metadata includes configurations related to features like lifecycle management rules. You can use this metadata as a snapshot of the bucket configuration for restoration later, such as part of BC/DR or backup/restore operations.

You can use this command on individual buckets or on all buckets in a MinIO deployment. For automatic synchronization of all buckets in a deployment to a remote site, use site replication.

The mc admin cluster bucket command has the following subcommands:

12 - mc admin cluster bucket export

Description

The mc admin cluster bucket export command exports bucket metadata for use with the mc admin cluster bucket import command.

You can use this command to manually back up the metadata for the specified MinIO bucket. The command always saves the output as cluster-metadata.zip.

If you specify only the deployment as the target, this command backs up all bucket metadata on the target deployment.

mc admin cluster bucket export myminio

mc [GLOBALFLAGS] admin cluster bucket export  \
                                      ALIAS[/BUCKET]

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

BUCKET

mc-cmd

Optional

The bucket to export metadata for.

Global Flags

This command supports any of the global flags.

13 - mc admin cluster iam export

Description

The mc admin cluster iam export command exports IAM metadata for use with the mc admin cluster iam import command.

The command saves the output as ALIAS-iam-metadata.zip, where ALIAS is the alias of the MinIO deployment.

mc admin cluster iam export myminio

mc [GLOBALFLAGS] admin cluster iam export ALIAS  \
                 [--output, -o <string>]

Starting with RELEASE.2023-05-04T18-10-16Z, mc admin cluster iam export adds support for aliases ending with a trailing forward slash ALIAS/. Prior to this release, the command would fail when provided a trailing forward slash.

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment to export IAM metadata for.

--output, --o

mc-cmd

Optional

Specify a custom file and path to use when exporting the IAM data.

Global Flags

This command supports any of the global flags.

Examples

Download all IAM metadata for a cluster to a ZIP file

The following command downloads all IAM metadata for the cluster at alias myminio, then stores the metadata to a ZIP file.

mc admin cluster iam export myminio

The ZIP file is named <alias>-iam-info.zip where <alias> is the alias of the cluster. For the above example, the file is named myminio-iam-info.zip.

The file is placed in the current active directory path.

Download all IAM metadata for a cluster and specify the name and path of the ZIP file

The following command downloads all IAM metadata for the cluster at alias myminio, then stores the metadata to a ZIP file at /tmp/myminio-iam.zip.

mc admin cluster iam export myminio --output /tmp/myminio-iam.zip

14 - mc admin policy create

Syntax

Creates a new policy on the target MinIO deployment.

MinIO deployments include the following built-in policies by default:

• readonly
• readwrite
• diagnostics
• writeonly

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Action": [
            "s3:ListAllMyBuckets"
         ],
         "Resource": [
            "arn:aws:s3:::*"
         ]
      }
   ]
}

mc admin policy create myminio listmybuckets /tmp/listmybuckets.json

mc admin policy create     \
                TARGET     \
                POLICYNAME \
                POLICYPATH

Parameters

The mc admin policy create command accepts the following arguments:

TARGET

mc-cmd

The alias of a configured MinIO deployment on which to add the new policy.

POLICYNAME

mc-cmd

The name of the policy to add.

Specifying the name of an existing policy overwrites that policy on the TARGET MinIO deployment.

POLICYPATH

mc-cmd

The file path of the policy to add. The file must be a JSON-formatted file with IAM-compatible syntax and no more than 2048 characters.

Global Flags

This command supports any of the global flags.

Examples

Create a new policy called writeonly from the JSON file at /tmp/writeonly.json on the deployment at the alias myminio.

mc admin policy create myminio writeonly /tmp/writeonly.json

15 - mc admin prometheus metrics

Description

The mc admin prometheus metrics command prints Prometheus metrics for a cluster.

The output includes additional information about each metric, such as if its value is a counter or gauge.

For more complete documentation on using MinIO with Prometheus, see How to monitor MinIO server with Prometheus

Starting with MinIO Server RELEASE.2024-07-15T19-02-30Z and MinIO Client RELEASE.2024-07-11T18-01-28Z, metrics version 3 (v3) provides additional endpoints and metrics. To print v3 metrics use the --api_version v3 option.

MinIO recommends new deployments use version 3 (v3). Existing deployments can continue to use metrics version 2

mc admin prometheus metrics myminio cluster

mc [GLOBALFLAGS] admin prometheus metrics  \
                                  ALIAS                                           \
                                  [TYPE]                                          \
                                  [--api_version v3]                              \
                                  [--bucket <bucket name>]

Parameters

ALIAS

mc-cmd

Required

The alias of a configured MinIO deployment for which the command prints metrics.

--api-version

mc-cmd

Optional

To print version 3 (v3) metrics, include an --api-version v3 parameter. v3 is the only accepted value.

Omit --api-version to print version 2 (v2) metrics.

--bucket

mc-cmd

Optional

Requires --api-version. For v3 metric types that return bucket-level metrics, specify a bucket name.

--bucket works for the following v3 metric types:

• api
• replication

The following example prints API metrics for the bucket mybucket:

mc admin prometheus metrics ALIAS api --bucket mybucket --api-version v3

TYPE

mc-cmd

Optional

The type of metrics to print.

Valid values for metrics version 3 are:

• api
• audit
• cluster
• debug
• ilm
• logger
• notification
• replication
• scanner
• system

If not specified, a v3 command returns all metrics.

Valid values for metrics version 2 are:

• bucket
• cluster
• node
• resource

If not specified, a v2 command returns cluster metrics. Cluster metrics include rollups of certain node metrics.

Global flags

This command supports any of the global flags.

Examples

Print v3 metrics

Use mc admin prometheus metrics --api-version v3 to print all available v3 metrics and their current values for a MinIO deployment:

mc admin prometheus metrics ALIAS --api-version v3

• Replace ALIAS with the alias of the MinIO deployment.

To print a specific type of metrics, include the TYPE. The following prints all scanner metrics for a deployment:

mc admin prometheus metrics ALIAS scanner --api-version v3

Print v3 API or bucket replication metrics

Certain v3 metric types accept a --bucket parameter to specify the bucket for which to print metrics. The following example prints v3 replication metrics for bucket mybucket:

mc admin prometheus metrics ALIAS replication --bucket mybucket --api-version v3

• Replace ALIAS with the alias of the MinIO deployment.

To print API metrics for the bucket, replace replication with api.

Print v2 cluster metrics

By default, mc admin prometheus metrics prints v2 cluster metrics:

mc admin prometheus metrics ALIAS

• Replace ALIAS with the alias of the MinIO deployment.

Print other types of v2 metrics

To print another type of v2 metrics, specify the desired TYPE. The following example prints v2 bucket metrics:

mc admin prometheus metrics ALIAS bucket

Accepted values are bucket, cluster, node, and resource.

16 - mc admin scanner trace

Description

The mc admin scanner trace command displays scanner-specific API operations occurring on the target MinIO deployment.

mc admin scanner trace myminio

mc admin scanner trace ALIAS
                       [--filter-request]            \
                       [--filter-response]           \
                       [--filter-size <value>]       \
                       [--funcname <value>]          \
                       [--node <value>]              \
                       [--path <value>]              \
                       [--response-duration <value>] \
                       [--verbose, -v]

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment for which to display scanner API operations.

--filter-request

mc-cmd

Optional

Trace scanner operations or calls with request size greater than the specified --filter-size value.

Must be used with --filter-size flag.

--filter-response

mc-cmd

Optional

Trace scanner operations or calls with response size greater than the specified --filter-size value.

Must be used with --filter-size flag.

--filter-size

mc-cmd

Optional

Filter output to request sizes or response sizes greater than the specified size.

Must be used with either --filter-request or --filter-response flag.

Valid units include:

--funcname

mc-cmd

Optional

Returns calls for the entered function name.

--node

mc-cmd

Optional

Returns calls for the specified server.

--path

mc-cmd

Optional

Returns calls for the specified path.

--response-duration

mc-cmd

Optional

Trace calls with response duration greater than the specified value.

--verbose, -v

mc-cmd

Optional

Returns verbose output.

Global Flags

This command supports any of the global flags.

Examples

Monitor all scanner API operations

Use mc admin scanner trace to monitor scanner API operations on the MinIO deployment at the alias myminio:

mc admin scanner trace myminio

Show scanner trace for a specific path

Use mc admin scanner trace to monitor API operations for a the path my-bucket/my-prefix/* on the deployment at the myminio alias:

 mc admin scanner trace --path my-bucket/my-prefix/* myminio

Show scanner API operations for the scanObject function

Monitor scanner activity for the scanObject function on the myminio deployment:

mc admin scanner trace --funcname=scanner.ScanObject myminio

Show scanner operation requests greater than 1MB in size

Use mc admin scanner trace to monitor requests larger than a 1MB on the myminio deployment:

mc admin scanner trace --filter-request --filter-size 1MB myminio

Show scanner operation responses greater than 1MB in size

Use mc admin scanner trace to monitor large response sizes:

 mc admin scanner trace --filter-response --filter-size 1MB myminio

Show scanner operations that last longer than five milliseconds

Use mc admin scanner trace to monitor long operations:

 mc admin scanner trace --response-duration 5ms myminio

17 - mc admin user disable

Syntax

The mc admin user disable command disables a MinIO user on the target MinIO deployment.

Clients cannot use the user credentials to authenticate to the MinIO deployment. Disabling a user does not remove that user from the deployment. Use mc admin user enable to enable a disabled user on a MinIO deployment.

To manage external Identity Provider users, see OIDC or AD/LDAP.

mc admin user disable myminio myuser

mc [GLOBALFLAGS] admin user disable   \
                            ALIAS     \
                            USERNAME

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment with the user to disable.

USERNAME

mc-cmd

Required

The username of the user to disable.

Global Flags

This command supports any of the global flags.

Example

Disable a User

Use mc admin user disable to disable a user on a MinIO deployment.

mc admin user disable ALIAS USERNAME

• Replace ALIAS with the alias of the MinIO deployment.
• Replace USERNAME with the username of the user to disable.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

18 - mc admin user svcacct disable

Syntax

The mc admin user svcacct disable command disables an existing access key.

mc admin user svcacct disable myminio myuserserviceaccount

mc [GLOBALFLAGS] admin user svcacct disable         \
                                    ALIAS           \
                                    SERVICEACCOUNT

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

SERVICEACCOUNT

mc-cmd

Required

The service account access key to disable.

Global Flags

This command supports any of the global flags.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

19 - mc admin cluster iam

Description

The mc admin cluster iam command and its subcommands provide tools for manually importing and exporting MinIO identity and access management (IAM) metadata.

For automatic synchronization of all IAM configurations in a deployment to a remote site, use site replication.

The mc admin cluster iam command has the following subcommands:

20 - mc admin policy detach

Syntax

Remove one or more IAM policies from either a MinIO-managed user or a group.

Exactly one --user or one --group is required.

mc admin policy detach myminio readonly --user james

mc admin policy detach TARGET                         \
                       POLICY                         \
                       [POLICY...]                    \
                       [--user USER | --group GROUP]

Parameters

The mc admin policy detach command accepts the following arguments:

TARGET

mc-cmd

Required

The alias of a configured MinIO deployment with the user or group for which you want to detach one or more policies.

POLICY

mc-cmd

Required

The name of the policy to detach from either the user or the group. You may detach multiple policies at once by separating each policy name with a space.

MinIO deployments include the following built-in policies by default:

• readonly
• readwrite
• diagnostics
• writeonly

--user

mc-cmd

Optional

The username of the identity you want to detach the policy or policies from. You may only list one user.

You must include either the --user flag or the --group flag. You may not use the --user flag at the same time as the --group flag.

--group

mc-cmd

Optional

The name of the group identity you want to detach the policy or policies from. You may only list one group.

All users with membership in the group lose access to any permissions granted by the policies associated to the group, unless those are granted by other policies or groups the users belong to.

You must include either the --group flag or the --user flag. You may not use the --group flag at the same time as the --user flag.

Global Flags

This command supports any of the global flags.

Examples

Detach the policy readonly from the user james on the deployment at alias myminio.

mc admin policy detach myminio readonly --user james

Detach the audit-policy and acct-policy policies from group legal on the deployment at alias myminio.

mc admin policy detach myminio audit-policy acct-policy --group legal

21 - mc admin user accesskey edit

Syntax

The mc admin accesskey edit command modifies the configuration of an access key associated to the specified user.

The command requires that at least one attribute of the access key change. Otherwise, the command exits with an error message.

mc admin accesskey edit                                             \
                   myminio myuserserviceaccount                     \
                   --secret-key "myuserserviceaccountnewsecretkey"  \
                   --policy "/path/to/new/policy.json"

mc [GLOBALFLAGS] admin accesskey edit                      \
                                 ALIAS                     \
                                 ACCESSKEY                 \
                                 [--description string]    \
                                 [--expiry-duration value] \
                                 [--expiry value]          \
                                 [--name string]           \
                                 [--policy path]           \
                                 [--secret-key string]

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

ACCESSKEY

mc-cmd

Required

The access key to modify.

--description

mc-cmd

Optional

Add or modify a description for the access key. For example, you might specify the reason the access key exists.

--expiry

mc-cmd

Optional

Set or modify an expiration date for the access key. The date must be in the future, you may not set an expiration date that has already passed.

Allowed date and time formats:

• 2023-06-24
• 2023-06-24T10:00
• 2023-06-24T10:00:00
• 2023-06-24T10:00:00Z
• 2023-06-24T10:00:00-07:00

Mutually exclusive with --expiry-duration.

--expiry-duration

mc-cmd

Optional

Length of time for which the accesskey remains valid. Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h”.

To expire the credentials after 30 days, use:

--expiry-duration 720h

Mutually exclusive with --expiry.

--name

mc-cmd

Optional

Add or modify a human-readable name for the access key.

--policy

mc-cmd

Optional

The path to a policy document to attach to the new access key, with a maximum size of 2048 characters. The attached policy cannot grant access to any action or resource not explicitly allowed by the parent user’s policies.

The new policy overwrites any previously attached policy.

--secret-key

mc-cmd

Optional

The secret key to associate with the new access key. Overwrites the previous secret key. Applications using the access keys must update to use the new credentials to continue performing operations.

Global Flags

This command supports any of the global flags.

Examples

Change the secret key for an access key

The following command modifies the secret key for the access key myuseraccesskey on the myminio deployment.

mc admin accesskey edit myminio/ myuseraccesskey --secret-key 'new-secret-key-change-me'

Change the expiration for an access key

The following command changes the expiration value for the access key myuseraccesskey on the myminio deployment.

mc admin accesskey edit myminio/ myuseraccesskey --expiry-duration 24h

The --expiry-duration cannot be added if the access key already has a value set for --expiry.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

22 - mc admin user enable

Syntax

The mc admin user enable command enables a MinIO user on the target MinIO deployment.

Clients can only use enabled users to authenticate to the MinIO deployment. Users created using mc admin user add are enabled by default.

To manage external Identity Provider users, see OIDC or AD/LDAP.

mc admin user enable myminio myuser

mc [GLOBALFLAGS] admin user enable    \
                            ALIAS     \
                            USERNAME

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment with the user to enable.

USERNAME

mc-cmd

Required

The username of the user to enable.

Global Flags

This command supports any of the global flags.

Example

Enable a User

Use mc admin user enable to enable a user on a MinIO deployment.

mc admin user enable ALIAS USERNAME

• Replace ALIAS with the alias of the MinIO deployment.
• Replace USERNAME with the username of the user to enable.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

23 - mc admin user svcacct edit

Syntax

The mc admin user svcacct edit command modifies the configuration of an access key associated to the specified user.

mc admin user svcacct edit                                             \
                      --secret-key "myuserserviceaccountnewsecretkey"  \
                      --policy "/path/to/new/policy.json"              \
                      myminio myuserserviceaccount

mc [GLOBALFLAGS] admin user svcacct edit            \
                                    [--secret-key]  \
                                    [--policy]      \
                                    ALIAS           \
                                    SERVICEACCOUNT

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

SERVICEACCOUNT

mc-cmd

Required

The service account to modify.

--description

mc-cmd

Optional

Add a description for the service account. For example, you might specify the reason the service account exists.

--expiry

mc-cmd

Optional

Set an expiration date for the service account. The date must be in the future, you may not set an expiration date that has already passed.

Allowed date and time formats:

• 2023-06-24
• 2023-06-24T10:00
• 2023-06-24T10:00:00
• 2023-06-24T10:00:00Z
• 2023-06-24T10:00:00-07:00

--name

mc-cmd

Optional

Add a human-readable name for the service account.

--policy

mc-cmd

Optional

The path to a policy document to attach to the new access key, with a maximum size of 2048 characters. The attached policy cannot grant access to any action or resource not explicitly allowed by the parent user’s policies.

The new policy overwrites any previously attached policy.

--secret-key

mc-cmd

Optional

The secret key to associate with the new access key. Overwrites the previous secret key. Applications using the access keys must update to use the new credentials to continue performing operations.

Global Flags

This command supports any of the global flags.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

24 - mc admin accesskey enable

Syntax

The mc admin accesskey enable command enables an existing access key.

mc admin accesskey enable myminio myuserserviceaccount

mc [GLOBALFLAGS] admin accesskey enable          \
                                 ALIAS           \
                                 SERVICEACCOUNT

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

SERVICEACCOUNT

mc-cmd

Required

The access key to enable.

Global Flags

This command supports any of the global flags.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

25 - mc admin config

Description

The mc admin config command manages configuration settings for the minio server.

Examples

Syntax

mc admin config set

mc-cmd

Sets a configuration key on the MinIO deployment. Configurations defined by environment variables override configurations defined by this command.

mc admin config get

mc-cmd

Gets a configuration key on the MinIO deployment created using mc admin config set.

mc admin config export

mc-cmd

Exports any configuration settings created using mc admin config set.

mc admin config history

mc-cmd

Lists the history of changes made to configuration keys by mc admin config.

Configurations defined by environment variables do not show.

mc admin config import

mc-cmd

Imports configuration settings exported using mc admin config export.

mc admin config reset

mc-cmd

Resets config to defaults. Configurations defined in environment variables are not affected.

mc admin config restore

mc-cmd

Roll back changes to configuration keys to a previous point in history.

Does not affect configurations defined by environment variables.

Configuration Settings

For a list of available configuration settings, see Settings Overview.

26 - mc admin policy entities

Syntax

List the entities associated with a policy, user, or group on a target MinIO deployment.

To list entities associated with an Active Directory or LDAP (AD/LDAP) configuration, use mc idp ldap policy entities.

For example, you can list all of the users and groups attached to a policy or list all of the policies attached to a specific user or group.

mc admin policy entities myminio/ --user bob

mc admin policy entities         \
                TARGET           \
                [--user value]   \
                [--group value]  \
                [--policy value]

Parameters

The mc admin policy entities command accepts the following arguments:

TARGET

mc-cmd

Required

The alias of a configured MinIO deployment on which to add the new policy.

--group

mc-cmd

Optional

The name of the group identity for which you want to list attached policies.

You may include multiple groups by repeating the flag multiple times. The command returns each group with a list of associated entities.

--policy

mc-cmd

Optional

The name of a policy for which to list associated entities.

You may include multiple policies by repeating the flag multiple times. The command returns each policy with a list of all associated entities.

--user

mc-cmd

Optional

The username of the identity for which you want to list attached policies.

You may include multiple users by repeating the flag multiple times. The command returns each user with a list of associated policies.

Global Flags

This command supports any of the global flags.

Examples

List all entities and policy associations for a deployment

The following command lists all policies and the entity mappings associated with them on the deployment at alias myminio.

mc admin policy entities myminio/

List entities associated with two different policies

The following command lists all entities associated with the policies inteam-policy and mlteam-policy on the deployment at alias myminio.

mc admin policy entities myminio/ --policy finteam-policy --policy mlteam-policy

List policies associated with two different users

The following command lists all policies associated with the users bob and james on the deployment at alias myminio.

The command outputs the list of policies associated with bob then the list of policies associated with james on the deployment at alias myminio.

mc admin policy entities myminio/ --user bob --user james

List policies associated with two different groups

The following command lists all policies associated with the groups auditors and accounting on the deployment at alias myminio.

The command outputs the list of policies associated with the group auditors then the list of policies associated with the group accounting on the deployment at alias myminio.

mc admin policy entities play/ --group auditors --group accounting

List policies associated with a policy, a group, and a user

The following command lists all policies associated with the policy finteam-policy, the user bobfisher, and the group consulting on the deployment at alias myminio.

The command outputs the list of groups and users associated with the policy finteam-policy, then lists the policies associated with the user bobfisher, and finally lists the policies associated with the group consulting on the deployment at alias myminio.

mc admin policy entities play/ \
           --policy finteam-policy --user bobfisher --group consulting

Output

The output of the commands resembles the following:

Query time: 2023-04-04T20:39:27Z
  Policy -> Entity Mappings:
    Policy: finteam-policy
      User Mappings:
        bobfisher
    Policy: diagnostics
      User Mappings:
        james
        bobfisher
        marcia
      Group Mappings:
        consulting
        auditors
  User -> Policy Mappings:
    User: bobfisher
      ALLOW_PUBLIC_READ
      finteam-policy
      diagnostics
      readonly
      readwrite
      writeonly

27 - mc admin user info

Syntax

The mc admin user info command returns detailed information of a MinIO user on the target MinIO deployment.

To manage external Identity Provider users, see OIDC or AD/LDAP.

mc admin user info myminio myuser

mc [GLOBALFLAGS] admin user info      \
                            ALIAS     \
                            USERNAME

Parameters

ALIAS

mc-cmd

Required

The alias of a configured MinIO deployment to retrieve user information from.

USERNAME

mc-cmd

The username to retrieve information for.

Global Flags

This command supports any of the global flags.

Examples

View User Details

Use mc admin user info to view detailed user information for a user on a MinIO deployment:

mc admin user info ALIAS USERNAME

• Replace ALIAS with the alias of the MinIO deployment.
• Replace USERNAME with the username of the user to display information for.

For the MinIO internal IDentity Provider (IDP), the output resembles the following:

AccessKey: miniouser
Status: enabled
PolicyName:
MemberOf: []
Authentication: builtin (miniouser)

For a third-party identity service such as LDAP, the output resembles the following:

AccessKey: uid=dillon,ou=people,ou=swengg,dc=min,dc=io
Status:
PolicyName: consoleAdmin
MemberOf: []
Authentication: ldap/localhost:1389 (uid=dillon,ou=people,ou=swengg,dc=min,dc=io)

View Policies from Group Membership

Use mc admin user info with :option::–json <mc.–json> to view the policies inherited from a user’s group memberships:

mc admin user info ALIAS USERNAME --json

• Replace ALIAS with the alias of the MinIO deployment.
• Replace USERNAME with the username of the user to display information for.

The memberOf property in the output contains a list of groups the user is a member of, with the policies attached to each group. The output resembles the following:

{
 "status": "success",
 "accessKey": "myuser",
 "userStatus": "enabled",
 "memberOf": [
  {
   "name": "testingGroup",
   "policies": [
    "testingGroupPolicy"
   ]
 "authentication": builtin (myuser)
  }
 ]
}

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

28 - mc admin user svcacct enable

Syntax

The mc admin user svcacct enable command enables an existing access key.

mc admin user svcacct enable myminio myuserserviceaccount

mc [GLOBALFLAGS] admin user svcacct enable          \
                                    ALIAS           \
                                    SERVICEACCOUNT

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

SERVICEACCOUNT

mc-cmd

Required

The service account access key to enable.

Global Flags

This command supports any of the global flags.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

29 - mc admin accesskey info

Syntax

The mc admin accesskey info command returns a description of the specified access key(s).

The description output includes the following details, as available:

• Access Key
• Parent user of the specified access key
• Access key status (on or off)
• Policy or policies
• Comment
• Expiration

mc admin accesskey info myminio myuseraccesskey

mc [GLOBALFLAGS] admin accesskey info      \
                                 ALIAS     \
                                 ACCESSKEY

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

ACCESSKEY

mc-cmd

Required

The access key to display.

Return information for multiple access keys by separating each access key with a space.

Global Flags

This command supports any of the global flags.

Examples

Display access key details

Use mc admin accesskey info to display details of an access key on a MinIO deployment:

   mc admin accesskey info myminio myaccesskey

• Replace myminio with the alias of the MinIO deployment.
• Replace myaccesskey with the access key for which to display information. List multiple keys by separating each with a space.

The output resembles the following:

AccessKey: myuserserviceaccount
ParentUser: myuser
Status: on
Comment:
Policy: implied
Expiration: no-expiry

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

30 - mc admin decommission

Syntax

The mc admin decommission command starts the decommissioning process for a MinIO server pools. Decommissioning is designed for removing an older server pool whose hardware is no longer sufficient or performant compared to the pools in the deployment. MinIO automatically migrates data from the decommissioned pool to the remaining pools in the deployment based on the ratio of free space available in each pool.

See Decommission Server Pools for a complete procedure on decommissioning a server pool.

mc admin [GLOBALFLAGS] decommission start|status|cancel ALIAS TARGET

Parameters

start

mc-cmd

Required Starts the decommissioning process for the server pool specified to TARGET.

Requires specifying TARGET

status

mc-cmd

Required Returns the decommissioning status of all server pools on the specified ALIAS:

• Active - The pool is active and not scheduled for decommissioning.
• Draining - The pool is currently decommissioning.
• Draining (Failed) - The decommissioning process failed and requires manually restart.
• Draining (Cancelled) - The decommissioning process was manually cancelled.

If the command includes a TARGET, the command output includes the rate of data migration if decommissioning is in progress.

cancel

mc-cmd

Required Cancels an ongoing decommissioning process on the pool specified to TARGET.

Requires specifying TARGET.

Cancelling a decommissioning process does not return the pool to an active state. You must eventually complete the decommissioning process and remove the pool from the deployment. You can resume the process by running mc admin decommission start again against the pool.

ALIAS

mc-cmd

Required The alias of the MinIO deployment on which to start the decommissioning process.

TARGET

mc-cmd

The full description of the server pool on which the command operates. For example:

https://minio-{01...04}.example.net:9000/mnt/disk{1...4}

Global Flags

This command supports any of the global flags.

Examples

See Decommission Server Pools for a complete procedure on decommissioning a server pool.

31 - mc admin policy info

Syntax

Returns the specified policy in JSON format if it exists on the target MinIO deployment.

 mc admin policy info myminio writeonly

mc admin policy info TARGET POLICYNAME
                     [--policy-file, -f <path>]

Parameters

The mc admin policy info command accepts the following arguments:

TARGET

mc-cmd

Required

The alias of a configured MinIO deployment from which to display the specified policy.

POLICYNAME

mc-cmd

Required

The name of the policy whose details you want to display.

--policy-file

mc-cmd

Optional

Specifly the path of a file to write the contents of the specified policy JSON. If the path already exists, the command overwrites the existing file with the contents of the specified file.

Global Flags

This command supports any of the global flags.

Examples

Display the contents of the writeonly policy on the alias myminio.

mc admin policy info myminio writeonly

Show information on a given policy and write the policy JSON content to /tmp/policy.json.

mc admin policy info myminio writeonly --policy-file /tmp/policy.json

Output

The command returns output that resembles the following:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Action": [
            "s3:PutObject"
         ],
         "Resource": [
            "arn:aws:s3:::*"
         ]
      }
   ]
}

32 - mc admin user ls

Syntax

The mc admin user ls command lists all MinIO users on the target MinIO deployment.

The mc admin user list command has equivalent functionality to mc admin user ls.

mc admin user ls does not return the access key or secret key associated to a user. Use mc admin user info to retrieve detailed user information, including the user access key.

To manage external Identity Provider users, see OIDC or AD/LDAP.

mc admin user ls myminio

mc [GLOBALFLAGS] admin user list   \
                            ALIAS

Parameters

ALIAS

mc-cmd

Required

The alias of a configured MinIO deployment from which the command lists users.

Global Flags

This command supports any of the global flags.

Example

List Available Users

Use mc admin user ls to list all users on a MinIO deployment:

mc admin user ls ALIAS

• Replace ALIAS with the alias of the MinIO deployment.

The output resembles the following:

enabled    devadmin              readwrite
enabled    devtest               readonly
enabled    newuser

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

33 - mc admin user svcacct info

Syntax

The mc admin user svcacct info command returns a description of the specified access key.

“Access Keys” have equivalent functionality to and replace the concept of “Service Accounts” in MinIO.

The description output includes the following details, as available:

• Access Key
• Parent user of the specified access key
• Access key status (on or off)
• Policy or policies
• Comment
• Expiration

Use --policy to view the attached policies.

mc admin user svcacct info myminio myuseraccesskey

mc [GLOBALFLAGS] admin user svcacct info           \
                                    [--policy]     \
                                    ALIAS          \
                                    ACCESSKEY

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

ACCESSKEY

mc-cmd

Required

The service account access key to display.

--policy

mc-cmd

Optional

Displays policies attached to the specified service account.

Global Flags

This command supports any of the global flags.

Examples

Display Service Account Details

Use mc admin user svcacct info to display details of a service account on a MinIO deployment:

   mc admin user svcacct info ALIAS ACCESSKEY

• Replace ALIAS with the alias of the MinIO deployment.
• Replace ACCESSKEY with the service account access key.

The output resembles the following:

AccessKey: myuserserviceaccount
ParentUser: myuser
Status: on
Comment:
Policy: implied
Expiration: no-expiry

Display Service Account Policy Details

Use mc admin user svcacct info to display the policies attached to service account:

   mc admin user svcacct info --policy ALIAS ACCESSKEY

• Replace ALIAS with the alias of the MinIO deployment.
• Replace ACCESSKEY with the service account access key.

The output resembles the following:

{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Effect": "Allow",
   "Action": [
    "s3:*"
   ],
   "Resource": [
    "arn:aws:s3:::*"
   ]
  }
 ]
}

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

34 - mc admin accesskey ls

Syntax

The mc admin accesskey ls command lists users, access keys, or temporary security token service keys managed by the MinIO deployment.

The alias mc admin accesskey list has equivalent functionality to mc admin accesskey ls.

mc admin accesskey ls myminio admin1

   Access Key        | Expiry
5XF3ZHNZK6FBDWH9JMLX | 2023-06-24 07:00:00 +0000 UTC
F4V2BBUZSWY7UG96ED70 | 2023-12-24 18:00:00 +0000 UTC
FZVSEZ8NM9JRBEQZ7B8Q | no-expiry
HOXGL8ON3RG0IKYCHCUD | no-expiry

mc [GLOBALFLAGS] admin accesskey ls             \
                                 ALIAS          \
                                 [USER]         \
                                 [--all]        \
                                 [--self]       \
                                 [--temp-only]  \
                                 [--users-only]

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

USER

mc-cmd

Optional

The username of the user(s) to display access keys for. Separate multiple usernames with a space.

--all

mc-cmd

Optional

List all users and any access keys or temporary STS keys associated with them. Requires admin privileges for the deployment.

This flag is mutually exclusive with the other flags available for this command.

--svcacc-only

mc-cmd

Optional

List temporary Security Token Service (STS) keys on the deployment.

This flag is mutually exclusive with the other flags available for this command.

--self

mc-cmd

Optional

List access keys and STS keys for the currently authenticated user.

This flag is mutually exclusive with the other flags available for this command.

--temp-only

mc-cmd

Optional

List users with their access keys. This returns only users that have associated access keys.

This flag requires admin privileges for the user running the command.

This flag is mutually exclusive with the other flags available for this command.

--users-only

mc-cmd

Optional

List the MinIO users managed by the deployment. Use in conjunction with the --all flag to list all users on the deployment.

Global Flags

This command supports any of the global flags.

Examples

List all built-in users and associated access keys

The following command lists all users managed by the MinIO deployment at alias myminio and any associated access keys or temporary STS tokens.

mc admin accesskey list myminio/ --all

Return a list of access keys for the current authenticated user

The following command lists the access keys or temporary STS tokens associated with the currently authenticated user for the myminio deployment.

mc admin accesskey list myminio/ --self

List all users created and managed by the deployment

The following command returns a list of all of the users on the current deployment. The list only includes MinIO IDP managed users, not users managed by a third party tool on a protocol like OpenID or Active Directory/LDAP.

mc admin accesskey ls myminio/ --all --users-only

Return a list of access keys associated with the users miniouser1 and miniouser2

The following command returns a list of access keys for two users on the myminio deployment.

mc admin accesskey ls myminio/ miniouser1 miniouser2

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

35 - mc admin group

Description

The mc admin group command manages groups on a MinIO deployment.

A group is a collection of users. Each group can have one or more assigned policies that explicitly list the actions and resources to which group members are allowed or denied access. Groups provide a simplified method for managing shared permissions among users with common access patterns and workloads.

Groups and Policy-Based Access Control

MinIO uses Policy-Based Access Control (PBAC) to support authorization of users who have successfully authenticated to the deployment. Each policy includes rules that dictate the allowed or denied actions/resources on the deployment. You can assign one or more policies to a group. Users with membership in the group inherit the group’s assigned policies. A user’s total set of permissions includes their explicitly assigned policies and any policies inherited via group membership.

Newly created groups have no policies by default. To configure a group’s assigned policies, use the mc admin policy attach command.

For more information on MinIO users and groups, see User Management and Group Management. For more information on MinIO policies, see MinIO Policy Based Access Control.

Examples

Create a New Group

Use mc admin group add to create a new group to an S3-compatible host:

mc admin group add ALIAS GROUPNAME MEMBER [MEMBER...]

• Replace ALIAS with the alias of the S3-compatible host.
• Replace GROUPNAME with the name of the group to create.
• Replace MEMBER with at least one user on the S3 host. Specify multiple members as a list: MEMBER1 MEMBER2 MEMBER3

List Available Groups

Use mc admin group ls to list list all groups on an S3-compatible host:

mc admin group ls ALIAS

• Replace ALIAS with the alias of the S3-compatible host.

View Group Details

Use mc admin group info to view detailed group information on an S3-compatible host:

mc admin group info ALIAS GROUPNAME

• Replace ALIAS with the alias of the S3-compatible host.
• Replace GROUPNAME with the name of the group.

Remove a Group

Use mc admin group rm to remove a group from an S3-compatible host:

mc admin group rm ALIAS GROUPNAME

• Replace ALIAS with the alias of the S3-compatible host.
• Replace GROUPNAME with the name of the group.

Disable a Group

Use mc admin group disable to disable a group on an S3-compatible host:

mc admin group disable ALIAS GROUPNAME

• Replace ALIAS with the alias of the S3-compatible host.
• Replace GROUPNAME with the name of the group.

Enable a Group

Use mc admin group enable to enable a group on an S3-compatible host:

mc admin group enable ALIAS GROUPNAME

• Replace ALIAS with the alias of the S3-compatible host.
• Replace GROUPNAME with the name of the group.

Quick Reference

mc admin group add TARGET GROUPNAME MEMBERS

Adds a user to a group on the MinIO deployment. Creates the group if it does not exist.

mc admin group info TARGET GROUPNAME

Returns detailed information for a group on the MinIO deployment.

mc admin group ls TARGET

Returns a list of all groups on the MinIO deployment.

mc admin group rm TARGET GROUPNAME

Removes a group on the MinIO deployment.

mc admin group enable TARGET GROUPNAME

Enables a group on the MinIO deployment. Users can only inherit policies assigned to an enabled group.

mc admin group disable TARGET GROUPNAME

Disables a group on the MinIO deployment. Users cannot inherit policies assigned to a disabled group.

Syntax

mc admin group add

mc-cmd

Adds an existing user to the group. The command creates the group if it does not exist. The command has the following syntax:

mc admin group add TARGET GROUPNAME MEMBERS

The command accepts the following arguments:

TARGET

mc-cmd

The alias of a configured MinIO deployment on which the command adds users to the new or existing group

GROUPNAME

mc-cmd

The name of the group. The command creates the group if it does not already exist. Use mc admin group ls to review the existing groups on a deployment.

A group name cannot contain the characters = (equal sign) or , (comma).

MEMBERS

mc-cmd

The name of the user to add to the group.

The user must exist on the TARGET MinIO deployment. Use mc admin user ls to review the available users on the deployment.

mc admin group info

mc-cmd

Returns details for the group on the target deployment, such as all users with membership in the group and the assigned policies. The command has the following syntax:

mc admin group info TARGET GROUPNAME

The command accepts the following arguments:

TARGET

mc-cmd

The alias of a configured MinIO deployment from which to retrieve the group information.

GROUPNAME

mc-cmd

The name of the group.

mc admin group ls, list

mc-cmd

List all groups on the target MinIO deployment. The command has the following syntax:

mc admin group ls TARGET

The command accepts the following arguments:

TARGET

mc-cmd

The alias of a configured MinIO deployment from which to retrieve groups.

mc admin group rm, remove

mc-cmd

Removes a group on the target MinIO deployment. Removing a group does not remove any users with membership in the group. Use mc admin user rm to remove users from a group.

The command has the following syntax:

mc admin group rm TARGET GROUPNAME

The command accepts the following arguments:

TARGET

mc-cmd

The alias of a configured MinIO deployment on which to remove the group.

GROUPNAME

mc-cmd

The name of the group to remove.

mc admin group enable

mc-cmd

Enables the group on the target MinIO deployment. Users can only inherit policies from an enabled group. Groups are enabled on creation by default. The command has the following syntax:

mc admin group enable TARGET GROUPNAME

The command accepts the following arguments:

TARGET

mc-cmd

The alias of a configured MinIO deployment on which to enable the group.

GROUPNAME

mc-cmd

The name of the group to enable.

mc admin group disable

mc-cmd

Disables the group on the target MinIO deployment. Users cannot inherit policies from a disabled group. The command has the following syntax:

mc admin group disable TARGET GROUPNAME

The command accepts the following arguments:

TARGET

mc-cmd

The alias of a configured MinIO deployment on which to disable the group.

GROUPNAME

mc-cmd

The name of the group to disable.

36 - mc admin policy ls

Syntax

Lists all policies on the target MinIO deployment.

The mc admin policy list command has equivalent functionality to mc admin policy ls.

mc admin policy ls play

mc admin policy ls TARGET

Parameters

The mc admin policy ls command accepts the following arguments:

TARGET

mc-cmd

The alias of a configured MinIO deployment from which the command lists the available policies.

Global Flags

This command supports any of the global flags.

Examples

List the policies that exist on the deployment at alias myminio.

mc admin policy ls myminio

Output

The command returns output that resembles the following:

readwrite
writeonly

37 - mc admin user rm

Syntax

The mc admin user rm command removes a MinIO user on the target MinIO deployment.

The mc admin user remove command has equivalent functionality to mc admin user rm.

To manage external Identity Provider users, see OIDC or AD/LDAP.

mc admin user rm myminio myuser

mc [GLOBALFLAGS] admin user remove    \
                            ALIAS     \
                            USERNAME

Parameters

ALIAS

mc-cmd

Required

The alias of the configured MinIO deployment with the user to remove.

USERNAME

mc-cmd

Required

The username of the user to remove.

Global Flags

This command supports any of the global flags.

Example

Remove a User

Use mc admin user rm to remove a user from a MinIO deployment:

mc admin user rm ALIAS USERNAME

• Replace ALIAS with the alias of the MinIO deployment.
• Replace USERNAME with the username of the user to remove.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

38 - mc admin user svcacct ls

Syntax

The mc admin user svcacct ls command lists all access keys associated to the specified user.

The alias mc admin user svcacct list has equivalent functionality to mc admin user svcacct ls.

mc admin user svcacct ls myminio admin1

   Access Key        | Expiry
5XF3ZHNZK6FBDWH9JMLX | 2023-06-24 07:00:00 +0000 UTC
F4V2BBUZSWY7UG96ED70 | 2023-12-24 18:00:00 +0000 UTC
FZVSEZ8NM9JRBEQZ7B8Q | no-expiry
HOXGL8ON3RG0IKYCHCUD | no-expiry

mc [GLOBALFLAGS] admin user svcacct ls   \
                                    ALIAS  \
                                    USER

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

USER

mc-cmd

Required

The username of the user to display access keys for.

Global Flags

This command supports any of the global flags.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

39 - mc admin accesskey rm

Syntax

The mc admin accesskey rm command removes an access key associated to a user on the deployment.

The mc admin accesskey remove command has equivalent functionality to mc admin accesskey rm.

mc admin accesskey rm myminio myuserserviceaccount

mc [GLOBALFLAGS] admin accesskey rm                \
                                 ALIAS             \
                                 ACCESSKEYTOREMOVE

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

ACCESSKEYTOREMOVE

mc-cmd

Required

The access key to remove.

Global Flags

This command supports any of the global flags.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

40 - mc admin heal

Description

The mc admin heal command scans for objects that are damaged or corrupted and heals those objects.

mc admin heal is resource intensive and typically not required as a manual process, even after drive failures or corruption events.

As a part of normal operations, MinIO:

• automatically heals objects damaged by silent bit rot corruption, drive failure, or other issues on each POST or GET operation.
• performs periodic background object healing using the scanner.
• aggressively heals objects after drive replacement.

Refer to Object Healing for more details on how MinIO heals objects.

Syntax

mc admin heal has the following syntax:

mc admin heal [FLAGS] TARGET             \
                      [--all-drives, -a] \
                      [--force]          \
                      [--verbose, -v]

mc admin heal supports the following arguments:

TARGET

mc-cmd

Required

The full path to the bucket or bucket prefix on which the command should perform object healing. Specify the alias of a configured MinIO deployment as the prefix for the path. For example:

mc admin heal play/mybucket/myprefix

If the TARGET bucket or bucket prefix has an active healing scan, the command returns the status of that scan.

--all-drives, -a

mc-cmd

Optional

Select all drives and show verbose information.

--force

mc-cmd

Optional

Disables warning prompts.

--verbose, -v

mc-cmd

Optional

Show information about offline and faulty healing drives.

Healing Colors

Some versions of MinIO used a color key as a way to differentiate objects with different healing statuses.

The color meaning has been updated.

• Green indicates the bucket is healthy.
• Yellow indicates the bucket requires healing on one or more drives.
• Red indicates one or more drives are unhealthy.
• Grey indicates an indeterminate healing state.

41 - mc admin policy rm

Syntax

Removes an IAM policy from the target MinIO deployment.

The mc admin policy remove command has equivalent functionality to mc admin policy rm.

mc admin policy rm myminio writeonly

mc admin policy rm TARGET POLICYNAME

Parameters

The mc admin policy rm command accepts the following arguments:

TARGET

mc-cmd

The alias of a configured MinIO deployment from which to remove the policy.

POLICYNAME

mc-cmd

The name of the policy to remove.

Global Flags

This command supports any of the global flags.

Examples

Remove a policy called listbuckets.

mc admin policy rm myminio listbuckets

42 - mc admin user sts info

Syntax

The mc admin user sts info command retrieves information on the specified STS credential, such as the parent MinIO user who generated the credentials, associated policies, and expiration.

STS credentials provide temporary access to the MinIO deployment.

mc admin user sts info myminio/ "J123C4ZXEQN8RK6ND35I"

mc [GLOBALFLAGS] admin user sts info          \
                                [--policy]    \
                                ALIAS         \
                                STSACCESSKEY

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

STSACCESSKEY

mc-cmd

Required

The access key for the STS credentials.

--policy

mc-cmd

Optional

Prints the policy attached to the specified STS credentials in JSON format.

Global Flags

This command supports any of the global flags.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

43 - mc admin user svcacct rm

Syntax

The mc admin user svcacct rm command removes an access key associated to a user on the deployment.

The mc admin user svcacct remove command has equivalent functionality to mc admin user svcacct rm.

Applications can no longer authenticate using that access key after removal.

mc admin user svcacct rm myminio myuserserviceaccount

mc [GLOBALFLAGS] admin user svcacct remove          \
                                    ALIAS           \
                                    SERVICEACCOUNT

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

SERVICEACCOUNT

mc-cmd

Required

The service account access key to remove.

Global Flags

This command supports any of the global flags.

Behavior

S3 Compatibility

The mc commandline tool is built for compatibility with the AWS S3 API and is tested with MinIO and AWS S3 for expected functionality and behavior.

MinIO provides no guarantees for other S3-compatible services, as their S3 API implementation is unknown and therefore unsupported. While mc commands may work as documented, any such usage is at your own risk.

44 - mc admin info

Description

The mc admin info command displays information on a MinIO server. For distributed MinIO deployments, mc admin info displays information for each MinIO server in the deployment.

The output of the command resembles the following:

●  play.min.io
   Uptime: 2 hours
   Version: 2024-05-10T08:24:14Z
   Network: 1/1 OK
   Drives: 4/4 OK
   Pool: 1

Pools:
   1st, Erasure sets: 1, Drives per erasure set: 4

0 B Used, 3 Buckets, 0 Objects
4 drives online, 0 drives offline, EC:1

Examples

The following example assumes that the play alias exists in the mc configuration file. You can replace play with the alias for your preferred S3-compatible deployment.

See mc alias for more information on aliases.

mc admin info play

Syntax

mc admin info has the following syntax:

mc admin info TARGET      \
              [--offline]

Specify the alias of a configured MinIO deployment as the TARGET.

Parameters

TARGET

mc-cmd

Required

The alias about which you want to display information.

--offline

mc-cmd

Optional

Show only offline drives or nodes.

45 - mc admin user svcacct

Description

The mc admin user svcacct command and its subcommands create and manage Access Keys on a MinIO deployment.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, these commands have been replaced by mc admin accesskey and mc idp ldap accesskey. This command and its subcommands will be deprecated in a future MinIO Client release.

Each access key is linked to a user identity and inherits the policies attached to its parent user or those groups in which the parent user has membership. Each access key also supports an optional inline policy which further restricts access to a subset of actions and resources available to the parent user.

mc admin user svcacct only supports creating access keys for MinIO-managed and Active Directory/LDAP-managed accounts.

To create access keys for OpenID Connect-managed users, log into the MinIO Console and generate the access keys through the UI.

The mc admin user svcacct command has the following subcommands:

46 - mc admin kms key

Description

The mc admin kms key command performs cryptographic key management operations through the MinIO Key Encryption Service (KES).

Syntax

mc admin kms key create

mc-cmd

Creates a new master key on a Key Management System (KMS).

The command has the following syntax:

mc admin kms key create TARGET [KEY_NAME]

The command accepts the following arguments:

TARGET

mc-cmd

Specify the alias of a configured MinIO deployment.

The TARGET deployment must include a configured MinIO Key Encryption Service (KES) server.

KEY_NAME

mc-cmd

Specify the name of the new master key.

mc admin kms key status

mc-cmd

Requests information on a Key Management System (KMS) master key.

The command has the following syntax:

mc admin kms key status TARGET [KEY_NAME]

The command accepts the following arguments:

TARGET

mc-cmd

Specify the alias of a configured MinIO deployment.

The TARGET deployment must include a configured MinIO Key Encryption Service (KES) server.

KEY_NAME

mc-cmd

Specify the name of a master key on the KMS.

Omit this argument to return the default master key on the TARGET deployment.

mc admin kms key list

mc-cmd

List all Key Management System (KMS) keys for a MinIO instance.

The command has the following syntax:

mc admin kms key list TARGET

The command accepts the following argument:

TARGET

mc-cmd

Specify the alias of a configured MinIO deployment.

The TARGET deployment must include a configured MinIO Key Encryption Service (KES) server.

47 - mc admin logs

Description

Use the mc admin logs command to show MinIO server logs.

The uploading feature remains disabled by default until explicitly enabled for a deployment on an opt-in only basis. If enabled, you can disable the feature at any time with mc support callhome disable.

Examples

Show Logs for a Deployment

The following command displays the most recent ten server logs of any type for the alias minio1.

mc admin logs minio1

Show Last 5 Log Entries for a Node

The following command shows the most recent five log entries for a node1 on the deployment with alias minio1.

mc admin logs --last 5 myminio node1

Show Application Type Log Entires for a Deployment

The following command shows log entries of the type application for all nodes on the deployment with alias minio1.

mc admin logs --type application minio1

Syntax

The command has the following syntax:

mc admin logs [GLOBAL FLAGS]     \
              [--last, -l value] \
              [--type, -t value] \
              ALIAS              \
              [NODE]

Parameters

ALIAS

mc-cmd

Required

The alias of the MinIO deployment.

--last, -l

mc-cmd

Optional

Show only the most recent specified number of log entries.

If this flag is not included, up to the last 10 log entries show.

--type, --type

mc-cmd

Optional

List log entries of a specified type. Valid types are minio, application, or all.

If not specified, all log entry types show.

NODE

mc-cmd

Optional

In distributed deployments, specify which node’s logs to show by entering the node’s name.

Global Flags

This command supports any of the global flags.

48 - mc admin policy

Description

The mc admin policy commands manage policies for use with MinIO Policy-Based Access Control (PBAC). MinIO PBAC uses IAM-compatible policy JSON documents to define rules for accessing resources on a MinIO server.

For complete documentation on MinIO PBAC, including policy document JSON structure and syntax, see Access Management. To manage policies for deployments that use LDAP authentication, see mc idp ldap policy.

Subcommands

mc admin policy includes the following subcommands:

49 - mc admin prometheus

Description

The mc admin prometheus command and its subcommands provide access to MinIO Prometheus metrics.

Subcommands

mc admin prometheus includes the following subcommands:

50 - mc admin rebalance

Permission

This command requires that the user performing it have the admin:Rebalance policy action for the deployment.

Description

The mc admin rebalance command allows starts, monitors, or stops a rebalancing operation on a MinIO deployment. Rebalancing redistributes objects across all pools in the deployment.

MinIO does not automatically rebalance objects when adding a new server pool. Instead, MinIO writes new objects to the pool with relatively more free space compared to the other available pools on the deployment. Triggering a manual rebalancing procedure prompts MinIO to scan the entire deployment and move objects as necessary to achieve a similar available free space across all pools.

This is an expensive and time consuming operation. Consider only running a rebalance procedure during light or no use of the deployment. If write operations do occur during a rebalance operation, they process in parallel and write to a pool not actively in rebalancing.

You can stop a rebalance and start it again later as needed.

Follow the progress of an ongoing rebalance operation using the following command:

mc admin trace --call rebalance ALIAS

The mc admin rebalance command has the following subcommands:

Syntax

mc admin rebalance start

mc-cmd

Start a rebalance operation for a MinIO deployment.

mc admin rebalance start minio1

mc [GLOBALFLAGS] admin rebalance start ALIAS

mc admin rebalance status

mc-cmd

Queries the deployment with an active rebalance process and returns information about the status of the rebalance process.

The status returns the ID of the rebalance operation, the time of the operation, and details for each pool on the deployment. For each pool, the status shows the pool ID, the pool’s rebalance status, the percentage of used space, and rebalance progress for the pool.

mc admin rebalance status minio1

mc [GLOBALFLAGS] admin rebalance ALIAS

mc admin rebalance stop

mc-cmd

Ends an in-progress rebalance job on the specified deployment.

mc admin rebalance stop minio1

mc [GLOBALFLAGS] admin rebalance stop ALIAS

Global Flags

This command supports any of the global flags.

Behavior

Back Up Cluster Settings First

Use the mc admin cluster bucket export and mc admin cluster iam export commands to take a snapshot of the bucket metadata and IAM configurations respectively prior to starting decommissioning. You can use these snapshots to restore bucket/IAM settings to recover from user or process errors as necessary.

Rebalancing Ignores Expired Objects and Trailing DeleteMarker

Starting with RELEASE.2023-06-23T20-26-00Z, rebalancing ignores object versions which have expired based on the configured lifecycle rules for the parent bucket.

Rebalancing also ignores objects where the only remaining version is a delete marker. This avoids inter-pool I/O for objects already considered fully deleted.

MinIO relies on the scanner to capture and remove those expired objects or trailing DeleteMarker objects.

51 - mc admin replicate

Description

The mc admin replicate command creates and manages site replication for a set of MinIO peer sites.

Site replication mimics an active-active bucket replication, but for multiple MinIO deployments. Wherever a change occurs to IAM settings, buckets, or objects across the set of sites, the change replicates across all sites in the site replication group.

Where bucket replication manages the mirroring of particular buckets or objects from one location to another within a deployment or across deployments, site replication continuously mirrors an entire MinIO site to other sites.

mc admin replicate only supports site replication for distributed deployments when configuring site replication.

Only one deployment can have any data when initiating a new site replication configuration.

Site replication enforces bucket versioning on all buckets, including existing buckets and any buckets added after initiating site replication. Site replication fully synchronizes versioned objects, compared to mc mirror which operates only on the latest version of an object

The mc admin replicate command has the following subcommands:

Syntax

mc admin replicate add

mc-cmd

Create or expand a site replication configuration. The configuration uses asynchronous site replication by default, as MinIO recommends.

To enable synchronous site replication, create the replication using this command first. Then use mc admin replicate update --mode sync to update the configuration.

mc admin replicate add minio1 minio2 minio3