MinIO Admin Client on SILO

mc admin accesskey create

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey create command adds a new access key and secret key pair for an existing MinIO user.

Access keys for OpenID Connect or AD/LDAP users

This command is for access keys for users created directly on the MinIO deployment and not managed by a third party solution.

To generate access keys for Active Directory/LDAP users, use mc idp ldap accesskey create.

The following command creates a new access key associated to an existing MinIO user:

mc admin cluster bucket import

Mon, 01 Jan 0001 00:00:00 +0000

Description

Added: RELEASE.2022-06-17T02-52-50Z

The mc admin cluster bucket import command imports bucket metadata as created by the mc admin cluster bucket export command.

You can use this command to manually restore the metadata to the specified bucket on a MinIO deployment.

If you specify only the deployment as the target, this command applies the metadata objects to all matching buckets on the target.

The following command imports the specified metadata to the myminio deployment.

mc admin cluster iam import

Mon, 01 Jan 0001 00:00:00 +0000

Description

Added: RELEASE.2022-06-17T02-52-50Z

The mc admin cluster iam import command imports IAM metadata as created by the mc admin cluster iam export command.

You can use this command to manually restore IAM metadata settings for a MinIO deployment.

Added: mc

RELEASE.2024-09-09T07-53-10Z

The command outputs the results of the import, including the following:

count of individual entities imported by entity type
list of policies imported by entity type they imported to
list of entities that failed to import

The following command imports the IAM metadata of the specified file onto the myminio deployment.

mc admin policy attach

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

Attaches one or more IAM policies to either a MinIO-managed user or a group.

Changed: RELEASE.2023-05-27T05-56-19Z

To successfully attach a policy, the referenced user or group must exist.

Exactly one --user or one --group is required.

The following command attaches the readonly policy to the user james on the deployment at alias myminio.

mc admin policy attach myminio readonly --user james

The command has the following syntax:

mc admin prometheus generate

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin prometheus generate command generates a metrics scraping configuration file for use with Prometheus.

For more complete documentation on using MinIO with Prometheus, see How to monitor MinIO server with Prometheus

Starting with MinIO Server RELEASE.2024-07-15T19-02-30Z and MinIO Client RELEASE.2024-07-11T18-01-28Z, metrics version 3 (v3) provides additional endpoints and metrics. To generate a v3 scrape configuration use the --api_version v3 option.

MinIO recommends new deployments use version 3 (v3). Existing deployments can continue to use metrics version 2

mc admin scanner status

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin scanner status command displays a real-time summary of scanner information for a MinIO Server.

This command has an alias of mc admin scanner info.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

The following example returns information about the current state of the scanner process.

mc admin user add

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user add command adds a new MinIO user to the target MinIO deployment.

To manage external Identity Provider users, see OIDC or AD/LDAP.

The following command creates a new user newuser on the myminio MinIO deployment:

mc admin user add myminio newuser newusersecret

The command has the following syntax:

mc admin user svcacct add

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey create command to add access keys for built-in MinIO IDP users.

To add access keys for AD/LDAP users, use the mc idp ldap accesskey create command.

Syntax

The mc admin user svcacct add command adds a new access key to an existing MinIO or AD/LDAP user.

mc admin accesskey disable

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey disable command disables an existing access key for a MinIO IDP user.

The following command disables the specified access key:

mc admin accesskey disable myminio myuserserviceaccount

The command has the following syntax:

mc [GLOBALFLAGS] admin accesskey disable \
 ALIAS \
 SERVICEACCOUNT

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc admin cluster bucket export

Mon, 01 Jan 0001 00:00:00 +0000

Description

Added: RELEASE.2022-06-17T02-52-50Z

The mc admin cluster bucket export command exports bucket metadata for use with the mc admin cluster bucket import command.

You can use this command to manually back up the metadata for the specified MinIO bucket. The command always saves the output as cluster-metadata.zip.

If you specify only the deployment as the target, this command backs up all bucket metadata on the target deployment.

The following command exports all bucket metadata for the myminio deployment.

mc admin cluster iam export

Mon, 01 Jan 0001 00:00:00 +0000

Description

Added: RELEASE.2022-06-26T18-51-48Z

The mc admin cluster iam export command exports IAM metadata for use with the mc admin cluster iam import command.

The command saves the output as ALIAS-iam-metadata.zip, where ALIAS is the alias of the MinIO deployment.

The following command exports all IAM metadata for the myminio deployment.

mc admin cluster iam export myminio

The command has the following syntax:

mc admin policy create

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

Creates a new policy on the target MinIO deployment.

MinIO deployments include the following built-in policies by default:

Consider the following JSON policy document saved at a file called /tmp/listmybuckets.json:

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "s3:ListAllMyBuckets"
 ],
 "Resource": [
 "arn:aws:s3:::*"
 ]
 }
 ]
}

The following command creates a new policy called listmybuckets on the alias myminio using the policy found at the file /tmp/listmybuckets.json.

mc admin prometheus metrics

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin prometheus metrics command prints Prometheus metrics for a cluster.

The output includes additional information about each metric, such as if its value is a counter or gauge.

For more complete documentation on using MinIO with Prometheus, see How to monitor MinIO server with Prometheus

Starting with MinIO Server RELEASE.2024-07-15T19-02-30Z and MinIO Client RELEASE.2024-07-11T18-01-28Z, metrics version 3 (v3) provides additional endpoints and metrics. To print v3 metrics use the --api_version v3 option.

mc admin scanner trace

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin scanner trace command displays scanner-specific API operations occurring on the target MinIO deployment.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

The following example returns a list of API operations related to the scanner on the myminio deployment.

mc admin user disable

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user disable command disables a MinIO user on the target MinIO deployment.

Clients cannot use the user credentials to authenticate to the MinIO deployment. Disabling a user does not remove that user from the deployment. Use mc admin user enable to enable a disabled user on a MinIO deployment.

To manage external Identity Provider users, see OIDC or AD/LDAP.

The following command disables user myuser on the myminio MinIO deployment:

mc admin user svcacct disable

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey disable command to disable an access key for a built-in MinIO IDP user.

To disable access keys for AD/LDAP users, use the mc idp ldap accesskey disable command.

Syntax

The mc admin user svcacct disable command disables an existing access key.

The following command disables the specified access key:

mc admin policy detach

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

Remove one or more IAM policies from either a MinIO-managed user or a group.

Exactly one --user or one --group is required.

The following command detaches the policy readonly from the user james on the deployment at alias myminio.

mc admin policy detach myminio readonly --user james

The command has the following syntax:

mc admin user accesskey edit

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey edit command modifies the configuration of an access key associated to the specified user.

The command requires that at least one attribute of the access key change. Otherwise, the command exits with an error message.

The following command applies a new policy and secret key to the myuserserviceaccount access key on the myminio deployment:

mc admin user enable

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user enable command enables a MinIO user on the target MinIO deployment.

Clients can only use enabled users to authenticate to the MinIO deployment. Users created using mc admin user add are enabled by default.

To manage external Identity Provider users, see OIDC or AD/LDAP.

The following command enables user myuser on the myminio MinIO deployment:

mc admin user svcacct edit

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey edit command to modify access keys for built-in MinIO IDP users.

To modify access keys for AD/LDAP users, use the mc idp ldap accesskey edit command.

Syntax

The mc admin user svcacct edit command modifies the configuration of an access key associated to the specified user.

mc admin accesskey enable

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey enable command enables an existing access key.

The following command enables the specified access key:

mc admin accesskey enable myminio myuserserviceaccount

The command has the following syntax:

mc [GLOBALFLAGS] admin accesskey enable \
 ALIAS \
 SERVICEACCOUNT

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc admin config

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin config command manages configuration settings for the minio server.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

Examples

Syntax

`mc admin config set`

mc-cmd

Sets a configuration key on the MinIO deployment. Configurations defined by environment variables override configurations defined by this command.

`mc admin config get`

mc-cmd

mc admin policy entities

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

List the entities associated with a policy, user, or group on a target MinIO deployment.

Changed: RELEASE.2023-05-27T05-56-19Z

This command only returns minio-managed users and groups.

To list entities associated with an Active Directory or LDAP (AD/LDAP) configuration, use mc idp ldap policy entities.

For example, you can list all of the users and groups attached to a policy or list all of the policies attached to a specific user or group.

mc admin user info

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user info command returns detailed information of a MinIO user on the target MinIO deployment.

To manage external Identity Provider users, see OIDC or AD/LDAP.

The following command returns details of user myuser on the myminio MinIO deployment:

mc admin user info myminio myuser

The command has the following syntax:

mc admin user svcacct enable

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey enable command to enable an access key for a built-in MinIO IDP user.

To enable access keys for AD/LDAP users, use the mc idp ldap accesskey enable command.

Syntax

The mc admin user svcacct enable command enables an existing access key.

The following command enables the specified access key:

mc admin accesskey info

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey info command returns a description of the specified access key(s).

The description output includes the following details, as available:

Access Key
Parent user of the specified access key
Access key status (on or off)
Policy or policies
Comment
Expiration

The following command returns information on the specified access key:

mc admin decommission

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin decommission command starts the decommissioning process for a MinIO server pools. Decommissioning is designed for removing an older server pool whose hardware is no longer sufficient or performant compared to the pools in the deployment. MinIO automatically migrates data from the decommissioned pool to the remaining pools in the deployment based on the ratio of free space available in each pool.

See Decommission Server Pools for a complete procedure on decommissioning a server pool.

mc admin policy info

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

Returns the specified policy in JSON format if it exists on the target MinIO deployment.

The following command displays the contents of the writeonly policy on the alias myminio.

 mc admin policy info myminio writeonly

The command has the following syntax:

mc admin policy info TARGET POLICYNAME
 [--policy-file, -f <path>]

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc admin user ls

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user ls command lists all MinIO users on the target MinIO deployment.

The mc admin user list command has equivalent functionality to mc admin user ls.

mc admin user ls does not return the access key or secret key associated to a user. Use mc admin user info to retrieve detailed user information, including the user access key.

To manage external Identity Provider users, see OIDC or AD/LDAP.

The following command lists all users on the myminio MinIO deployment:

mc admin user svcacct info

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey info command to display information about access keys for built-in MinIO IDP users.

For access keys for AD/LDAP users, use the mc idp ldap accesskey info command.

Syntax

The mc admin user svcacct info command returns a description of the specified access key.

“Access Keys” have equivalent functionality to and replace the concept of “Service Accounts” in MinIO.

mc admin accesskey ls

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey ls command lists users, access keys, or temporary security token service keys managed by the MinIO deployment.

The alias mc admin accesskey list has equivalent functionality to mc admin accesskey ls.

The following command lists all access keys associated to the user with username admin1 on the deployment at alias myminio:

mc admin group

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin group command manages groups on a MinIO deployment.

A group is a collection of users. Each group can have one or more assigned policies that explicitly list the actions and resources to which group members are allowed or denied access. Groups provide a simplified method for managing shared permissions among users with common access patterns and workloads.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

mc admin policy ls

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

Lists all policies on the target MinIO deployment.

The mc admin policy list command has equivalent functionality to mc admin policy ls.

The following command displays a list of the policies currently current on the alias play.

mc admin policy ls play

The command has the following syntax:

mc admin policy ls TARGET

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc admin user rm

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user rm command removes a MinIO user on the target MinIO deployment.

The mc admin user remove command has equivalent functionality to mc admin user rm.

To manage external Identity Provider users, see OIDC or AD/LDAP.

The following command removes user myuser on the myminio MinIO deployment:

mc admin user rm myminio myuser

Removes a user on the target MinIO deployment.

mc admin user svcacct ls

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey ls command to list access keys for built-in MinIO IDP users.

For access keys for AD/LDAP users, use the mc idp ldap accesskey ls command.

Syntax

The mc admin user svcacct ls command lists all access keys associated to the specified user.

The alias mc admin user svcacct list has equivalent functionality to mc admin user svcacct ls.

mc admin accesskey rm

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin accesskey rm command removes an access key associated to a user on the deployment.

The mc admin accesskey remove command has equivalent functionality to mc admin accesskey rm.

Warning

Applications can no longer authenticate using the access key after its removal.

The following command removes the specified access key:

mc admin heal

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin heal command scans for objects that are damaged or corrupted and heals those objects.

mc admin heal is resource intensive and typically not required as a manual process, even after drive failures or corruption events.

As a part of normal operations, MinIO:

automatically heals objects damaged by silent bit rot corruption, drive failure, or other issues on each POST or GET operation.
performs periodic background object healing using the scanner.
aggressively heals objects after drive replacement.

Refer to Object Healing for more details on how MinIO heals objects.

mc admin policy rm

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

Removes an IAM policy from the target MinIO deployment.

The mc admin policy remove command has equivalent functionality to mc admin policy rm.

The following command removes the policy names writeonly from the myminio MinIO deployment:

mc admin policy rm myminio writeonly

The command has the following syntax:

mc admin policy rm TARGET POLICYNAME

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

mc admin user sts info

Mon, 01 Jan 0001 00:00:00 +0000

Syntax

The mc admin user sts info command retrieves information on the specified STS credential, such as the parent MinIO user who generated the credentials, associated policies, and expiration.

STS credentials provide temporary access to the MinIO deployment.

The following command retrieves information on the STS credentials with specified access key:

mc admin user sts info myminio/ "J123C4ZXEQN8RK6ND35I"

The command has the following syntax:

mc admin user svcacct rm

Mon, 01 Jan 0001 00:00:00 +0000

Important

This command has been replaced and will be deprecated in a future MinIO Client release.

As of MinIO Client RELEASE.2024-10-08T09-37-26Z, use the mc admin accesskey rm command to delete access keys for built-in MinIO IDP users.

For access keys for AD/LDAP users, use the mc idp ldap accesskey rm command.

Syntax

The mc admin user svcacct rm command removes an access key associated to a user on the deployment.

mc admin info

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin info command displays information on a MinIO server. For distributed MinIO deployments, mc admin info displays information for each MinIO server in the deployment.

Added: mc

RELEASE.2024-05-03T11-21-07Z

The command output includes information about the erasure code setting for the cluster. This displays in the output in the format EC:#.

The output of the command resembles the following:

● play.min.io
 Uptime: 2 hours
 Version: 2024-05-10T08:24:14Z
 Network: 1/1 OK
 Drives: 4/4 OK
 Pool: 1

Pools:
 1st, Erasure sets: 1, Drives per erasure set: 4

0 B Used, 3 Buckets, 0 Objects
4 drives online, 0 drives offline, EC:1

Examples

The following example assumes that the play alias exists in the mc configuration file. You can replace play with the alias for your preferred S3-compatible deployment.

mc admin kms key

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin kms key command performs cryptographic key management operations through the MinIO Key Encryption Service (KES).

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

Syntax

`mc admin kms key create`

mc-cmd

Creates a new master key on a Key Management System (KMS).

The command has the following syntax:

mc admin logs

Mon, 01 Jan 0001 00:00:00 +0000

SUBNET Registration Required

The mc support commands are designed for MinIO deployments registered with MinIO SUBNET to ensure optimal outcome of diagnostics and performance testing. Deployments not registered with SUBNET cannot use the mc support commands.

Changed: RELEASE.2022-12-02T23-48-47Z

mc support logs moved to mc admin logs and provide a simpler command interface for displaying server logs for the MinIO deployment.

The output is similar to what is available via journalctl -uf minio for systemd-controlled deployments.

mc admin rebalance

Mon, 01 Jan 0001 00:00:00 +0000

Permission

This command requires that the user performing it have the admin:Rebalance policy action for the deployment.

Description

The mc admin rebalance command allows starts, monitors, or stops a rebalancing operation on a MinIO deployment. Rebalancing redistributes objects across all pools in the deployment.

MinIO does not automatically rebalance objects when adding a new server pool. Instead, MinIO writes new objects to the pool with relatively more free space compared to the other available pools on the deployment. Triggering a manual rebalancing procedure prompts MinIO to scan the entire deployment and move objects as necessary to achieve a similar available free space across all pools.

mc admin replicate

Mon, 01 Jan 0001 00:00:00 +0000

Changed: RELEASE.2023-01-11T03-14-16Z

mc admin replicate edit renamed to mc admin replicate update
mc admin replicate remove renamed to mc admin replicate rm

Description

The mc admin replicate command creates and manages site replication for a set of MinIO peer sites.

Site replication mimics an active-active bucket replication, but for multiple MinIO deployments. Wherever a change occurs to IAM settings, buckets, or objects across the set of sites, the change replicates across all sites in the site replication group.

mc admin service

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin service command can restart or unfreeze MinIO servers.

mc admin service affects all MinIO servers in the target deployment at the same time. The command interrupts in-progress API operations on the MinIO deployment. Use caution when issuing this command to a deployment.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

mc admin trace

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin trace command displays API operations occurring on the target MinIO deployment.

Use mc admin on MinIO Deployments Only

MinIO does not support using mc admin commands with other S3-compatible services, regardless of their claimed compatibility with MinIO deployments.

Examples

Monitor All API operations

Use mc admin trace to monitor API operations on a MinIO deployment:

mc admin trace -a ALIAS

Replace ALIAS with the alias of the MinIO deployment.

See Calls that Return 503 Errors

Use mc admin trace to monitor API operations that return a service unavailable 503 error:

mc admin update

Mon, 01 Jan 0001 00:00:00 +0000

Description

The mc admin update command updates all MinIO servers in the deployment. The command also supports using a private mirror server for environments where the deployment does not have public internet access.

After running the command, a prompt displays to confirm the update. Type y and [ENTER] to confirm and proceed with the update.

The user must have write permissions for the target location where the binary installs.