Make MinIO Access Key

Today in my homelab I wanted to setup a new service that needed a MinIO access key. So I created a new user and a new access key with the MinIO CLI rather than poking through the ui like I have before.

Global Level vs User Level

The MinIO CLI has two levels of access, global and user level. Most of the commands in this post will have several ways to do similar tasks that would potentially work. We are going to prefer to use the user level commands for more control. For some commands such as listing Keys it is handy to use the global level.

The Policy

First we are going to make a new policy file named mypages_rw_policy.json.

        
{
"Version": "2012-10-17",
"Statement": [
    {
    "Action": [
        "s3:GetBucketLocation",
        "s3:ListBucket"
    ],
    "Effect": "Allow",
    "Resource": [
        "arn:aws:s3:::mybucket"
    ]
    },
    {
    "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:ListMultipartUploadParts",
        "s3:AbortMultipartUpload"
    ],
    "Effect": "Allow",
    "Resource": [
        "arn:aws:s3:::mybucket/*"
    ]
    }
]
}

Set the Minio Alias

Before we can create new access keys we will need to start by settin up an alias in minio that has admin rights to the minio server.

        
# default values
export MINIO_ACCESS_KEY=minioadmin
export MINIO_SECRET_KEY=minioadmin

mc alias set myminio https://myminio.example.com $MINIO_ACCESS_KEY $MINIO_SECRET_KEY

Check to see if your alias exists.

        
mc alias list

The Script

Now we are going to pick a SECRETKEY and a NEWUSERNAME, create the policy, create the user, attach the policy to the user and add the user to the alias.

        
#!/bin/bash
NEWUSERNAME=MYPAGESUSER
NEWPASSWORD=mysupersecretkey
echo USERNAME: $NEWUSERNAME
echo PASSWORD: $NEWPASSWORD

# create a new policy for read/write to the bucket
mc admin policy create myminio mybucket-readwrite mypages_rw_policy.json

# create a new user
mc admin user add myminio $NEWUSERNAME $NEWPASSWORD

# attach the policy to the user, giving them read/write to the bucket
mc admin policy attach myminio mybucket-readwrite --user $NEWUSERNAME

# add the user to the alias
mc config host add myminio https://minio.wayl.one $NEWUSERNAME $NEWPASSWORD

# create a new access key for the user with thier permissions
mc admin user svcacct add                       \
myminio MYPAGESUSER                     \
--name mypagesRWKey                       \
--description "MYPAGESUSER Key for myminio" \
--expiry 2025-03-01

        
NEWSECRETKEY
3e11************************************************************
Access Key: IL4*****************
Secret Key: M3D*************************************
Expiration: 2025-03-01 06:00:00 +0000 UTC

Give it a test

Now we can test that it works, by creating a file and copying it into the bucket.

        
# set up to work with the aws cli
export AWS_DEFAULT_REGION=us-east-1
export AWS_ACCESS_KEY_ID=IL4*****************
export AWS_SECRET_ACCESS_KEY=M3D*************************************
export AWS_ENDPOINT_URL=https://myminio.example.com

# create a test file
echo "You How" > hi-hello.txt
# upload the file
aws s3 cp hi-hello.txt s3://mybucket/hi-hello.txt
# test the file exists
aws s3 ls s3://mybucket
# output
# 2025-02-02 19:25:02          8 hi-hello.txt

        
pipx install awscli

Managing Access Keys

You can list all of the access keys for a user, or all users.

        
# for one user
mc admin accesskey ls myminio/ MYPAGESUSER

# for all users
mc admin accesskey ls myminio/ --all

The output will show you all of the access keys for each user.

        
User: MYPAGESUSER
  Access Keys:
    IL4*****************, expires: 3 weeks from now, sts: false

You can also get a list of the service accounts for a user with this command.

        
mc admin user svcacct ls myminio/ MYPAGESUSER

        
   Access Key        | Expiry
IL4***************** | 2025-03-01 06:00:00 +0000 UTC

Creating an RO Access Key

I ran into errors when trying to create a new key with exactly the same permissions as the user, I'm not sure if adding a policy that does not match the user is allowed or not.

I made a new policy that has read only access to the bucket as mypages_ro_policy.json

        
{
"Version": "2012-10-17",
"Statement": [
    {
    "Action": [
        "s3:GetBucketLocation",
        "s3:ListBucket"
    ],
    "Effect": "Allow",
    "Resource": [
        "arn:aws:s3:::mypages"
    ]
    },
    {
    "Action": [
        "s3:GetObject",
        "s3:ListMultipartUploadParts"
    ],
    "Effect": "Allow",
    "Resource": [
        "arn:aws:s3:::mypages/*"
    ]
    }
]
}

This command will use the above policy to create a new read only access key.

        
mc admin user svcacct add \
  myminio MYPAGESUSER \
  --name mypagesRWKey \
  --description "MYPAGESUSER READ ONLY Key for myminio" \
  --expiry 2025-03-01 \
  --policy mypages_ro_policy.json

The output will show you the access key and secret key.

        
Access Key: KDM*****************
Secret Key: 8Ww*************************************
Expiration: 2025-03-01 06:00:00 +0000 UTC

Removing a service account

If you want to remove a service account, you can use the rm command to remove the Access Key, by alias and Access Key.

        
mc admin user svcacct rm myminio/ QH6*****************

Getting info

You can get the info for a user or service accounts using the info subcommands.

        
⬢ [devtainer] ❯ mc admin user info minio-wayl-one/ MYPAGESUSER
AccessKey: MYPAGESUSER
Status: enabled
PolicyName: mypages-readwrite
MemberOf: []

⬢ [devtainer] ❯ mc admin user svcacct ls minio-wayl-one/ MYPAGESUSER
   Access Key        | Expiry
KDM***************** | 2025-03-01 06:00:00 +0000 UTC
IL4***************** | 2025-03-01 06:00:00 +0000 UTC

⬢ [devtainer] ❯ mc admin user svcacct info myminio/ IL4*****************
AccessKey: IL4*****************
ParentUser: MYPAGESUSER
Status: on
Name: mypagesRWKey
Description: MYPAGESUSER Key for myminio
Policy: implied
Expiration: 3 weeks from now

⬢ [devtainer] ❯ mc admin user svcacct info myminio/ KDM*****************
AccessKey: KDM*****************
ParentUser: MYPAGESUSER
Status: on
Name: mypagesRWKey
Description: MYPAGESUSER READ ONLY Key for myminio
Policy: embedded
Expiration: 3 weeks from now