Minio ↔ Minio KES Server ↔ Hashicorp Vault

Minio is an S3 compliant data storage service. It can be hosted on premises and even supports distribution across multiple nodes. To meet certain data protection regulations, data is required to be encrypted the moment it is written to disk. Minio supports two types of encryption schemes

• SSE-S3 (Server side encryption)
• SSE-C (Client side encryption)

Goal of this blog is to guide you through setting up Minio with server side encryption. For server side encryption a KMS(key management system) is required. We have chosen Hashicorp vault as KMS here. Minio also supports a Key Encryption Service(KES) which is a stateless cryptographic operations service for Minio with the keys provided from KMS.

KES supports only one form authentication currently which is mTLS. Minio authenticates itself to KES with client TLS certificate for every connection. At a time, KES also supports different policies to be applied for different clients(Eg: Minio). KES acts like a lightweight gateway to use KMS thus abstracting out KMS footprint to clients to minimal.

This blogs covers following:

1. Concepts Overview - Some of my exploration notes
2. Generate a root CA certificate pair
3. Hashicorp vault setup
4. Minio KES setup
5. Minio Standalone Setup
6. Minio Distributed Mode Setup
7. Minio Benchmarking using S3 benchmark