Configure MinIO as a storage provider

To use MinIO as the storage provider for Boundary session recordings, you need a MinIO storage bucket, a service account with S3 read/write IAM policy permissions, and optionally the additional admin policy permissions to enable credential rotation.

MinIO and worker requirements

Before you can create a storage bucket in Boundary, you must ensure that your environment meets certain requirements.

Session recording requires specific configuration for both the external storage provider and the Boundary worker.

Refer to Configure workers for session recording to learn about configuring self-managed workers for session recording.

When you determine storage requirements for the external bucket, you should consider:

• BSR storage considerations
• Storage bucket retention policies

MinIO requirements

• A MinIO storage bucket

  You must associate the Boundary storage bucket with a MinIO storage bucket. A Boundary MinIO storage bucket contains the bucket name, endpoint URL, optional region, optional prefix, and the service account credentials needed to access the bucket. To enable credential rotation, you cannot add a Boundary storage bucket without a MinIO service account. You can disable credential rotation when you create the Boundary storage bucket.

  At the time of the 0.18.0 release, the latest tested and supported MinIO version is RELEASE.2024-10-02T17-50-4Z. Newer versions may work as well, but they have not been tested.

  Note

  At this time, the NetBSD operating system is not supported for the MinIO storage bucket.

• A MinIO service account and access keys

  You must provide service account access keys when you configure a Boundary storage bucket later on.

  Refer to the MinIO Access Keys documentation page to learn how to set up a MinIO service account.

• A MinIO storage bucket must be configured with read/write (R/W) access. If you use a restricted IAM user policy, the following policy actions must be allowed at a minimum.

  {
    "Version": "2012-10-17",
    "Statement": [
       {
          "Action": [
            "s3:PutObject",
            "s3:GetObject",
            "s3:GetObjectAttributes",
            "s3:DeleteObject"
          ],
          "Effect": "Allow",
          "Resource": "arn:aws:s3:::test-session-recording-bucket/*"
       },
       {
          "Action": "s3:ListBucket",
          "Effect": "Allow",
          "Resource": "arn:aws:s3:::test-session-recording-bucket"
       }
    ]
  }
  

• HashiCorp recommends that you enable credential rotation. To enable credential rotation, use the following service account policy:

  {
    "Version": "2012-10-17",
    "Statement": [
       {
          "Action": [
            "s3:PutObject",
            "s3:GetObject",
            "s3:GetObjectAttributes",
            "s3:DeleteObject"
          ],
          "Effect": "Allow",
          "Resource": "arn:aws:s3:::test-session-recording-bucket/*"
       },
       {
          "Action": "s3:ListBucket",
          "Effect": "Allow",
          "Resource": "arn:aws:s3:::test-session-recording-bucket"
       },
       {
          "Action": [
          "admin:CreateServiceAccount",
          "admin:RemoveServiceAccount"
        ],
        "Effect": "Allow"
       }
    ]
  }
  

MinIO documentation

The following MinIO docs are relevant for configuring storage buckets and service accounts:

• Refer to the MinIO Policy Action Keys documentation to learn more about restricting IAM user policies.
• Refer to the MinIO Object Encryption with KES documentation to learn more about KMS and data encryption with vault key management.

Next steps

After you configure the external storage provider, you can create the storage bucket in Boundary.