Granular policy-based access control
Model least-privilege permissions across users, groups, roles, buckets, and operational workflows.
Security & Compliance
RustFS ships identity, encryption, audit, and transport controls. Built-in does not mean already configured for production. Change default credentials, define IAM policies, enable TLS, and turn on encryption or audit targets before you expose a cluster. The controls on this page are product features, not SOC 2, ISO, or HIPAA certifications.
Configure before production
- Least privilege
- IAM can model least privilege. Root credentials bypass identity policies until you create users and attach policies.
- Separate controls
- Access, encryption, audit delivery, and TLS are configured separately. Enabling one does not enable the others.
- Not a certification
- These controls can support a review. RustFS does not claim SOC 2, ISO, or HIPAA certification on this page.
Identity and access management
RustFS includes a built-in IAM system. Root credentials from the server environment bypass identity-policy checks, so production use means creating users, groups, and policies.
Dynamic STS temporary credentials
Issue token-based temporary credentials to reduce long-term secret exposure and simplify controlled delegation.
Data encryption
Protect object data at rest and keep key ownership aligned with enterprise security requirements.
SSE-S3, SSE-KMS, and SSE-C
Server-side encryption modes are available after you configure them. SSE-S3 uses the configured KMS to wrap per-object keys. It is not already enabled for production data.
KMS when you enable it
SSE-KMS can use a local backend, Vault KV2, or Vault Transit. KMS is off until RUSTFS_KMS_ENABLE is set and the backend is configured.
Security audit
Audit records can support incident review after you enable a target. Audit delivery is disabled by default, and a target is not a compliance certification.
Request-level audit records
When an audit target is enabled, RustFS can send request activity to an external system for review. Delivery is off until you configure it.
Audit targets you enable
Audit delivery is disabled by default. After you configure a target, supported families include webhook, Kafka, and Pulsar.
Authentication
Integrate RustFS into enterprise identity systems without turning login and operator access into custom glue code.
OIDC for Console SSO
Console single sign-on needs an OIDC provider, a confidential client, a callback URL, and claim-to-policy mapping. It is not active until that setup is done.
Provider setup required
Follow the provider guide for your identity system. RustFS policies still authorize S3 and admin operations after the provider authenticates the user.
mTLS
Protect service-to-service traffic with mutual identity verification and certificate automation.
mTLS when enabled
Mutual TLS is off until RUSTFS_SERVER_MTLS_ENABLE is set and client certificates are in place. On Kubernetes, the Helm chart can turn it on.
cert-manager on Kubernetes
The Helm chart can use cert-manager to issue and renew Ingress and mTLS certificates when you enable that configuration. Install cert-manager first.