MinIO

Connect MinIO to collect cloud storage provider evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In MinIO:

   1. Write a policy file that allows only the bucket-listing actions Safeguard needs (MinIO policies use AWS IAM syntax).
   2. Create the policy: mc admin policy create ALIAS safeguard-read policy.json.
   3. Create a dedicated user: mc admin user add ALIAS USERNAME PASSWORD, and attach the policy: mc admin policy attach ALIAS safeguard-read --user USERNAME.
   4. Generate an access key for that user: mc admin accesskey create ALIAS USERNAME (add --policy policy.json to restrict the key further, and --expiry-duration if you want it to expire).
   5. Copy the access key and secret key from the command output.

   Where to find the other values:

   • Server URL: The https endpoint of your MinIO deployment (the URL your mc alias points to).

   MinIO's public documentation does not cover every step.

   MinIO's docs now redirect to the AIStor documentation; the mc commands are the same. The built-in readonly policy only reads a specific object without listing, so a custom policy is needed for bucket listing. MinIO Console steps were not sourced. The docs do not say whether the secret key is shown only once. Verification removed the action names s3:ListAllMyBuckets and s3:GetBucket* because the fetched pages do not list them.

   Source: min.io, docs.min.io, docs.min.io, checked 2026-10-07.

   The permissions Safeguard needs: s3:ListAllMyBuckets, s3:GetBucket*.

2. On Compliance › Connectors, open MinIO, click Connect, choose API token and fill in:

   Field	What to enter
   Server URL	Required. Your own server: an https address reachable from the internet.
   Access key	Required. Stored encrypted and never shown again.
   Secret key	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read MinIO and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Cloud Storage Provider connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks