MinIO

Open Marketplace in the Azure Portal, search for MinIO, select the SecureAnyCloud publisher entry, and select Create.

On the Networking tab, attach a network security group (NSG) that allows three inbound rules. Allow TCP 22 from your management IP range. Allow TCP 9001 (the Console) from your admin networks. Allow TCP 9000 (the S3 API) from your application networks.

Do not expose the Console (9001) to the public internet. Root credentials are written in plain text on the VM, and an internet-exposed Console makes brute-force attacks trivial. For any public deployment, add TLS at a reverse proxy such as Nginx, Caddy, Apache or Azure Application Gateway.

Select Review + create, wait for validation, then select Create. Deployment takes around two minutes.

Set the variables at the top of the script, then run it. It creates a resource group, a virtual network, an NSG with three rules and the VM.

RG="minio-prod" LOCATION="eastus" VM_NAME="minio-01" ADMIN_USER="azureuser" GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-sac/providers/Microsoft.Compute/galleries/sacGallery/images/minio-ubuntu-24-04/versions/<version>" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create \
  --resource-group "$RG" \
  --name minio-vnet --address-prefix 10.94.0.0/16 \
  --subnet-name minio-subnet --subnet-prefix 10.94.1.0/24 az network nsg create --resource-group "$RG" --name minio-nsg az network nsg rule create \
  --resource-group "$RG" --nsg-name minio-nsg \
  --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create \
  --resource-group "$RG" --nsg-name minio-nsg \
  --name allow-s3-api --priority 110 \
  --source-address-prefixes 10.94.0.0/16 \
  --destination-port-ranges 9000 --access Allow --protocol Tcp az network nsg rule create \
  --resource-group "$RG" --nsg-name minio-nsg \
  --name allow-console --priority 120 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 9001 --access Allow --protocol Tcp az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username "$ADMIN_USER" --ssh-key-values "$SSH_KEY" \
  --vnet-name minio-vnet --subnet minio-subnet --nsg minio-nsg \
  --public-ip-sku Standard

Connect to the VM over SSH:

ssh azureuser@<vm-ip>

minio.service is already running, and minio-firstboot.service has already rotated the root credentials.

Check the service status. The expected state is active (running).

sudo systemctl status minio.service --no-pager

Confirm the first-boot sentinel file exists:

sudo test -f /var/lib/sac/data/minio-firstboot.done && echo FIRSTBOOT_DONE

Confirm that both listeners are up:

sudo ss -tln | grep -E ':9000|:9001'

Check the health endpoint:

curl -s http://localhost:9000/minio/health/live echo "exit=$?"

Print the credentials file as root:

sudo cat /stage/scripts/minio-credentials.log

The file contains:

ROOT_USER=<ROOT_USER> ROOT_PASSWORD=<ROOT_PASSWORD> S3_API_PORT=9000 CONSOLE_PORT=9001

Store both values in your secret store. The file is mode 0600, readable by root only.

Open http://<vm-ip>:9001 in your browser. The MinIO Console sign-in page appears.

Sign in with the ROOT_USER and ROOT_PASSWORD from Step 5. After you sign in, MinIO opens the Object Browser.

Recommended: open Identity, then Users, in the left navigation and create per-application accounts. This keeps production workloads from authenticating as the shared root user.

Open Buckets in the left navigation. On a fresh VM, the list is empty.

Select Create Bucket, enter a name, and select Create Bucket again. To do the same from the command line, run:

export ROOT_USER="$(sudo awk -F= '/^ROOT_USER=/{print $2}' /stage/scripts/minio-credentials.log)"
export ROOT_PASS="$(sudo awk -F= '/^ROOT_PASSWORD=/{print $2}' /stage/scripts/minio-credentials.log)" mc alias set local http://127.0.0.1:9000 "${ROOT_USER}" "${ROOT_PASS}" --api S3v4 mc mb local/sac-test

Open Identity, then Users, in the left navigation.

Create a user account for each application. Attach the canned readwrite policy or a custom least-privilege policy, and generate a service access key and secret. Use those credentials in your application's S3 client configuration instead of the root credentials.

From the CLI, the same workflow is:

mc admin user add local app-user 'app-strong-password-here' mc admin policy attach local readwrite --user app-user

Open Monitoring, then Metrics, for MinIO's built-in metrics dashboard. It plots requests per second, bandwidth, error rates and storage usage.

For longer-term metrics retention, MinIO exposes a Prometheus scrape endpoint at http://<vm-ip>:9000/minio/v2/metrics/cluster, authenticated with the root token. Pair it with the SecureAnyCloud Grafana 12 image and a Prometheus instance for full observability.

Upload a small file, download it again and remove it:

echo "sac-roundtrip-ok" > /tmp/probe.txt mc cp /tmp/probe.txt local/sac-test/probe.txt mc cp local/sac-test/probe.txt /tmp/probe-back.txt cat /tmp/probe-back.txt mc rm local/sac-test/probe.txt mc rb local/sac-test

The expected output is sac-roundtrip-ok, followed by clean removals.

Any aws-sdk works. This Python boto3 example lists the buckets:

python3 -c " import boto3 s3 = boto3.client( 's3', endpoint_url='http://<vm-ip>:9000', aws_access_key_id='<ROOT_USER>', aws_secret_access_key='<ROOT_PASSWORD>', region_name='us-east-1', ) print(s3.list_buckets()) "

For production, generate a per-application access key in the Console and use it instead of the root credentials. Open Identity, then Users, select the user, and open Service Accounts.

These are the key files and paths on the VM:

• MinIO server binary: /usr/local/bin/minio
• mc client: /usr/local/bin/mc
• Data directory: /mnt/minio-data
• Server configuration: /etc/default/minio
• Systemd unit: /etc/systemd/system/minio.service
• First-boot script: /usr/local/sbin/minio-firstboot.sh
• First-boot service: /etc/systemd/system/minio-firstboot.service
• Credentials file: /stage/scripts/minio-credentials.log
• First-boot sentinel: /var/lib/sac/data/minio-firstboot.done

Inspect the installed versions:

minio --version mc --version

Check the status:

sudo systemctl status minio.service --no-pager

Stop, start or restart:

sudo systemctl stop minio.service
sudo systemctl start minio.service
sudo systemctl restart minio.service

View the logs (systemd journal):

sudo journalctl -u minio.service --no-pager -n 50

The image is single-node and single-drive, which suits development, staging and small workloads. For production, apply the following changes.

• Use multi-node erasure coding. Use at least 4 drives in a coded set, across one or more nodes. MinIO's distributed mode requires --server <pool> syntax in the start command. Edit MINIO_VOLUMES in /etc/default/minio to point at the multi-drive layout.
• Front MinIO with TLS. Terminate TLS at a reverse proxy (the SecureAnyCloud nginx-ssl-certbot-ubuntu-24-04 image is purpose-built for this). Alternatively, drop public.crt and private.key into /etc/minio/certs and set MINIO_OPTS="--certs-dir /etc/minio/certs".
• Restrict the Console (9001). Allow admin networks only, through the NSG.
• Restrict the API (9000). Allow your application server subnets only, through the NSG.
• Switch to a separate data disk. Attach a Premium SSD, format it with xfs, mount it at /mnt/minio-data and set ownership to minio-user:minio-user.

You cannot reach the Console on port 9001

• Confirm the service is running: sudo systemctl status minio.service
• Confirm the listeners are bound: sudo ss -tln | grep -E ':9000|:9001'
• Check the journal: sudo journalctl -u minio.service --no-pager -n 50
• Confirm the NSG allows TCP 9001 from your client's source IP

You cannot authenticate to the Console

• Read the credentials again: sudo cat /stage/scripts/minio-credentials.log
• Confirm the first-boot sentinel exists: ls -la /var/lib/sac/data/minio-firstboot.done
• If first boot did not run, check its service: sudo systemctl status minio-firstboot.service --no-pager

An S3 client fails with "InvalidAccessKeyId" or "SignatureDoesNotMatch"

• Confirm the access key is exactly the value of ROOT_USER (not MINIO_ROOT_USER)
• Confirm the secret is exactly ROOT_PASSWORD, with no whitespace
• Confirm region_name is set to us-east-1. MinIO accepts any value, but the SDK requires one
• Confirm endpoint_url matches the server's actual address and port

The service fails to start

• Check the journal: sudo journalctl -u minio.service --no-pager -n 100
• Check the filesystem space: df -h /mnt/minio-data
• Verify the data directory ownership with sudo ls -la /mnt/minio-data. It should be minio-user:minio-user

• Rotate the root credentials on a schedule. Edit /etc/default/minio and restart minio.service.
• Create per-application users under Identity, then Users. Never connect application code as root.
• Restrict the Console port (9001) to admin networks only.
• Enable TLS before you expose MinIO to anything other than a private VNet.
• Enable bucket versioning for buckets that hold important data: mc version enable local/<bucket>
• Set bucket retention policies for compliance-heavy data: mc retention set --default GOVERNANCE 30d local/<bucket>
• Audit access logs by enabling MinIO's audit webhook or Kafka target.
• Keep MinIO updated by periodically re-installing the latest .deb from dl.min.io. Data is preserved across upgrades.
• Shred the credentials file once the root credentials are in your secret store: sudo shred -u /stage/scripts/minio-credentials.log

MinIO is dual-licensed under AGPLv3 (community) and a commercial license from MinIO Inc. SecureAnyCloud ships the community AGPLv3 build. If you redistribute MinIO as part of a closed-source product or SaaS, the AGPLv3 obligations apply, or you can purchase a commercial license from MinIO Inc.

SecureAnyCloud provides commercial support for the SecureAnyCloud image, covering deployment, configuration and integration with other SecureAnyCloud products. This support is separate from the MinIO project itself.

• Email: sales@secureanycloud.com
• Website: secureanycloud.com
• Support hours: 24/7, with a guaranteed 24-hour response SLA

Deploy on Azure

Launch MinIO on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch MinIO on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for MinIO. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network, inbound port 80 from the trusted networks that will reach the Console, and inbound port 9000 from the trusted networks that will reach the S3 API. Do not open port 9001 directly to the public internet, because the Console is fronted by nginx on port 80.

Leave the root volume at the default size or larger. The dedicated data volume mounted at /var/lib/minio defaults to 50 GiB, and you can resize it independently in the EC2 console.

Select Launch instance. First-boot initialisation takes approximately one minute after the instance state becomes Running and the status checks pass.

Run the following command to launch an instance from the SecureAnyCloud MinIO Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22, 80 and 9000 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=minio-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address withaws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the AMI variant you launched. For MinIO on Ubuntu 24.04, the login user is ubuntu.

The first-boot service runs before the SSH daemon is ready, so the credentials file is always in place when you log in for the first time.

ssh <login-user>@<public-ip>
sudo cat /root/minio-credentials.txt

The plain text file contains the Console URL, the S3 API URL, the MinIO root user and the MinIO root password. Copy these values somewhere secure, such as a password manager or an encrypted vault. Do not commit them to source control.

Each command block in this guide that talks to MinIO begins by reading the root credentials into shell variables, so every block is self-contained:

ROOT_USER="$(sudo awk -F= '/^minio.root.user=/ {print $2}' /root/minio-credentials.txt)" ROOT_PASS="$(sudo awk -F= '/^minio.root.pass=/ {print $2}' /root/minio-credentials.txt)" echo "root user: ${ROOT_USER}; password length: ${#ROOT_PASS}"

MinIO exposes a built-in liveness endpoint. It returns HTTP 200 OK whenever the server process is alive, with no authentication required. It reports only whether the server process is up, not whether any backing storage is healthy.

curl -fsS http://127.0.0.1:9000/minio/health/live -o /dev/null -w "HTTP %{http_code}\n"

You should see HTTP 200. If you see anything else, check the service status with sudo systemctl status minio.service and read the journal with sudo journalctl -u minio.service -n 50.

Open a browser on a workstation in a network that is allowed inbound on port 80, and browse to:

http://<public-ip>/

The MinIO Console sign-in page appears. Sign in as the root user with the root password from the credentials file. The Console opens on the buckets overview, which is empty on a fresh instance.

The first time you sign in, you may see a one-off AGPLv3 license acknowledgement dialog. Select Acknowledge to dismiss it.

You then reach the object browser, the primary administration surface in the MinIO Community Edition Console. The left sidebar lists every bucket on the server, and the main pane shows the objects in the selected bucket. Selecting an object opens an inspector pane on the right. It shows the object's metadata (name, size, last modified, ETag, tags) and offers quick actions to download, generate a shareable link, preview, edit tags and delete.

To create a bucket, select Create Bucket at the top of the sidebar. Enter the bucket name in the dialog and select Create Bucket to confirm. Bucket names must follow the standard S3 naming rules: lowercase letters, digits and hyphens only, between 3 and 63 characters, starting and ending with a letter or digit.

The MinIO Community Edition Console focuses on the object browser. User management, access key issuance, policy management and the admin dashboard are features of the paid AIStor tier of MinIO. On the Community Edition image, the mc admin command line exposes the equivalent administrative actions. The next step covers it.

The MinIO Client mc is installed at /usr/local/bin/mc. Configure an alias that points at the local MinIO server, using the generated root credentials:

ROOT_USER="$(sudo awk -F= '/^minio.root.user=/ {print $2}' /root/minio-credentials.txt)" ROOT_PASS="$(sudo awk -F= '/^minio.root.pass=/ {print $2}' /root/minio-credentials.txt)" mc alias set local http://127.0.0.1:9000 "${ROOT_USER}" "${ROOT_PASS}" mc admin info local

mc admin info prints the server endpoint, drive layout, uptime and a one-line health summary. Next, create your first bucket, upload a small object and list the bucket contents:

mc mb local/my-first-bucket echo "hello from sac" > /tmp/hello.txt mc cp /tmp/hello.txt local/my-first-bucket/ mc ls local/my-first-bucket/

You can browse the same bucket and object in the Console. To delete the object and the bucket, run:

mc rm local/my-first-bucket/hello.txt mc rb local/my-first-bucket

The MinIO server is fully S3-compatible, so any S3 client works with it. You change only the endpoint URL and the access keys.

From a workstation that has the AWS CLI installed and inbound network access to port 9000 of the instance, pass the MinIO root credentials and an explicit endpoint URL:

# Run on a workstation that has the AWS CLI v2 installed.
# Replace <root-user>, <root-pass> and <public-ip> with the values from
# /root/minio-credentials.txt on the instance. AWS_ACCESS_KEY_ID=<root-user> \
  AWS_SECRET_ACCESS_KEY=<root-pass> \
  aws --endpoint-url http://<public-ip>:9000 s3 mb s3://aws-cli-bucket AWS_ACCESS_KEY_ID=<root-user> \
  AWS_SECRET_ACCESS_KEY=<root-pass> \
  aws --endpoint-url http://<public-ip>:9000 s3 ls

In production, do not use the root credentials directly from application code. Create an application user with the mc admin user add command, which is the equivalent of the Console Identity, Users page on the paid AIStor tier. Attach the least-privileged built-in or custom policy that the application needs, for example readwrite scoped to a single bucket. Then generate an access key for that user and use it in the application.

Rotate the access key on a schedule that suits your security posture.

The image ships with nginx fronting the Console on port 80. For production, terminate TLS so that the Console and the S3 API are reachable over HTTPS only.

The most common pattern is to attach an Elastic Load Balancer in front of the instance, terminate TLS on the load balancer with an ACM certificate, and forward to the instance on port 80. The alternative is to terminate TLS on the instance itself, with a certificate issued by Let's Encrypt and the certbot CLI. This requires a DNS name that points at the instance and inbound port 443 from the public internet in the security group.

If you terminate TLS on the instance, replace the contents of /etc/nginx/sites-available/minio-console with an HTTPS server block. Run sudo certbot --nginx -d <your-domain>, then reload nginx with sudo systemctl reload nginx.

Also wrap the S3 API on port 9000 in HTTPS for production. Either terminate TLS at the load balancer in front of the instance, or configure MinIO with MINIO_OPTS that point at a certificate.

The simplest backup strategy is to use the MinIO Client mc to mirror buckets to another S3-compatible target on a schedule. The target can be another MinIO instance, an Amazon S3 bucket or any other S3-compatible service.

The mc mirror command keeps the source and the target in sync, and mc mirror --watch keeps them in sync continuously.

# Replace <aws-access-key> and <aws-secret-key> with an IAM access key pair
# that has s3:* on the destination bucket, and replace <my-offsite-bucket>
# with the name of the destination bucket. Run this on the instance. mc alias set offsite https://s3.amazonaws.com <aws-access-key> <aws-secret-key> mc mirror local/my-first-bucket offsite/<my-offsite-bucket>

Maintain the operating system with the standard Ubuntu package manager. Apply security updates with sudo apt-get update && sudo apt-get -y dist-upgrade, and reboot the instance when a kernel update is installed.

Update the MinIO server with sudo mc admin update local. It downloads the latest upstream binary, verifies its checksum and asks the running MinIO process to restart itself.

To grow the storage tier, resize the EBS data volume in the EC2 console, then run sudo resize2fs /dev/<device> on the instance. MinIO picks up the new capacity immediately. The root volume and the data volume are independent, so you do not need to touch the operating system disk.