RustFS

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for RustFS. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, then create or select a security group. The group must allow inbound port 22 from your management network and inbound port 443 from the trusted networks that will reach the console and the S3 API.

Leave the root volume at the default size or larger. The dedicated data volume mounted at /var/lib/rustfs defaults to 50 GiB, and you can resize it independently in the EC2 console.

Select Launch instance. First-boot initialisation takes approximately one minute after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud RustFS Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=rustfs-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched:

AMI variant SSH login user

RustFS on Ubuntu 24.04 ubuntu

The first boot service runs before the SSH daemon becomes ready, so the credentials file is always in place when you log in for the first time.

sudo cat /root/rustfs-credentials.txt

The file is plain text. It contains the console URL, the S3 API URL, the RustFS access key and the RustFS secret key. Copy these values to a secure place such as a password manager or an encrypted vault. Do not commit them to source control.

Each command block in this guide that talks to RustFS begins by reading the credentials into shell variables, so every block is self-contained:

ACCESS_KEY="$(sudo awk -F= '/^rustfs.access.key=/ {print $2}' /root/rustfs-credentials.txt)" SECRET_KEY="$(sudo awk -F= '/^rustfs.secret.key=/ {print $2}' /root/rustfs-credentials.txt)" echo "access key: ${ACCESS_KEY}; secret length: ${#SECRET_KEY}"

nginx serves the console sign-in page over TLS and returns HTTP 200 with no authentication. The certificate is self-signed, so pass -k to curl to skip certificate verification when you probe from the instance itself.

curl -ksS https://127.0.0.1/rustfs/console/ -o /dev/null -w "console HTTP %{http_code}\n"

You should see console HTTP 200. If you see anything else, check the service status with sudo systemctl status rustfs.service and the journal with sudo journalctl -u rustfs.service -n 50. Confirm that nginx is up with sudo systemctl status nginx.service.

Open a browser on a workstation in a network that is allowed inbound on port 443, and browse to:

https://<public-ip>/rustfs/console/

The certificate is self-signed, so your browser warns you on the first visit. Accept the warning to proceed, or install your own CA-issued certificate as described in Step 8.

On the RustFS console sign-in page, select the Key Login tab. Enter the access key in the Account field and the secret key in the Key field.

After you sign in, the console opens the Buckets overview. It lists every bucket on the server with its object count, size and access policy, and it is empty on a fresh instance.

Select a bucket to open the object browser. There you can upload files and folders, filter the object list, and preview, download, rename or delete individual objects.

The Access Keys page issues additional service account keys for applications. Each key can be scoped by a policy and an expiry date, so applications never need the root credentials. Select Add Access Key, and the console generates an access key and secret key for you to record.

The AWS CLI is installed at /usr/local/bin/aws. RustFS is fully S3-compatible, so the CLI works against it with only an explicit endpoint URL.

Run the following block on the instance. It points the CLI at the loopback S3 API with the generated credentials, creates a bucket, uploads a small object, and lists the bucket:

ACCESS_KEY="$(sudo awk -F= '/^rustfs.access.key=/ {print $2}' /root/rustfs-credentials.txt)" SECRET_KEY="$(sudo awk -F= '/^rustfs.secret.key=/ {print $2}' /root/rustfs-credentials.txt)" export AWS_ACCESS_KEY_ID="${ACCESS_KEY}" export AWS_SECRET_ACCESS_KEY="${SECRET_KEY}" export AWS_EC2_METADATA_DISABLED=true export AWS_DEFAULT_REGION=us-east-1 EP="http://127.0.0.1:9000" aws --endpoint-url "${EP}" s3 mb s3://my-first-bucket echo "hello from sac" > /tmp/hello.txt aws --endpoint-url "${EP}" s3 cp /tmp/hello.txt s3://my-first-bucket/hello.txt aws --endpoint-url "${EP}" s3 ls s3://my-first-bucket/

You can browse the same bucket and object in the console. To remove the object and the bucket again, run:

ACCESS_KEY="$(sudo awk -F= '/^rustfs.access.key=/ {print $2}' /root/rustfs-credentials.txt)" SECRET_KEY="$(sudo awk -F= '/^rustfs.secret.key=/ {print $2}' /root/rustfs-credentials.txt)" export AWS_ACCESS_KEY_ID="${ACCESS_KEY}" export AWS_SECRET_ACCESS_KEY="${SECRET_KEY}" export AWS_EC2_METADATA_DISABLED=true export AWS_DEFAULT_REGION=us-east-1 EP="http://127.0.0.1:9000" aws --endpoint-url "${EP}" s3 rm s3://my-first-bucket/hello.txt aws --endpoint-url "${EP}" s3 rb s3://my-first-bucket

From a workstation that has the AWS CLI installed and inbound network access to port 443 of the instance, point the CLI at the HTTPS endpoint. The shipped certificate is self-signed, so add --no-verify-ssl or install your own certificate as in Step 8.

Replace <access-key>, <secret-key> and <public-ip> with the values from /root/rustfs-credentials.txt:

# Run on a workstation that has the AWS CLI v2 installed. AWS_ACCESS_KEY_ID=<access-key> \
  AWS_SECRET_ACCESS_KEY=<secret-key> \
  aws --endpoint-url https://<public-ip> --no-verify-ssl s3 mb s3://app-bucket AWS_ACCESS_KEY_ID=<access-key> \
  AWS_SECRET_ACCESS_KEY=<secret-key> \
  aws --endpoint-url https://<public-ip> --no-verify-ssl s3 ls

In production, do not use the root credentials directly from application code. Issue a dedicated service account key on the console Access Keys page (Step 5), scope it to the least privilege the application needs, and use that access key in the application. Rotate the access key on a schedule that suits your security posture.

The image ships with a per-instance, self-signed certificate at /etc/rustfs/tls/cert.pem and /etc/rustfs/tls/key.pem, so the console and API are encrypted out of the box. For production, replace it with a certificate that clients trust.

The simplest pattern on AWS is to attach an Elastic Load Balancer in front of the instance, terminate TLS on the load balancer with an AWS Certificate Manager certificate, and forward to the instance on port 443.

To terminate TLS on the instance itself, obtain a certificate for a DNS name that points at the instance, for example with the certbot CLI and a certbot certonly challenge. Then replace cert.pem and key.pem under /etc/rustfs/tls/ with the issued certificate and private key, and reload nginx:

sudo cp /etc/letsencrypt/live/<your-domain>/fullchain.pem /etc/rustfs/tls/cert.pem
sudo cp /etc/letsencrypt/live/<your-domain>/privkey.pem /etc/rustfs/tls/key.pem
sudo systemctl reload nginx

The simplest backup strategy is to sync buckets to another S3-compatible target on a schedule with the AWS CLI. The target can be another RustFS instance, an Amazon S3 bucket, or any other S3-compatible service. Run aws s3 sync from the instance with two profiles or two sets of credentials, one for the local RustFS endpoint and one for the destination.

Maintain the operating system with the standard Ubuntu package manager. Apply security updates with sudo apt-get update && sudo apt-get -y dist-upgrade, and reboot the instance when a kernel update is installed.

To grow the storage tier, resize the EBS data volume in the EC2 console and run sudo resize2fs /dev/<device> on the instance. RustFS picks up the new capacity immediately. The root volume and the data volume are independent, so growing the storage tier does not require touching the operating system disk.