<commit_before># MinIO S3 Gateway [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)

MinIO S3 Gateway adds MinIO features like MinIO Console and disk caching to AWS S3 or any other AWS S3 compatible service.

## Run MinIO Gateway for AWS S3
As a prerequisite to run MinIO S3 gateway, you need valid AWS S3 access key and secret key by default. Optionally you can also set custom access/secret key, when you have rotating AWS IAM credentials or AWS credentials through environment variables (i.e. AWS_ACCESS_KEY_ID)

### Using Docker
```
podman run -p 9000:9000 --name minio-s3 \
 -e "MINIO_ROOT_USER=aws_s3_access_key" \
 -e "MINIO_ROOT_PASSWORD=<PASSWORD>" \
 minio/minio gateway s3
```

### Using Binary
```
export MINIO_ROOT_USER=aws_s3_access_key
export MINIO_ROOT_PASSWORD=aws_s3_secret_key
minio gateway s3
```

### Using Binary in EC2
Using IAM rotating credentials for AWS S3

If you are using an S3 enabled IAM role on an EC2 instance for S3 access, MinIO will still require env vars MINIO_ROOT_USER and MINIO_ROOT_PASSWORD to be set for its internal use. These may be set to any value which meets the length requirements. Access key length should be at least 3, and secret key length at least 8 characters.
```
export MINIO_ROOT_USER=custom_access_key
export MINIO_ROOT_PASSWORD=custom_secret_key
minio gateway s3
```

MinIO gateway will automatically look for list of credential styles in following order, if your backend URL is AWS S3.

- AWS env vars (i.e. AWS_ACCESS_KEY_ID)
- AWS creds file (i.e. AWS_SHARED_CREDENTIALS_FILE or ~/.aws/credentials)
- IAM profile based credentials. (performs an HTTP call to a pre-defined endpoint, only valid inside configured ec2 instances)

Minimum permissions required if you wish to provide restricted access with your AWS credentials, please make sure you have following IAM policies attached for your AWS user or roles.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "readonly",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::testbucket/*"
        },
        {
            "Sid": "readonly",
            "Effect": "Allow",
            "Action": [
                "s3:HeadBucket",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::testbucket"
        }<commit_msg>fix: Mention GetBucketyPolicy in S3 gateway docs policy (#12642)<commit_after># MinIO S3 Gateway [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)

MinIO S3 Gateway adds MinIO features like MinIO Console and disk caching to AWS S3 or any other AWS S3 compatible service.

## Run MinIO Gateway for AWS S3
As a prerequisite to run MinIO S3 gateway, you need valid AWS S3 access key and secret key by default. Optionally you can also set custom access/secret key, when you have rotating AWS IAM credentials or AWS credentials through environment variables (i.e. AWS_ACCESS_KEY_ID)

### Using Docker
```
podman run -p 9000:9000 --name minio-s3 \
 -e "MINIO_ROOT_USER=aws_s3_access_key" \
 -e "MINIO_ROOT_PASSWORD=aws_s3_secret_key" \
 minio/minio gateway s3
```

### Using Binary
```
export MINIO_ROOT_USER=aws_s3_access_key
export MINIO_ROOT_PASSWORD=aws_s3_secret_key
minio gateway s3
```

### Using Binary in EC2
Using IAM rotating credentials for AWS S3

If you are using an S3 enabled IAM role on an EC2 instance for S3 access, MinIO will still require env vars MINIO_ROOT_USER and MINIO_ROOT_PASSWORD to be set for its internal use. These may be set to any value which meets the length requirements. Access key length should be at least 3, and secret key length at least 8 characters.
```
export MINIO_ROOT_USER=custom_access_key
export MINIO_ROOT_PASSWORD=custom_secret_key
minio gateway s3
```

MinIO gateway will automatically look for list of credential styles in following order, if your backend URL is AWS S3.

- AWS env vars (i.e. AWS_ACCESS_KEY_ID)
- AWS creds file (i.e. AWS_SHARED_CREDENTIALS_FILE or ~/.aws/credentials)
- IAM profile based credentials. (performs an HTTP call to a pre-defined endpoint, only valid inside configured ec2 instances)

Minimum permissions required if you wish to provide restricted access with your AWS credentials, please make sure you have following IAM policies attached for your AWS user or roles.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "readonly",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::testbucket/*"
        },
        {
            "Sid": "readonly",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketPolicy",
                "s3:HeadBucket",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::testbucket"
        }
{'fraction_non_alphanumeric': 0.08479412963717896, 'fraction_numerical': 0.01956787607011822, 'mean_word_length': 3.2228915662650603, 'pattern_counts': {'":': 20, '<': 4, '<?xml version=': 0, '>': 4, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2595981', 'n_tokens_mistral': 1539, 'n_tokens_neox': 1442, 'n_words': 565}