CIS MinIO Object Storage Benchmark

This recommendation verifies that root credentials are rotated and dedicated service accounts used on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check MinIO access keys:
mc admin user list myminio

# Verify root credentials are not used for regular operations:
mc admin user info myminio root 2>&1

# Change root credentials:
export MINIO_ROOT_USER=admin-$(openssl rand -hex 4)
export MINIO_ROOT_PASSWORD=$(openssl rand -base64 32)

# Create dedicated service accounts:
mc admin user add myminio app-user $(openssl rand -base64 24)

# Assign policy:
mc admin policy attach myminio readwrite --user app-user

This recommendation verifies that IAM policies follow least-privilege per bucket and action on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List IAM policies:
mc admin policy list myminio

# Check user policies:
mc admin policy entities myminio --user app-user

# Verify no wildcard policies:
mc admin policy info myminio readwrite | grep -i 'Resource\|Action'

# Create least-privilege policy:
cat > /tmp/app-policy.json << 'EOF'
{
  "Version":"2012-10-17",
  "Statement":[{
    "Effect":"Allow",
    "Action":["s3:GetObject","s3:PutObject","s3:ListBucket"],
    "Resource":[
      "arn:aws:s3:::app-data/*",
      "arn:aws:s3:::app-data"
    ]
  }]
}
EOF
mc admin policy create myminio app-policy /tmp/app-policy.json
mc admin policy attach myminio app-policy --user app-user

This recommendation verifies that TLS is enabled with valid certificates for all connections on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS configuration:
mc admin info myminio | grep -i tls

# Verify certificate:
openssl s_client -connect minio.example.com:9000 2>/dev/null | openssl x509 -noout -dates -subject

# Check for HTTP (should fail):
curl -s -o /dev/null -w '%{http_code}' http://minio.example.com:9000/minio/health/live

# Configure TLS:
mkdir -p ${HOME}/.minio/certs
cp server.crt ${HOME}/.minio/certs/public.crt
cp server.key ${HOME}/.minio/certs/private.key

# Start with TLS:
minio server /data --address ':9000' --console-address ':9001'

# Or set environment:
export MINIO_SERVER_URL=https://minio.example.com:9000
export MINIO_BROWSER_REDIRECT_URL=https://console.minio.example.com:9001

This recommendation verifies that server-side encryption at rest is configured with KES on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check encryption at rest:
mc admin kms status myminio

# Verify SSE configuration:
mc encrypt info myminio/mybucket

# Configure server-side encryption:
# Set up KES (Key Encryption Service):
export MINIO_KMS_KES_ENDPOINT=https://kes.example.com:7373
export MINIO_KMS_KES_KEY_NAME=minio-default-key
export MINIO_KMS_KES_CERT_FILE=/etc/minio/certs/kes-client.crt
export MINIO_KMS_KES_KEY_FILE=/etc/minio/certs/kes-client.key

# Enable auto-encryption on bucket:
mc encrypt set sse-kms minio-default-key myminio/mybucket

This recommendation verifies that no buckets allow anonymous or public access on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check bucket policies:
mc anonymous get myminio/mybucket

# List all buckets:
mc ls myminio

# Check for public buckets:
for b in $(mc ls myminio --json | python3 -c 'import sys,json; [print(json.loads(l)["key"].rstrip("/")) for l in sys.stdin]'); do
  mc anonymous get myminio/$b
done

# Remove public access:
mc anonymous set none myminio/mybucket

# Apply bucket policy:
cat > /tmp/bucket-policy.json << 'EOF'
{
  "Version":"2012-10-17",
  "Statement":[{
    "Effect":"Deny",
    "Principal":{"AWS":["*"]},
    "Action":["s3:*"],
    "Resource":["arn:aws:s3:::mybucket/*"],
    "Condition":{"Bool":{"aws:SecureTransport":"false"}}
  }]
}
EOF
mc anonymous set-json /tmp/bucket-policy.json myminio/mybucket

This recommendation verifies that versioning and object locking are enabled for critical data on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check versioning:
mc version info myminio/mybucket

# Check object locking:
mc retention info myminio/mybucket

# Enable versioning:
mc version enable myminio/mybucket

# Enable object locking (immutability):
mc mb myminio/compliance-bucket --with-lock
mc retention set --default compliance 365d myminio/compliance-bucket

This recommendation verifies that audit logging is forwarded to webhook or Kafka on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check audit log settings:
mc admin config get myminio audit_kafka 2>/dev/null
mc admin config get myminio audit_webhook 2>/dev/null

# Check console logs:
mc admin logs myminio --last 1h | head -20

# Configure audit webhook:
mc admin config set myminio audit_webhook:primary \
  endpoint="https://siem.example.com/minio-audit" \
  auth_token="<TOKEN>"

# Or configure audit to Kafka:
mc admin config set myminio audit_kafka:primary \
  brokers="kafka1:9092,kafka2:9092" \
  topic="minio-audit"

# Restart MinIO:
mc admin service restart myminio

This recommendation verifies that Prometheus metrics are configured with authentication on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Prometheus metrics:
curl -s https://minio.example.com:9000/minio/v2/metrics/cluster | head -20

# Check metric authentication:
mc admin prometheus generate myminio

# Configure Prometheus metrics:
mc admin prometheus generate myminio > /etc/prometheus/minio-targets.yml

# Add scrape config to prometheus.yml:
# scrape_configs:
# - job_name: minio
#   bearer_token: <TOKEN>
#   metrics_path: /minio/v2/metrics/cluster
#   scheme: https
#   static_configs:
#   - targets: ['minio.example.com:9000']

# Set up alerting rules:
# alert: MinIODiskOffline
#   expr: minio_cluster_disk_offline_total > 0
#   for: 5m

This recommendation verifies that erasure coding with appropriate parity is configured on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check erasure coding configuration:
mc admin info myminio --json | python3 -m json.tool | grep -i 'erasure\|parity\|data'

# Verify drive layout:
mc admin info myminio

# Start MinIO with erasure coding (minimum 4 drives):
minio server /data{1...4}

# Or distributed mode across servers:
minio server https://minio{1...4}.example.com:9000/data{1...4}

# Set storage class for higher parity:
export MINIO_STORAGE_CLASS_STANDARD=EC:3
export MINIO_STORAGE_CLASS_RRS=EC:2

This recommendation verifies that lifecycle rules manage object expiration and tiering on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check lifecycle rules:
mc ilm ls myminio/mybucket

# Verify tiering:
mc admin tier ls myminio

# Create lifecycle rule for expiration:
mc ilm add myminio/mybucket \
  --expiry-days 365 \
  --prefix "logs/" \
  --tags "retention=short"

# Create transition rule to cold storage:
mc admin tier add s3 myminio COLDTIER \
  --endpoint https://s3.example.com \
  --access-key $ACCESS_KEY \
  --secret-key $SECRET_KEY \
  --bucket cold-storage

mc ilm add myminio/mybucket \
  --transition-days 90 \
  --storage-class COLDTIER

This recommendation verifies that MinIO is running the latest stable version on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check MinIO version:
mc admin info myminio | grep -i version

# Check for updates:
mc admin update myminio --dry-run

# Update MinIO:
mc admin update myminio

# Or manual update:
wget https://dl.min.io/server/minio/release/linux-amd64/minio -O /usr/local/bin/minio.new
chmod +x /usr/local/bin/minio.new
systemctl stop minio
mv /usr/local/bin/minio.new /usr/local/bin/minio
systemctl start minio

This recommendation verifies that cluster healing and health monitoring are configured on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check healing status:
mc admin heal myminio --dry-run

# Check cluster health:
mc admin info myminio
mc ping myminio

# Run healing check:
mc admin heal myminio --recursive

# Configure health check monitoring:
curl -s https://minio.example.com:9000/minio/health/live
curl -s https://minio.example.com:9000/minio/health/cluster

# Add systemd watchdog:
# [Service]
# WatchdogSec=30
# Restart=on-failure
# RestartSec=5

This recommendation verifies that site replication is configured for disaster recovery on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check site replication:
mc admin replicate info myminio

# Verify replication status:
mc admin replicate status myminio

# Configure site replication for DR:
mc admin replicate add myminio-site1 myminio-site2

# Verify replication:
mc admin replicate status myminio-site1

# Check replication metrics:
mc admin replicate resync status myminio-site1

This recommendation verifies that continuous backup mirroring is configured for critical data on the MinIO object storage server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the MinIO object storage server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check batch replication status:
mc batch status myminio 2>/dev/null

# Verify backup configuration:
mc mirror --watch --active-active myminio/data backup/data 2>&1 | head -5

# Configure continuous backup:
mc mirror --watch --active-active myminio/critical-data backup/critical-data &

# Create backup script:
cat > /usr/local/bin/minio-backup.sh << 'SCRIPT'
#!/bin/bash
DATE=$(date +%Y%m%d)
mc mirror myminio/critical-data /opt/backups/minio/${DATE}/
find /opt/backups/minio/ -maxdepth 1 -mtime +30 -exec rm -rf {} \;
SCRIPT
chmod +x /usr/local/bin/minio-backup.sh
echo '0 3 * * * root /usr/local/bin/minio-backup.sh' > /etc/cron.d/minio-backup