You should be prepared to enter the S3 server name as a Fully Qualified Domain Name (FQDN), which clients will use for S3 access. The FQDN must not begin with a bucket name.

You should have a self-signed CA certificate (created in previous steps) or a certificate signed by an external CA vendor. A CA certificate is not necessary for a local tiering use case, where IP traffic is going over cluster LIFs only.

About this task

When an object store server is created, a root user with UID 0 is created. No access key or secret key is generated for this root user. The ONTAP administrator must run the object-store-server users regenerate-keys command to set the access key and secret key for this user.

As a Fujitsu best practice, do not use this root user. Any client application that uses the access key or secret key of the root user has full access to all buckets and objects in the object store.

See the vserver object-store-server man pages for additional configuration and display options.

Example 1. Steps

ONTAP System Manager

Use this procedure if you are adding an S3 server to an existing storage VM. To add an S3 server to a new storage VM, see Create a storage SVM for S3.

You should be prepared to enter IP addresses for interface role Data.

Enable S3 on an existing storage VM.
1. Select the storage VM: click Storage > Storage VMs, select a storage VM, click Settings, and then click under S3.
2. Click Enable S3, then enter the S3 Server Name.
3. Select the certificate type.
  
  Whether you select system-generated certificate or one of your own, it will be required for client access.
4. Enter the network interfaces.
If you selected the system-generated certificate, you see the certificate information when the new storage VM creation is confirmed. Click Download and save it for client access.
- The secret key will not be displayed again.
- If you need the certificate information again: click Storage > Storage VMs, select the storage VM, and click Settings.

CLI

Create the S3 server:

vserver object-store-server create -vserver svm_name -object-store-server s3_server_fqdn -certificate-name s3_server_name -comment text [additional_options]

You can specify additional options when creating the S3 server or at any time later.
- The SVM name can be either a data SVM or Cluster (the system SVM name) if you are configuring local tiering.
- HTTPS is enabled by default on port 443. You can change the port number with the -secure-listener-port option.
  
  When HTTPS is enabled, CA certificates are required for proper integration with SSL/TLS.
- HTTP is disabled by default; when enabled, the server listens on port 80. You can enable it with the -is-http-enabled option or change the port number with the -listener-port option.
  
  When HTTP is enabled, all the request and responses are sent over the network in clear text.
Verify that S3 is configured as desired:

vserver object-store-server show

Example

The following command verifies the configuration values of all object storage servers:

cluster1::> vserver object-store-server show

            Vserver: vs1

                      Object Store Server Name: s3.example.com
                          Administrative State: up
                        Listener Port For HTTP: 80
                Secure Listener Port For HTTPS: 443
                                  HTTP Enabled: false
                                 HTTPS Enabled: true
             Certificate for HTTPS Connections: svm1_ca
                                       Comment: Server comment