ONTAP 9.14.1 commands

storage aggregate object-store config modify

Modify object store configuration attributes

Availability: This command is available to cluster administrators at the admin privilege level.

Description

The storage aggregate object-store config modify command is used to update one or more of object store configuration parameters. This command must not be used to reassociate an existing valid object-store configuration to a new object-store or container. The modifiable parameters include object store name, server name, port, access_key, secret-password, ipspace and is-ssl-enabled.

Parameters

-object-store-name <text> - Object Store Configuration Name

This parameter identifies the configuration to be modified.

[-new-object-store-name <text>] - Object Store Configuration New Name

This optional parameter specifies the new name for the object store configuration.

[-auth-type <object_store_auth_type>] - Authentication Used to Access the Object Store

This optional parameter specifies where the system obtains credentials for authentication to an object store. The available choices depend on the platform (Cloud Volumes ONTAP or not) and provider-type (AWS_S3 or not). The keys value is always applicable, and if selected means that the access-key and secret-password are provided by the system administrator. In Cloud Volumes ONTAP, the EC2-IAM value is also applicable. It means that the IAM role is associated with the EC2 instance, and that the access-key , secret-password and session token are are retrieved from EC2 instance metadata for this IAM role. Note that -use-iam-role and -auth-type are mutually exclusive, -auth-type EC2-IAM is an equivalent of -use-iam-role true , and -auth-type key is an equivalent of -use-iam-role false . In Cloud Volumes ONTAP, the GCP-SA value may also be applicable. It means that a session token is retrieved from the GCP instance metadata for the Service Account associated with the GCP instance. Similarly, Azure-MSI means that a session token is retrieved from the Azure instance metadata for the Managed Service Identity (MSI) associated with the Azure instance. For the AWS_S3 provider, the CAP (C2S Authentication Portal) value is also applicable. This should only be used when accessing C2S (Commercial Cloud Services). If the CAP value is specified, then the`-cap-url` must be specified. See cap-url .

[-cap-url <text>] - URL to Request Temporary Credentials for C2S Account

This parameter is available only when -auth-type is CAP . It specifies a full URL of the request to a CAP server for retrieving temporary credentials (access-key, secret-pasword and session token) for accessing the object store server. The CAP URL may look like: https://123.45.67.89:1234/CAP/api/v1/credentials?agency=myagency=mymission=myrole

[-server <Remote InetAddress>] - Fully Qualified Domain Name of the Object Store Server

This optional parameter specifies the new Fully Qualified Domain Name (FQDN) of the same object store server. For Amazon S3, server name must be an AWS regional endpoint in the format s3.amazonaws.com or s3-<region>.amazonaws.com, for example, s3-us-west-2.amazonaws.com. The region of the server and the bucket must match. For more information on AWS regions, refer to 'Amazon documentation on AWS regions and endpoints'. For Azure, if the -server is a "blob.core.windows.net" or a "blob.core.usgovcloudapi.net", then the value of azure-account in the configuration followed by a period will be added in front of the server. Note that the value of azure-account cannot be modified.

[-is-ssl-enabled {true|false}] - Is SSL/TLS Enabled

This optional parameter indicates whether a secured SSL/TLS connection will be used during data access to the object store.

[-port <integer>] - Port Number of the Object Store

This optional parameter specifies a new port number to connect to the object store server indicated in the -server parameter.

[-access-key <text>] - Access Key ID for S3 Compatible Provider Types

This optional parameter specifies a new access key (access key ID) for the AWS S3, SGWS, IBM COS object stores and ONTAP S3.

[-secret-password <text>] - Secret Access Key for S3 Compatible Provider Types

This optional parameter specifies a new password (secret access key) for the AWS S3, SGWS, IBM COS object stores and ONTAP S3. For an Azure object store see -azure-private-key . If the -access-key is specified but the -secret-password is not then one will be asked to enter the -secret-password without echoing the input.

[-ask-azure-private-key {true|false}] - Ask to Enter the Azure Access Key without Echoing

If this optional parameter is true then one will be asked to enter the -azure-private-key without echoing the input.

[-azure-private-key <text>] - Azure Access Key

This optional parameter specifies a new access key for Azure object store. For other object store providers see secret-password . See also ask-azure-private-key .

[-azure-sas-token <text>] - Azure Account Shared Access Signature token

This parameter specifies the shared access signature token to authenticate requests and provide limited access to storage resources in the Azure object store. Any previously stored token will be overwritten by the token specified in this parameter. Pass an empty string in single quotes to clear any previously stored token.

[-ipspace <IPspace>] - IPspace to Use in Order to Reach the Object Store

This optional parameter specifies new ipspace values for the configuration.

[-is-certificate-validation-enabled {true|false}] - Is SSL/TLS Certificate Validation Enabled

This optional parameter indicates whether an SSL/TLS certificate of an object store server is validated whenever an SSL/TLS connection to an object store server is established. This parameter is only applicable when is-ssl-enabled is true . It is recommended to keep the default value which is true to make sure that Data ONTAP connects to a trusted object store server, otherwise identities of an object store server are not verified.

[-use-http-proxy {true|false}] - Use HTTP Proxy

This optional parameter indicates whether an HTTP proxy will be used for connecting to an object store. Note that an HTTP proxy is configured using the vserver http-proxy commands at the diagnostic privilege level.

[-server-side-encryption {none | SSE-S3}] - Encryption of Data at Rest by the Object Store Server

This parameter specifies if AWS or other S3 compatible object store server must encrypt data at rest. The available choices depend on provider-type. none encryption (no encryption required) is supported by all S3 (non-Azure) object store servers. SSE-S3 encryption is supported by all S3 (non-Azure) object store servers except ONTAP_S3. This is an advanced property. In most cases it is best not to change default value of "sse_s3" for object store servers which support SSE-S3 encryption. The encryption is in addition to any encryption done by ONTAP at a volume or at an aggregate level. Note that changing this option does not change encryption of data which already exist in the object store.

[-url-style {path-style | virtual-hosted-style}] - URL Style Used to Access S3 Bucket

This parameter specifies the URL style used to access S3 bucket. This option is only available for non-Azure object store providers. The available choices and default value depend on provider-type.

Examples

The following example modifies two parameters (port number and is-ssl-enabled) of an object store configuration named my-store:

cluster1::>storage aggregate object-store config modify -object-store-name my-store -port 1235 -is-ssl-enabled true
Top of Page