TrueNAS
Products
Support & Resources
Get A Quote
Solutions
Company
Sign In
  1. Documentation Hub
  2. /
  3. TrueNAS 27 (Early)
  4. /
  5. System Settings
  6. /
  7. Services
  8. /
  9. S3 Service Screen
Edit page
TrueNASTrueNAS Development Documentation
This content follows experimental development changes in TrueNAS 27, a future version of TrueNAS.
Use the Product and Version selectors above to view content specific to a stable software release.

S3 Service Screen

  5 minute read.

The S3 service screen shows settings to configure where the S3 service listens for client requests, the certificate for encrypted connections, and service-wide options that apply to every bucket.

To open the screen, go to Shares, click the more_vert icon on the Object Storage (S3) Buckets card, and then select Config Service.

S3 Service Screen
Figure 1: S3 Service Screen

Changing the listen addresses, the number of servers, or the region restarts the S3 service. A restart waits up to 30 seconds for client requests in progress to finish. Other changes apply without a restart.

Save applies the settings.

Listeners Settings

The Listeners settings select the IP addresses and ports the S3 service listens on, and the certificate for listeners that use TLS.

S3 Listen Address Settings
Figure 2: S3 Listen Address Settings
Click Here for More Information
SettingDescription
Listen AddressesClick Add to add a listen address. Each listen address shows the Address, Port, and TLS settings. Add up to eight listen addresses. Leave empty to listen on every IP address on port 9000 without TLS. Click the close icon to remove a listen address.
Address(Required) Select an IP address from the dropdown list. The list shows the static IP addresses on the system, the loopback addresses, and the wildcard addresses 0.0.0.0 and :: that listen on every IPv4 or IPv6 address. On HA systems, the list shows the virtual IP (VIP) addresses.
Port(Required) Enter the TCP port for the listen address. The default is 9000. Each address and port combination can only be listed once.
TLSSelect to encrypt connections to this listen address using the certificate selected in Certificate. Leave cleared to accept unencrypted connections. A system with more than one network can serve a storage network without TLS and a management network with TLS.
CertificateSelect the certificate for listen addresses that use TLS. The default, Use UI certificate, uses the certificate assigned to the TrueNAS web UI, so a renewal or change of the UI certificate also applies to the S3 service. Manage Certificates opens the Certificates screen.

Other Options Settings

The Other Options settings configure service performance, the region name, and logging.

Click Here for More Information
SettingDescription
Servers(Required) Enter the number of server threads that handle client connections. The default is 1. Enter a number from 1 to 8 that does not exceed the number of CPUs in the system. Each server uses its own connection pool and buffers, so more servers use more memory.
RegionEnter the region name the S3 service reports to clients, for example us-east-1. Enter up to 63 lowercase letters, numbers, and hyphens. Leave empty to accept any region a client uses.
Log Level(Required) Select the least serious type of message the S3 service records in its log. Options are Error, Warning, Notice, Info, and Debug. The default is Notice. Info adds one log record for every client request.

Protocol-Created Buckets Settings

The Protocol-Created Buckets setting allows S3 clients to create buckets.

Click Here for More Information

Browsing to select a path

Click the arrow to the left of the folder icon to expand that folder and show any child datasets and directories. A solid folder icon shows for datasets and an outlined folder for directories. A selected dataset or directory folder and name shows in blue.

SettingDescription
Managed Root DatasetSelect the dataset where TrueNAS creates a dataset for each bucket that an S3 client creates. The dataset must already exist. Create Dataset opens a dialog to create a dataset under the selected dataset. Leave empty to refuse bucket creation requests from S3 clients. Buckets you add from the Shares screen use the Parent Dataset you select instead. A client can only create buckets with an access key that has Manage Buckets selected.

Global Grants Settings

The Global Grants setting applies grants to every bucket on the system.

S3 Global Grants and Auditing Settings
Figure 4: S3 Global Grants and Auditing Settings
Click Here for More Information
SettingDescription
Global GrantsClick Add to add a grant that applies to every bucket. Each grant shows the Principal, User or Group, and Access settings, with the same options as the bucket grants. A Deny global grant blocks the principal from every bucket, and overrides any grant on an individual bucket.

Auditing Settings

The Auditing settings set the default audit behavior for buckets that do not set their own. S3 auditing is a licensed feature. The section shows a Premium tag when the system license does not include it.

Click Here for More Information
SettingDescription
Default Audit(Required) Select which operations to audit on buckets that have Audit set to Use service default. Options are Audit all actions, Audit nothing, and Audit selected actions. The default is Audit nothing. This setting is the only way to audit bucket creation (CreateBucket) and bucket list (ListAllMyBuckets) requests.
Audited ActionsShows when Default Audit is Audit selected actions. Select one or more S3 operations from the dropdown list.
Default Audit Overflow(Required) Select what happens to an audited request when the audit log cannot accept another record. Options are Drop the record and Answer the client with a retryable 503. The default is Drop the record.

Amazon S3 is a trademark of Amazon.com, Inc. or its affiliates.

Related Content

Reference
Tutorial
Solutions

Have more questions?

For further discussion or assistance, see these resources:

Found content that needs an update?  You can suggest content changes directly! To request changes to this content, click the Feedback button located on the middle-right side of the page (might require disabling ad blocking plugins).