```sh
aws s3api put-object --bucket testbucket --key lockme --object-lock-mode GOVERNANCE --object-lock-retain-until-date "2019-11-20"  --body /etc/issue
```

The MinIO server requires an available KMS to en/decrypt SSE-S3 encrypted objects. Therefore it is possible to erase or lock some or all encrypted objects. For example in case of a detected attack or other emergency situations the following actions can be taken:

- Creation of STS credentials
- Creation and deletion of service accounts (except those owned by the root user)
- Changes to Bucket features such as:
  - Bucket Policies
  - Bucket Tags
  - Bucket Object-Lock configurations (including retention and legal hold configuration)
  - Bucket Encryption configuration

> NOTE: Bucket versioning is automatically enabled for all new and existing buckets on all replicated sites.

	if ! checkBucketExists $BUCKET; then
		if [ ! -z $OBJECTLOCKING ]; then
			if [ $OBJECTLOCKING = true ]; then
				echo "Creating bucket with OBJECTLOCKING '$BUCKET'"
				${MC} mb --with-lock myminio/$BUCKET
			elif [ $OBJECTLOCKING = false ]; then
				echo "Creating bucket '$BUCKET'"
				${MC} mb myminio/$BUCKET
			fi
		elif [ -z $OBJECTLOCKING ]; then
			echo "Creating bucket '$BUCKET'"

```
~ mc admin config set alias/ heal
KEY:

2018/12/26 17:49:36 listening on http://localhost:8080/
```

> NOTE: for a reasonable test outcome, make sure the assumed user has at least permission/policy to list all buckets. That policy would look like below:

```
{
  "version": "2012-10-17",
  "statement": [
    {
      "effect": "Allow",
      "action": [
        "s3:ListAllMyBuckets"
      ],
      "resource": [

        "fe012443-6ba9-4ef2-bb94-b729d2060c78/test123/testw3c.pdf/xl.meta": {"Versions":[{"Type":1,"V2Obj":{"ID":"aGEA/ZUOR4ueRIZs...

HTTP/1.1 503 Service Unavailable
Accept-Ranges: bytes
Content-Length: 0
Server: MinIO
Vary: Origin
X-Amz-Bucket-Region: us-east-1
X-Minio-Write-Quorum: 3
X-Amz-Request-Id: 16239D6AB80EBECF
X-Xss-Protection: 1; mode=block
Date: Tue, 21 Jul 2020 00:36:14 GMT
```

### Cluster-readable probe

The reply is '200 OK' if cluster has read quorum if not it returns '503 Service Unavailable'.

```

- Multi destination replication

## How to use?

Ensure that versioning is enabled on the source and target buckets with `mc version` command. If object locking is required, the buckets should have been created with `mc mb --with-lock`

### Create a bucket for Veeam backups

Create a bucket for Veeam Backup, e.g.,

```
mc mb myminio/veeambackup
```

> NOTE: For Veeam Backup with Immutability, create the bucket with object lock enabled, e.g.,

```
mc mb -l myminio/veeambackup
```