#!/usr/bin/env/python

import boto3
from botocore.client import Config

s3 = boto3.client('s3',
        endpoint_url='http://localhost:9000',
        aws_access_key_id='YOUR-ACCESSKEYID',
        aws_secret_access_key='YOUR-SECRETACCESSKEY',
        config=Config(signature_version='s3v4'),
        region_name='us-east-1')


def _add_header(request, **kwargs):
    request.headers.add_header('x-minio-extract', 'true')

```
docker service create --name="minio-service" \
  --secret="my_access_key" \
  --secret="my_secret_key" \
  --env="MINIO_ROOT_USER_FILE=my_access_key" \
  --env="MINIO_ROOT_PASSWORD_FILE=my_secret_key" \
  quay.io/minio/minio server /data
```

```
mc encrypt info myminio/bucket/
Auto encryption 'sse-s3' is enabled
```

### Using environment (not-recommended)

MinIO automatically encrypts all objects on buckets if KMS is successfully configured and following ENV is enabled:

```
export MINIO_KMS_AUTO_ENCRYPTION=on
```

### Verify auto-encryption

> Note that auto-encryption only affects requests without S3 encryption headers. So, if a S3 client sends

ENV MINIO_ACCESS_KEY_FILE=access_key \
    MINIO_SECRET_KEY_FILE=secret_key \
    MINIO_ROOT_USER_FILE=access_key \
    MINIO_ROOT_PASSWORD_FILE=secret_key \
    MINIO_KMS_SECRET_KEY_FILE=kms_master_key \
    MINIO_UPDATE_MINISIGN_PUBKEY="RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav" \
    MINIO_CONFIG_ENV_FILE=config.env

		return args, err
	}

	opaURL := env.Get(EnvIamOpaURL, "")
	if opaURL == "" {
		opaURL = env.Get(EnvPolicyOpaURL, kv.Get(URL))
		if opaURL == "" {
			return args, nil
		}
	}
	authToken := env.Get(EnvIamOpaAuthToken, "")
	if authToken == "" {
		authToken = env.Get(EnvPolicyOpaAuthToken, kv.Get(AuthToken))
	}

	u, err := xnet.ParseHTTPURL(opaURL)

		return cfg, nil
	}

	allowEnc := env.Get(EnvCompressAllowEncryption, kvs.Get(AllowEncrypted))
	if allowEnc == "" {
		allowEnc = env.Get(EnvCompressAllowEncryptionLegacy, "")
	}

	cfg.AllowEncrypted, err = config.ParseBool(allowEnc)
	if err != nil {
		return cfg, err
	}

	compressExtensions := env.Get(EnvCompressExtensions, kvs.Get(Extensions))
	compressExtensionsLegacy := env.Get(EnvCompressExtensionsLegacy, "")

	if err = config.CheckValidKeys(config.CallhomeSubSys, kvs, DefaultKVS); err != nil {
		return cfg, err
	}

	cfg.Enable = env.Get(config.EnvMinIOCallhomeEnable,
		kvs.GetWithDefault(Enable, DefaultKVS)) == config.EnableOn
	cfg.Frequency, err = time.ParseDuration(env.Get(config.EnvMinIOCallhomeFrequency,
		kvs.GetWithDefault(Frequency, DefaultKVS)))
	return cfg, err

#!/usr/bin/env bash
#

_init() {

	shopt -s extglob

	## Minimum required versions for build dependencies
	GIT_VERSION="1.0"
	GO_VERSION="1.16"
	OSX_VERSION="10.8"
	KNAME=$(uname -s)
	ARCH=$(uname -m)
	case "${KNAME}" in
	SunOS)
		ARCH=$(isainfo -k)
		;;
	esac
}

## FIXME:
## In OSX, 'readlink -f' option does not exist, hence
## we have our own readlink -f behavior here.

		return cfg, err
	}

	bitrot := env.Get(EnvBitrot, kvs.GetWithDefault(Bitrot, DefaultKVS))
	if _, err = parseBitrotConfig(bitrot); err != nil {
		return cfg, fmt.Errorf("'heal:bitrotscan' value invalid: %w", err)
	}

	cfg.Bitrot = bitrot

	cfg.Sleep, err = time.ParseDuration(env.Get(EnvSleep, kvs.GetWithDefault(Sleep, DefaultKVS)))
	if err != nil {

	}

	var proxyURL *xnet.URL
	proxy := env.Get(config.EnvMinIOSubnetProxy, kvs.Get(config.Proxy))
	if len(proxy) > 0 {
		proxyURL, err = xnet.ParseHTTPURL(proxy)
		if err != nil {
			return cfg, err
		}

	}

	cfg.License = strings.TrimSpace(env.Get(config.EnvMinIOSubnetLicense, kvs.Get(config.License)))
	cfg.APIKey = strings.TrimSpace(env.Get(config.EnvMinIOSubnetAPIKey, kvs.Get(config.APIKey)))