# KMS IAM/Config Encryption

MinIO supports encrypting config, IAM assets with KMS provided keys. If the KMS is not enabled, MinIO will store the config, IAM data as plain text erasure coded in its backend.

## MinIO KMS Quick Start

MinIO supports two ways of encrypting IAM and configuration data.
You can either use KES - together with an external KMS - or, much simpler,

    override fun intercept(chain: Interceptor.Chain): Response {
      val level = this.level

      val request = chain.request()
      if (level == Level.NONE) {
        return chain.proceed(request)
      }

      val logBody = level == Level.BODY
      val logHeaders = logBody || level == Level.HEADERS

      val requestBody = request.body

      val connection = chain.connection()

import org.apache.logging.log4j.Logger;
import org.codelibs.core.lang.StringUtil;

/**
 * Utility class for text normalization and processing.
 *
 * This class provides methods to normalize text by reading characters from a provided Reader
 * and processing them according to specific rules. The main functionality is encapsulated
 * within the nested {@link TextNormalizeContext} class.
 *
 * <p>The text normalization process includes:
 * <ul>

import io.minio.errors.XmlParserException;

/**
 * Handler for the "storage" protocol, allowing access to objects stored in a MinIO-compatible storage service.
 * This handler extends {@link URLStreamHandler} to provide a way to open connections to storage objects
 * using URLs with the "storage" protocol.
 *
 * <p>
 * The URL format is expected to be: {@code storage://bucketName/objectName}.

            dst[start + ANDX_OFFSET_OFFSET + 1] = (byte) 0xde;

            // andx not used; return
            return dstIndex - start;
        }

        /* The message provided to batch has a batchLimit that is
         * higher than the current batchLevel so we will now encode
         * that chained message. Before doing so we must increment

 * </ul>
 *
 * <p>The main purpose of {@link #addListener addListener} is to support this chaining. You will
 * rarely use it directly, in part because it does not provide direct access to the {@code Future}
 * result. (If you want such access, you may prefer {@link Futures#addCallback
 * Futures.addCallback}.) Still, direct {@code addListener} calls are occasionally useful:
 *
 * {@snippet :

 * </ul>
 *
 * <p>The main purpose of {@link #addListener addListener} is to support this chaining. You will
 * rarely use it directly, in part because it does not provide direct access to the {@code Future}
 * result. (If you want such access, you may prefer {@link Futures#addCallback
 * Futures.addCallback}.) Still, direct {@code addListener} calls are occasionally useful:
 *
 * {@snippet :

			<groupId>jakarta.servlet</groupId>
			<artifactId>jakarta.servlet-api</artifactId>
			<version>5.0.0</version>
			<scope>provided</scope>
		</dependency>
		<dependency>
			<groupId>jakarta.annotation</groupId>
			<artifactId>jakarta.annotation-api</artifactId>
			<version>2.1.1</version>
			<scope>provided</scope>
		</dependency>
		<dependency>
			<groupId>org.slf4j</groupId>
			<artifactId>slf4j-api</artifactId>

 *
 * <p>The extractor supports two types of password management:
 * <ul>
 *   <li>Static passwords configured via {@link #addPassword(String, String)}</li>
 *   <li>Dynamic passwords provided through extraction parameters</li>
 * </ul>
 *
 * <p>Passwords are matched against URLs or resource names using regular expression patterns.

      return new MaxCodePoint(userFriendly);
    }

    public MaxCodePoint(String userFriendly) {
      value = decode(userFriendly);
    }
  }

  /**
   * The default values of maxCodePoint below provide pretty good performance models of different
   * kinds of common human text.
   *
   * @see MaxCodePoint#decode
   */
  @Param({"0x80", "0x90", "0x100", "0x800", "0x10000", "0x10ffff"})
  MaxCodePoint maxCodePoint;