# How to use S3 Plugin with a Keystore

**URL:** <https://discuss.elastic.co/t/how-to-use-s3-plugin-with-a-keystore/122613>\
**Category:** Elasticsearch\
**Created:** [March 5, 2018, 11:29pm UTC](https://discuss.elastic.co/t/how-to-use-s3-plugin-with-a-keystore/122613 "2018-03-05T23:29:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rhugga](https://avatars.discourse-cdn.com/v4/letter/r/71e660/32.png) [@rhugga](https://discuss.elastic.co/u/rhugga)\
**Post date:** [March 5, 2018, 11:29pm UTC](https://discuss.elastic.co/t/how-to-use-s3-plugin-with-a-keystore/122613/1 "2018-03-05T23:29:50Z")

</div>

I'm trying to configure the S3 plugin to use a non-AWS S3 storage platform with access credentials stored in a keystore. I can't seem to find where or how you reference the keystore and key names.

Thx

---

<div class="post-metadata">

**Author:** ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)\
**Post date:** [March 9, 2018, 6:28am UTC](https://discuss.elastic.co/t/how-to-use-s3-plugin-with-a-keystore/122613/2 "2018-03-09T06:28:14Z")

</div>

See the [S3 repository documentation](https://www.elastic.co/guide/en/elasticsearch/plugins/current/repository-s3-client.html). In particular, note the `access_key` and `secret_key` settings which must exist in the keystore for the named client, and the `endpoint` setting to specify where your s3 service exists. Also please note that we do not officially support s3 clones. The only way it will work is if the clone implements the current s3 api (eg v4 auth, domain based bucket resolution, etc).

---

<div class="post-metadata">

**Author:** ![rhugga](https://avatars.discourse-cdn.com/v4/letter/r/71e660/32.png) [@rhugga](https://discuss.elastic.co/u/rhugga)\
**Post date:** [March 20, 2018, 6:33pm UTC](https://discuss.elastic.co/t/how-to-use-s3-plugin-with-a-keystore/122613/3 "2018-03-20T18:33:09Z")

</div>

So client in this example from the docs is an actual client hostname?

bin/elasticsearch-keystore add s3.client.default.access\_key

And how does something know to use a keystore?

The documentation for this is horribly lacking.

---

<div class="post-metadata">

**Author:** ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)\
**Post date:** [March 20, 2018, 8:22pm UTC](https://discuss.elastic.co/t/how-to-use-s3-plugin-with-a-keystore/122613/4 "2018-03-20T20:22:56Z")

</div>

> So client in this example from the docs is an actual client hostname?

I'm not sure I understand the question. Can you please rephrase?

> And how does something know to use a keystore?

The code must be updated to look in the keystore for a setting. This was done for all sensitive settings for s3-repository.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2018, 8:23pm UTC](https://discuss.elastic.co/t/how-to-use-s3-plugin-with-a-keystore/122613/5 "2018-04-17T20:23:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.