# 添加别名
mc alias set myminio http://localhost:9000 admin password123

# 添加带 API 签名的别名
mc alias set s3backup https://s3.amazonaws.com \
  AKIAIOSFODNN7EXAMPLE \
  wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

# 列出所有别名
mc alias list

# 删除别名
mc alias remove myminio

# 导出别名配置
mc alias list > aliases.json

# 导入别名配置
mc alias import < aliases.json

# 开发环境
mc alias set minio-dev http://dev.minio.local:9000 admin devpass

# 测试环境
mc alias set minio-test http://test.minio.local:9000 admin testpass

# 生产环境
mc alias set minio-prod https://minio.company.com admin prodpass

# 快速切换
export MC_HOST_minio=admin:password@http://localhost:9000

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::mybucket/*"
    }
  ]
}

# 创建只读策略文件
cat > read-only-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::mybucket"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::mybucket/*"
    }
  ]
}
EOF

# 应用策略
mc admin policy create myminio/read-only read-only-policy.json

# 列出所有策略
mc admin policy list myminio/

# 查看策略详情
mc admin policy info myminio/read-only

# 创建用户
mc admin user add myminio newuser newpassword

# 创建带策略的用户
mc admin user add myminio readonlyuser --policy read-only

# 查看用户列表
mc admin user list myminio/

# 查看用户信息
mc admin user info myminio/newuser

# 禁用用户
mc admin user disable myminio/newuser

# 启用用户
mc admin user enable myminio/newuser

# 删除用户
mc admin user remove myminio/newuser

# 创建组
mc admin group add myminio developers newuser1 newuser2

# 查看组信息
mc admin group info myminio/developers

# 为组设置策略
mc admin policy attach myminio/read-only --group developers

# 从组中移除用户
mc admin group remove myminio developers newuser1

# 列出所有组
mc admin group list myminio/

# 附加策略到用户
mc admin policy attach myminio/read-only --user newuser

# 附加策略到组
mc admin policy attach myminio/read-only --group developers

# 分离策略
mc admin policy detach myminio/read-only --user newuser

# SQL 查询 JSON 文件
mc sql --recursive --storage-class STANDARD \
  --query "select * from S3Object" \
  myminio/mybucket/data.json

# 查询 CSV 文件
mc sql --query "SELECT * FROM S3Object WHERE age > 25" \
  myminio/mybucket/users.csv

# 查询 JSON 文件
mc sql --query "SELECT name, email FROM S3Object WHERE active = true" \
  myminio/mybucket/users.json

# 递归查询目录
mc sql --recursive \
  --query "SELECT count(*) FROM S3Object" \
  myminio/mybucket/logs/

# 带条件的查询
mc sql \
  --query "SELECT _1.name, _1.price FROM S3Object WHERE _1.category = 'electronics'" \
  myminio/mybucket/products.ndjson

# 设置存储桶加密
mc encryption set sse-s3 myminio/mybucket

# 查看加密状态
mc encryption info myminio/mybucket

# 禁用加密
mc encryption set none myminio/mybucket

# 上传时指定加密
mc cp encrypted-file.txt myminio/mybucket/ \
  --enc-sse-s3

# 配置 KMS (使用 Vault 作为示例)
export MINIO_KMS_KES_ENDPOINT=https://kes.minio.local:7373
export MINIO_KMS_KES_KEY_NAME=my-minio-key
export MINIO_KMS_KES_CERT_FILE=kes-cert.pem
export MINIO_KMS_KES_KEY_FILE=kes-key.pem
export MINIO_KMS_KES_CAPATH=kes-ca.pem

# 设置存储桶加密
mc encryption set sse-kms myminio/mybucket

# 使用特定密钥加密
mc cp file.txt myminio/mybucket/ \
  --enc-sse-kms=my-key-name

# 使用客户密钥加密上传
mc cp file.txt myminio/mybucket/ \
  --enc-sse-c=my-32-byte-key-1234567890 \
  --enc-sse-c-file=keyfile

# 下载加密文件
mc cp myminio/mybucket/file.txt /tmp/ \
  --decryption-key file.key

# 为对象设置标签
mc tag set myminio/mybucket/file.txt "project=analytics" "env=production"

# 列出对象标签
mc tag list myminio/mybucket/file.txt

# 删除对象标签
mc tag remove myminio/mybucket/file.txt project

# 批量设置标签
mc tag set --recursive myminio/mybucket/*.txt "backup=true"

# 按标签查询对象
mc ls --tag "project=analytics" myminio/mybucket/

# 设置存储桶标签
mc tag set myminio/mybucket "project=analytics" "cost-center=engineering"

# 列出存储桶标签
mc tag list myminio/mybucket

# 删除存储桶标签
mc tag remove myminio/mybucket project

{
  "arn": "minioio:sqs:us-east-1:1:webhook",
  "config": {
    "endpoint": "http://webhook.example.com/notify",
    "authToken": "Bearer TOKEN"
  },
  "event": ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"]
}

# 添加 webhook 通知
mc event add myminio/mybucket \
  arn:minioio:sqs::1:webhook \
  --event put,get,delete

# 列出通知规则
mc event list myminio/mybucket

# 删除通知规则
mc event remove myminio/mybucket arn:minioio:sqs::1:webhook

# 配置审计日志
mc admin config set myminio audit_webhook \
  endpoint=http://audit-server:8080/audit \
  auth_token=YOUR_AUTH_TOKEN

# 重启服务生效
mc admin service restart myminio

# 查看审计配置
mc admin config get myminio audit_webhook

# 设置审计过滤
mc admin config set myminio \
  audit_webhook=endpoint=http://audit-server:8080/audit \
  audit_webhook/auth_token=YOUR_TOKEN \
  audit_webhook/client_cert=/path/to/cert.pem \
  audit_webhook/client_key=/path/to/key.pem

# 比较本地和远程差异
mc diff myminio/mybucket /local/path/

# 示例输出
# Comparing "/local/path/" to "myminio/mybucket/"
# upload: file1.txt -> file1.txt
# missing: file2.txt
# extra:   file3.txt

# 查找文件
mc find myminio/mybucket --name "*.log"

# 按大小查找
mc find myminio/mybucket --size +1G

# 按时间查找
mc find myminio/mybucket --newer 2024-01-01

# 执行操作
mc find myminio/mybucket --name "*.tmp" --exec "mc rm {}"

# 批量加密
mc encrypt encrypt --suffix ".conf" myminio/mybucket/

# 批量解密
mc decrypt decrypt --suffix ".conf" myminio/mybucket/

# 重新加密
mc encrypt re-encrypt myminio/mybucket/old-key myminio/mybucket/new-key