RustFS S3-Compatible Object Storage

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Why This RustFS Image Over Alternatives

RustFS is a high-performance, S3-compatible object storage server written in Rust and licensed under Apache 2.0. Most RustFS images and manual installations ship with the well-known rustfsadmin/rustfsadmin default credentials, requiring immediate manual rotation. This image eliminates that risk entirely - every instance generates a unique access key and secret key on first boot, stored in a root-only file, before the storage engine starts on an empty backend. A pre-configured nginx reverse proxy terminates TLS on port 443 with a per-instance self-signed certificate, a dedicated EBS data volume holds your buckets, and 24/7 expert support from cloudimg means you move from launch to first API call in minutes without touching configuration files.

## Object Storage Stack

• RustFS server running as a hardened systemd service, S3-compatible REST API and built-in web console in a single Rust binary
• S3-compatible REST API for any S3 client (AWS CLI, boto3, s3cmd, rclone) - reached over TLS through the nginx proxy on port 443
• Built-in web console for buckets, objects, users, policies and access keys, served over TLS on port 443
• AWS CLI bundled for command-line bucket and object management
• Dedicated EBS data volume for buckets and objects, independently resizable from the root volume

## Secure First Boot

On first launch a one-shot systemd service generates a cryptographically random RustFS access key and secret key, writes them into the RustFS environment file, generates a fresh per-instance TLS certificate, and stores the plain-text credentials in a file readable only by the root OS user. The insecure rustfsadmin default is never present in the image, and the raw storage ports are bound to loopback only - the sole network entry points are SSH, an HTTP-to-HTTPS redirect, and the TLS console and API on port 443.

## Security and Encryption Guidance

• Encryption in transit: TLS is enabled out of the box on port 443 with a self-signed certificate. Replace it with your own CA-issued certificate for production, following the reverse proxy section of the user guide.
• Encryption at rest: Enable EBS encryption on the dedicated data volume at launch to protect stored objects with AWS-managed or customer-managed KMS keys.
• Network isolation: Deploy the instance in a private VPC subnet. Restrict Security Group ingress to only the ports and source IPs your workload requires (443, and 22 for administration).

## Ready To Use

Browse to the instance public or private IP over HTTPS to reach the web console and sign in with the generated credentials. Alternatively, point any S3-compatible client at the same HTTPS endpoint. Create buckets, upload objects, and configure access policies immediately.

## Example Use Case: DevOps Artifact Storage

A platform team stores Terraform state files, container images, and CI/CD build artifacts in RustFS running on a single m5.large instance with a large EBS data volume. The S3 API integrates directly with existing pipelines without code changes, replacing a managed object storage service while keeping data within the team's VPC and benefiting from Rust-native throughput.

## Additional Use Cases

• Backup, archive, and snapshot targets for hybrid cloud workloads
• Application object stores for media, documents, and logs
• Data lake and analytics staging areas for AI and ML workloads
• Container registry backend storage
• CI/CD artifact repositories

## cloudimg Support

24/7 technical support by email and live chat. Our engineers assist with RustFS deployment, access policy configuration, S3 client integration, TLS certificate replacement, performance tuning, and storage administration. Critical issues receive a one-hour average response time.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.