[WRITE][risk=medium] Replace the bucket policy. Reversible → prior policy JSON.

An anonymous-Allow policy makes the bucket public — check bucket_exposure_audit after changing policies.

Refuses a policy whose explicit Deny on s3:PutBucketPolicy covers this tool's own access key: an explicit Deny beats every Allow, so the undo that replays the prior policy would itself be denied. Enforced under dry_run too.

Args: bucket_name: Bucket name (from bucket_ls). policy_json: Full policy document as a JSON string (must contain 'Statement'). dry_run: If True, preview without applying. target: MinIO target name from config; omit for the default.

[WRITE][risk=medium] Remove the bucket policy (back to private/default).

Reversible → the prior policy JSON is captured and re-applied on undo.

Args: bucket_name: Bucket name (from bucket_ls). dry_run: If True, preview without removing. target: MinIO target name from config; omit for the default.

[WRITE][risk=medium] Enable or suspend bucket versioning. Reversible → prior state.

Args: bucket_name: Bucket name (from bucket_ls). status: "Enabled" or "Suspended". dry_run: If True, preview without changing versioning. target: MinIO target name from config; omit for the default.

[WRITE][risk=medium] Replace the bucket lifecycle. Reversible → prior config.

Pass the day-count knobs (rules are built for you: current-version expiry, noncurrent-version expiry), or lifecycle_xml to apply a configuration verbatim (used by undo restores). REPLACES any existing rules — the prior config is captured for undo.

Aborting abandoned multipart uploads is NOT available here: MinIO refuses a lifecycle rule whose only action is that, and drops the action when it is combined with an expiration. Use remove_incomplete_uploads instead.

The undo restores the RULE, not the data: objects the rule expires before you undo are deleted, and putting the prior configuration back does not bring them back.

Args: bucket_name: Bucket name (from bucket_ls). expire_days: Expire current objects after N days. noncurrent_expire_days: Expire noncurrent versions after N days. prefix: Optional key prefix the rules apply to (empty = whole bucket). lifecycle_xml: Full lifecycle configuration XML to apply verbatim. dry_run: If True, preview without applying. target: MinIO target name from config; omit for the default.

[WRITE][risk=medium] Remove all lifecycle rules. Reversible → prior config.

Args: bucket_name: Bucket name (from bucket_ls). dry_run: If True, preview without removing. target: MinIO target name from config; omit for the default.

[WRITE][risk=medium] Set (>0) or clear (0) the bucket hard quota. Reversible.

Needs admin-capable credentials (admin API).

Args: bucket_name: Bucket name (from bucket_ls). size_bytes: New hard quota in bytes; 0 clears the quota. dry_run: If True, preview without changing the quota. target: MinIO target name from config; omit for the default.

[WRITE][risk=high] Delete a bucket — refused unless verifiably empty. Irreversible.

Pass dry_run=True to preview. The emptiness check includes noncurrent versions and delete markers; this tool never mass-deletes data to force a bucket empty.

Args: bucket_name: Bucket name (from bucket_ls). dry_run: If True, preview (including the emptiness check) without deleting. target: MinIO target name from config; omit for the default.

[WRITE][risk=medium] Abort abandoned multipart uploads (reclaims their parts).

priorState records the count and a sample; the parts themselves are unrecoverable once aborted — no undo. Only uploads at least older_than_days old are touched (default 7), protecting in-flight uploads.

Args: bucket_name: Bucket name (from bucket_ls). older_than_days: Only abort uploads at least this old (0 = all). dry_run: If True, preview the matching uploads without aborting. target: MinIO target name from config; omit for the default.

[READ] Buckets (name + creation time) in a truncation-aware envelope.

Returns {"buckets": [...], "returned": N, "limit": L, "truncated": bool}. When "truncated" is true there are MORE buckets than shown — re-run with a higher limit rather than reporting the list as complete.

Args: limit: Maximum buckets to return (default 500). target: MinIO target name from config; omit for the default.

[READ] One bucket's full config: policy, versioning, lifecycle, encryption, quota, tags.

Args: bucket_name: Bucket name (from bucket_ls). target: MinIO target name from config; omit for the default.

[READ] The bucket's policy JSON (verbatim) + anonymous-access summary.

Args: bucket_name: Bucket name (from bucket_ls). target: MinIO target name from config; omit for the default.

[READ] The bucket's lifecycle rules (null when no lifecycle is set).

Args: bucket_name: Bucket name (from bucket_ls). target: MinIO target name from config; omit for the default.

[READ] The bucket's versioning state: Enabled / Suspended / Off.

Args: bucket_name: Bucket name (from bucket_ls). target: MinIO target name from config; omit for the default.

[READ] The bucket's hard quota (0 = unlimited). Needs admin credentials.

Args: bucket_name: Bucket name (from bucket_ls). target: MinIO target name from config; omit for the default.

[READ] Objects under prefix in a truncation-aware envelope (never a full walk).

Returns {"objects": [...], "returned": N, "limit": L, "truncated": bool}. A bucket can hold millions of keys, so "truncated" being true is the normal case — say so and re-run with a higher limit or a narrower prefix instead of treating the page as the whole bucket. "lastModified" and "versionId" are null when the source had no value.

Args: bucket_name: Bucket name (from bucket_ls). prefix: Key prefix filter; empty for the whole bucket. limit: Maximum objects to return (default 100, max 1000). target: MinIO target name from config; omit for the default.

[READ] In-flight/abandoned multipart uploads in a truncation-aware envelope.

Returns {"uploads": [...], "returned": N, "limit": L, "truncated": bool}. Each row: objectName, uploadId, initiated time (null when the source gave none). When "truncated" is true, re-run with a higher limit.

Args: bucket_name: Bucket name (from bucket_ls). prefix: Key prefix filter; empty for the whole bucket. limit: Maximum uploads to return (default 200). target: MinIO target name from config; omit for the default.

[READ] Admin server info: mode, servers/pools summary. Needs admin credentials.

Args: target: MinIO target name from config; omit for the default.

[READ] Capacity & usage RCA: cause + suggested action per finding.

Call this first on any "storage is filling up / writes are failing" question — it folds capacity vs used, offline drives/nodes, per-drive hotspots, and imbalance into ranked findings with what to do next.

Args: target: MinIO target name from config; omit for the default.

[READ] Per-bucket usage (bytes + objects), biggest first, in an envelope.

Returns {"buckets": [...], "returned": N, "limit": L, "truncated": bool}. When "truncated" is true, buckets outside the top limit were not shown — do not present the list as the deployment's complete usage breakdown.

Args: limit: Maximum rows to return (default 25). target: MinIO target name from config; omit for the default.

[READ] Ranked bucket-exposure findings (riskiest first), cause + action.

Scores every bucket for anonymous/public policy statements (read and write), missing default encryption, versioning off, and no lifecycle — the fastest answer to "is anything in my object storage exposed?".

Args: limit: Maximum buckets to audit (default 100). target: MinIO target name from config; omit for the default.

[READ] ILM gaps per bucket + reclaimable estimate, cause + action.

Finds versioned buckets with no noncurrent expiry (old bytes accrue forever), incomplete multipart uploads with no abort rule (invisible space), and large buckets with no lifecycle at all.

Args: limit: Maximum buckets to analyze (default 100). target: MinIO target name from config; omit for the default.

[READ] Healing backlog + erasure-set write-quorum risk, cause + action.

Answers "how many more drive failures can I take?": per-erasure-set online drives vs write quorum (remaining failure tolerance), drives currently healing, heal backlog/errors — each risk as a plain-language finding.

Args: target: MinIO target name from config; omit for the default.

[READ] Per-drive rows (server, drive, used ratio), fullest first.

Returns {"drives": [...], "returned": N, "error": str | None}. A non-null "error" means the metrics scrape failed — that is NOT the same as a server with no drives, so do not report an empty list as "healthy, nothing to see".

Args: target: MinIO target name from config; omit for the default.

[READ] Node-level view: online/offline nodes + per-node drive counts.

Args: target: MinIO target name from config; omit for the default.

[READ] Node liveness probe (unauthenticated /minio/health/live).

Args: target: MinIO target name from config; omit for the default.

[READ] Node readiness probe (unauthenticated /minio/health/ready).

Args: target: MinIO target name from config; omit for the default.

[READ] Cluster write-quorum health (/minio/health/cluster; 503 = degraded).

Combined with liveness/readiness in one structured answer plus an overall 'healthy' verdict.

Args: target: MinIO target name from config; omit for the default.

[READ] Dashboard-header summary: nodes, drives, capacity, buckets, objects.

Args: target: MinIO target name from config; omit for the default.

[READ] One-shot deployment overview: health + capacity + exposure headline.

Call this first on any broad "how is my object storage doing" question.

Args: target: MinIO target name from config; omit for the default.

[READ][risk=low] IAM users with status, attached policies, group membership.

An empty list carries a note: the root credential (MINIO_ROOT_USER) is not an IAM user and never appears, so a root-only deployment legitimately reports no users — not a failed probe.

Args: limit: Maximum users to return (envelope reports truncation). target: MinIO target name from config; omit for the default.

[READ][risk=low] IAM groups with members and attached policies.

Groups whose read fails are listed in groupErrors rather than dropped.

Args: limit: Maximum groups to return (envelope reports truncation). target: MinIO target name from config; omit for the default.

[READ][risk=low] Canned policy names defined on the deployment.

Args: limit: Maximum policy names to return (envelope reports truncation). target: MinIO target name from config; omit for the default.

[READ][risk=low] Ranked IAM findings: admin sprawl and unusable accounts.

Resolves group-inherited policies first, so a correctly group-managed user is not reported as having no permissions. Findings: NO_EFFECTIVE_POLICY (MinIO denies by default, so the account can do nothing — a broken account that looks identical to a working one in any name-and-status listing), FULL_ADMIN_POLICY, BROAD_DATA_POLICY, DISABLED_BUT_PRIVILEGED. Sorted worst-first with rank.

Args: limit: Maximum findings to return (envelope reports truncation). target: MinIO target name from config; omit for the default.

[WRITE][risk=medium] Create or reset an IAM user. Reversible → remove.

The secret is redacted in the audit row and is NOT returned: the harness stores a result verbatim, so echoing it would persist a live credential in plaintext. A new user has no policy and can do nothing until one is attached.

MinIO treats this as an upsert — an existing access key has its secret REPLACED, and no undo can restore the old one, so the undo is recorded only for a genuinely new account.

Args: access_key: The new user's access key (3-128 chars, letters/digits/._=+-). secret_key: The new user's secret (8+ chars). Redacted in the audit log. dry_run: If True, preview without creating. target: MinIO target name from config; omit for the default.

[WRITE][risk=medium] Enable or disable an IAM user. Reversible → prior status.

Refused when it targets the access key this tool authenticates with: the change would take effect and then reject every following call, the undo included. Enforced under dry_run too.

Args: access_key: The user's access key (from iam_users). enabled: True enables the account, False disables it. dry_run: If True, preview without changing the status. target: MinIO target name from config; omit for the default.

[WRITE][risk=high] Delete an IAM user. IRREVERSIBLE — no undo is recorded.

MinIO keeps no recoverable copy of the secret, so the account cannot be restored, only recreated with a secret supplied again. priorState captures the status and policy attachments so the same rights can be rebuilt. Refused when it targets this tool's own credential.

Args: access_key: The user's access key (from iam_users). dry_run: If True, run the guards and report without deleting. target: MinIO target name from config; omit for the default.

[WRITE][risk=medium] Attach canned policies to a user. Reversible → detach.

Refused for this tool's own credential: MinIO's canned policies replace what a credential may do rather than only adding to it, so this can silently narrow the tool's own access.

Args: access_key: The user's access key (from iam_users). policies: Policy names to attach (from iam_policies). dry_run: If True, preview without attaching. target: MinIO target name from config; omit for the default.

[WRITE][risk=medium] Detach canned policies from a user. Reversible → attach.

Refused for this tool's own credential: the account keeps authenticating and loses exactly the rights the undo would need to put them back.

Args: access_key: The user's access key (from iam_users). policies: Policy names to detach (from iam_users). dry_run: If True, preview without detaching. target: MinIO target name from config; omit for the default.

[READ][risk=low] Object-lock (WORM) state of one bucket.

Distinguishes the two absences that look alike and mean different things: objectLockEnabled=false (lock was never enabled and cannot be enabled on an existing bucket) versus objectLockEnabled=true with defaultRetention=null (WORM is available, but an upload that omits its own retention header is retained for nothing).

Args: bucket_name: Bucket name (from bucket_ls). target: MinIO target name from config; omit for the default.

[READ][risk=low] Retention + legal hold for one object version.

Reports whether the version is deletable right now and what blocks it. Retention and legal hold stack independently: lifting the hold does not help while retention runs, and a lapsed retention does not help while the hold is on.

Args: bucket_name: Bucket name (from bucket_ls). object_name: Object key (from bucket_objects). version_id: Specific version; omit for the current version. target: MinIO target name from config; omit for the default.

[READ][risk=low] WORM/retention gaps across every bucket, worst-first.

Finds the contradictions rather than a house style: lock enabled with no default retention (protects nothing), a lifecycle expiry that retention outlives (the rule can never delete and the capacity never returns — both day counts reported), object lock on a bucket whose versioning is not active, and the mode choice with its consequence spelled out.

Buckets whose probes fail are listed in bucketErrors rather than skipped: a clean findings list does not mean those buckets are clean.

Args: limit: Maximum findings to return (envelope reports truncation). target: MinIO target name from config; omit for the default.

[WRITE][risk=medium] Create a bucket, optionally WORM-capable. Reversible.

object_lock=True is the ONLY way to get object lock: S3 accepts the flag at bucket creation and has no call that enables it later. The server force-enables versioning as a consequence; the result reports what it observed rather than what was assumed.

Undo deletes the bucket, and only while it is still empty.

Args: bucket_name: New bucket name (3-63 chars, lowercase/digits/dots/hyphens). object_lock: Enable object lock (WORM). Cannot be changed afterwards. dry_run: If True, preview without creating. target: MinIO target name from config; omit for the default.

[WRITE][risk=high] Set the bucket's DEFAULT retention. Reversible → prior rule.

Applies to objects written from now on; objects already stored are untouched. Undo restores the prior rule — but objects written while this rule was in force keep the retention they were given, and COMPLIANCE retention on them cannot be shortened by anyone afterwards.

Refused (under dry_run too) when the bucket has no object lock, since the rule would have nothing to attach to.

Args: bucket_name: Bucket name (must already have object lock enabled). mode: "GOVERNANCE" (an admin with bypass permission can lift it) or "COMPLIANCE" (nobody can lift it before the date). days: Retention duration in days. Pass exactly one of days/years. years: Retention duration in years. Pass exactly one of days/years. dry_run: If True, preview without applying. target: MinIO target name from config; omit for the default.

[WRITE][risk=medium] Remove the DEFAULT retention rule. Reversible → prior rule.

Clears the rule only. Object lock stays enabled on the bucket (S3 has no call that disables it) and objects already carrying retention keep it, so this makes future uploads unprotected and changes nothing already stored.

Args: bucket_name: Bucket name (must have object lock enabled). dry_run: If True, preview without clearing. target: MinIO target name from config; omit for the default.

[WRITE][risk=critical] Put retention on one object version. NO UNDO EXISTS.

This is extend-only and irreversible through this tool, not by policy but by construction: S3 refuses to shorten or remove retention without the x-amz-bypass-governance-retention header, and the minio SDK never sends it. COMPLIANCE mode cannot be shortened by any credential at all — not root — until the date passes, and the storage cannot be reclaimed before then.

No undo token is recorded. Calls that would shorten or downgrade retention already in force are refused, and COMPLIANCE requires acknowledge_irreversible=True. Both refusals fire under dry_run.

Args: bucket_name: Bucket name (must have object lock enabled). object_name: Object key (from bucket_objects). mode: "GOVERNANCE" (liftable out of band with mc retention clear by a holder of s3:BypassGovernanceRetention — note that command has no --bypass flag) or "COMPLIANCE" (liftable by nobody before the date, root included). days: Retain for this many days from now. version_id: Specific version; omit for the current version. acknowledge_irreversible: Required True for COMPLIANCE mode. dry_run: If True, run every guard and report the before-state without writing. target: MinIO target name from config; omit for the default.

[WRITE][risk=medium] Turn a legal hold on/off. Reversible → prior hold state.

A legal hold blocks deletion with no date attached and is lifted by turning it off — the one WORM control that is reversible by design. It stacks with retention: lifting the hold does not make an object deletable while its retention still runs.

Args: bucket_name: Bucket name (must have object lock enabled). object_name: Object key (from bucket_objects). hold_on: True places the hold, False lifts it. version_id: Specific version; omit for the current version. dry_run: If True, preview (reading the current hold) without changing it. target: MinIO target name from config; omit for the default.

[READ] List recorded, not-yet-applied undo tokens (most recent first).

Each entry names the original tool, the inverse tool that undo_apply would run, and a human note. Use the undoId with undo_apply.

Returns {"undos": [...], "returned": N, "limit": L, "truncated": bool}. truncated is measured (one extra row is fetched), not guessed from a length coincidence: when it is true there are MORE tokens than shown, so re-run with a higher limit rather than reporting the list as complete.

Each entry carries effectVerified. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that may never have been reached.

Args: limit: Max rows to return (default 50, capped at 500). target: Unused (undo state is host-local); accepted for CLI uniformity.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.

The inverse runs through its own governed tool, so it is audited under its own real risk tier there. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once.

Args: undo_id: The undoId from undo_list (or an _undo_id in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.