Rotate PD MinIO S3 service credentials when replacing a secret or responding to its exposure. Prepare the dependent application updates first: the previous secret will stop working.

Prepare the affected applications

Identify the intended service and its buckets. List the backup clients, sync jobs and applications using its credential without copying secrets into general notes. Record the current access mode so that a quota or suspension refusal is not mistaken for a rotation failure.

The connection dialog can reveal the saved secret again. Do not rotate merely to redisplay it. Replacing the host’s MinIO administrative key is a separate task.

Rotate once and update tools

1. Open the service’s Connection details and choose credential rotation.
2. Review the confirmation and complete it once.
3. Save the returned connection details privately.
4. Update every dependent application with the returned secret.
5. Verify the required operations and inspect Activity.

MinIO keeps the service’s access-key identity while issuing a fresh secret. An unchanged access key does not mean the old secret remains valid. Rotation keeps the buckets and objects; it does not change the plan or remove suspension.

Check uncertain outcomes

Old presigned URLs can stop working before their displayed expiry when their signing secret is replaced. Issue replacement links only where needed and distribute them privately.

A refused or interrupted operation can leave access needing attention. Inspect the current service and original result before repeating rotation; do not assume a partial failure rolled itself back. Retain the original action time and redacted error while your hosting team and storage administrator check the actual credential/access state, excluding both secrets and signed links.

Check the updated credentials

Your hosting team should compare the intended service and original rotation result with its currently saved connection details and dependent application configuration. MinIO keeps the service’s access-key identity while replacing its secret; an unchanged access key is not evidence that the old secret still works. Review access mode and policy attachment with your storage administrator after a partial failure, without guessing that the operation rolled itself back. Check an uncertain result before repeating rotation, and account for old signed links that used the replaced secret. Never include either secret or a signed URL in diagnostics.

See the PD MinIO S3 WHMCS guide for related tasks, or explore the module.