Administration

Managing a running Record Store deployment: credentials, access control, retention, and the trails that tell you what happened.

• Configuration — how settings are loaded and layered
• Service Accounts — application credentials
• Policies — what an account may do
• Temporary Credentials — expiring credentials
• Quotas — bounding a bucket's size
• Lifecycle Rules — expiring objects on a schedule
• Audit Log — administrative history
• Events and Webhooks — storage events, delivered
• Metrics — Prometheus scraping

Three trails, three purposes

They are separate on purpose. Merging them loses the distinction that makes each useful.

	Contains	Read it when
Audit	Security and administrative actions	Asking who changed what
Events	Storage changes to buckets and objects	Reacting to data changes
Logs	Operational diagnostics	Debugging the process

Management roles

Management authentication is separate from S3 access. A management token is not an S3 credential and cannot read objects.

Role	Token	Can do
System administrator	RECORD_STORE_MANAGEMENT_SYSTEM_TOKEN	Everything
Storage administrator	RECORD_STORE_MANAGEMENT_STORAGE_TOKEN	Buckets, objects, storage, integrity, lifecycle
Auditor	RECORD_STORE_MANAGEMENT_AUDITOR_TOKEN	Read-only, including the audit trail

See Authorization.