FAQ¶
General¶
Is Record Store a drop-in replacement for S3?
For the supported operations, yes — point your SDK
at the endpoint and use path-style addressing. Access control lists, Object Lock,
UploadPartCopy, and server-side-encryption request headers are not supported.
What happens if the machine dies?
The service is down until you restore it. A deployment is one process with one copy of your data, so put the data directory on redundant storage and take backups — see Durability.
Which port do applications use?
7600, the S3 API. 7601 is administration and must not be public.
What is the difference between the S3 API and the management API?
The S3 API moves data and is authenticated with SigV4 credentials. The management API administers the deployment and is authenticated with bearer tokens. A management token cannot read an object; an S3 credential cannot change configuration.
Credentials¶
I lost a secret key. Can I recover it?
No. Record Store stores a sealed form it cannot reverse. Rotate:
Can I rotate the credential master key?
No. It seals credentials, webhook secrets, capability secrets, and — with encryption on — per-object data keys. Replacing it makes all of that permanently unreadable. Generate it once and back it up separately from the data directory.
Why does creating a service account fail?
auth.credential_master_key is not set. Credentials are stored sealed under it, and
Record Store will not fall back to storing them any other way.
Does rotating disable the old credential?
No. Rotation issues a new credential alongside the old one, which is what makes a zero-downtime rotation possible. Disable the old one explicitly once traffic has moved.
Access control¶
Why does my policy not work?
Almost always the resource pattern. bucket:uploads covers the bucket;
bucket:uploads/* covers its objects. Listing a bucket and reading its objects needs
both.
Can I use IAM-style wildcards?
Only a single trailing *. bucket:uploads/* is fine; bucket:*/logs/* is rejected.
Can I grant an action on all buckets?
bucket:* matches everything. Use it sparingly.
Are there session tokens?
No. Temporary credentials are plain access-key/secret-key pairs with an expiry. Do not
set AWS_SESSION_TOKEN.
Storage¶
Is encryption at rest on by default?
No. Set RECORD_STORE_STORAGE_ENCRYPTION_ENABLED=true, which also requires the master
key. Service-account credentials, webhook secrets, and capability secrets are always
sealed regardless of that setting.
Are object keys encrypted?
No. If your key names are themselves sensitive, encode them rather than putting the sensitive value in the key.
Enabling encryption did nothing to existing objects — why?
It applies to newly committed payloads. Existing objects stay in plaintext and both are readable side by side. Rewrite objects to encrypt them.
Why is disk usage higher than the sum of my objects?
Version history and in-progress multipart uploads. Compare logical and physical bytes
with record-store storage inspect.
Can I turn versioning off once it is on?
You can suspend it, which stops new versions while keeping existing history.
enabled cannot return to disabled — that would silently discard history.
Sharing¶
What is the difference between share links, embed links, and presigned URLs?
| For | Served on | Revocable | |
|---|---|---|---|
| Share link | A person | Console /s/<token> |
Yes |
| Embed link | A website | Storage /e/<token> |
Yes |
| Presigned URL | An automated client | Storage | No — only expiry |
A presigned URL cannot be revoked once issued. Share and embed links can, and the revocation takes effect on the next request.
Why do my links point at 127.0.0.1?
Set RECORD_STORE_SHARING_SHARE_BASE_URL and RECORD_STORE_SHARING_EMBED_BASE_URL.
Record Store cannot infer its public hostname from behind a proxy.
Can I turn sharing off?
Operations¶
How do I back up?
record-store server backup-metadata for metadata, your usual file backup for
objects/. Both from the same point in time, plus the master key kept separately. See
Backup and Restore.
Can I back up while the server runs?
Not with backup-metadata — it takes the exclusive data lock. Either stop the server
briefly, or take a filesystem snapshot and run the backup against that.
Is the audit log pruned?
No. It grows with request volume and has no automatic retention. Budget for it.
How do I see who deleted something?
Can I change configuration without a restart?
No. Configuration is read at startup. Validate first with
record-store server check-config.
Does erasure coding exist?
No. GET /api/v1/system/info reports capabilities.erasure_coding as false, and no
code path produces or reads erasure stripes.
Development¶
Where do I start?
How do I run the compatibility tests?
They exercise real AWS SDKs against a running server. See Testing.