---
title: MinIO
description: Archive SAP documents to a self-hosted MinIO instance. S3-compatible API for on-premise and air-gapped deployments.
type: minio
use_cases:
  - On-premise SAP document archival
  - Air-gapped and network-isolated environments
  - Self-hosted S3-compatible storage
config_fields:
  - name: bucket
    type: string
    required: true
    desc: "MinIO bucket name"
  - name: endpoint
    type: string
    required: true
    desc: "MinIO server endpoint (e.g. https://minio.yourcompany.com:9000)"
  - name: prefix
    type: string
    required: false
    desc: "Path prefix for stored objects"
credential_fields:
  - name: access_key_id
    type: string
    required: true
    desc: "MinIO access key"
  - name: secret_access_key
    type: string
    required: true
    desc: "MinIO secret key"
---

Archive SAP documents to a self-hosted MinIO instance. MinIO provides S3-compatible object storage that runs entirely on your own infrastructure, making it the ideal choice for on-premise SAP environments, air-gapped networks, or organizations with strict data residency requirements.

## Setup

1. Deploy MinIO on your infrastructure following the [MinIO documentation](https://min.io/docs/minio/linux/index.html)
2. Create a bucket for SAP documents using the MinIO Console or the `mc` CLI:
   ```bash
   mc alias set myminio https://minio.yourcompany.com:9000 ROOTUSER ROOTPASSWORD
   mc mb myminio/sap-documents
   ```
3. Create a dedicated access key pair in the MinIO Console under **Access Keys**, or use the `mc` CLI:
   ```bash
   mc admin user add myminio filerelay-user StrongPassword123
   ```
4. Assign a policy with write permissions to the bucket (see Policy Example below)
5. Ensure the FileRelay on-premise connector can reach the MinIO endpoint over the network
6. In FileRelay, add a **MinIO** destination with the endpoint URL, bucket name, access key, and secret key

> **REPLACE:** Screenshot of the MinIO connector configuration form in FileRelay

## How It Works

FileRelay connects to MinIO using the S3-compatible API at the specified endpoint. Documents are uploaded as objects with the configured prefix and automatic subfolders. MinIO stores the data on your local disks, distributed storage pool, or erasure-coded drives depending on your deployment topology.

Path-style addressing is used by default, which is compatible with all MinIO deployments.

## Path Structure

Documents are stored with the following key pattern:

```
{prefix}/{subfolder}/{doc_id}.{ext}
```

- **prefix** — configured base path (e.g. `sap-documents/`)
- **subfolder** — automatic subfolder based on routing rules
- **doc_id** — the SAP document ID
- **ext** — file extension based on MIME type

Example: `sap-documents/2026-04/4500012345.pdf`

## MinIO Policy Example

Create a policy file (`filerelay-policy.json`) with the minimum required permissions:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::sap-documents",
        "arn:aws:s3:::sap-documents/*"
      ]
    }
  ]
}
```

Apply the policy using the MinIO CLI:

```bash
mc admin policy create myminio filerelay-policy filerelay-policy.json
mc admin policy attach myminio filerelay-policy --user filerelay-user
```

## TLS Configuration

For production deployments, always use HTTPS for the MinIO endpoint:

1. Obtain or generate TLS certificates for your MinIO server
2. Place the certificate and key in MinIO's certs directory (`~/.minio/certs/` by default)
3. MinIO will automatically serve HTTPS when certificates are present
4. If using a self-signed or internal CA certificate, add the CA to the trust store on the machine running the FileRelay on-premise connector

The endpoint in FileRelay should use the `https://` protocol prefix (e.g. `https://minio.yourcompany.com:9000`).

## Deployment Topologies

| Topology | Drives | Best For |
|----------|--------|----------|
| Single-node single-drive | 1 | Development and testing |
| Single-node multi-drive | 4+ | Small production workloads |
| Multi-node multi-drive | 4+ nodes, 4+ drives each | Enterprise production with high availability |

For production SAP document archiving, MinIO recommends at least 4 drives for erasure coding, which provides data redundancy without replication overhead.

## Tips

- **On-premise connector required** — This connector requires the [on-premise FileRelay connector](/docs/on-premise) deployed within your network. The connector must have direct network access to the MinIO endpoint.
- **Endpoint format** — Include the protocol and port (e.g. `https://minio.internal:9000`). Do not include a trailing slash or bucket name in the endpoint URL.
- **Bucket notifications** — MinIO supports bucket event notifications (via webhooks, Kafka, AMQP, etc.). Use these to trigger downstream processing when FileRelay uploads a new SAP document.
- **Bucket versioning** — Enable versioning on the MinIO bucket to retain document history: `mc version enable myminio/sap-documents`
- **Performance** — MinIO delivers high throughput on modern hardware. For large SAP document volumes, ensure your MinIO deployment has adequate disk I/O (NVMe recommended) and network bandwidth.
- **Air-gapped environments** — MinIO works fully offline with no external dependencies. Combined with the on-premise FileRelay connector, you can archive SAP documents in completely disconnected environments.
- **Monitoring** — MinIO provides a built-in metrics endpoint compatible with Prometheus. Monitor disk usage, request rates, and error counts to ensure reliable operation.