A Firewall Designed for Data:
The MinIO Enterprise Object Store Firewall

Yes, cert-manager via Let's Encrypt can be used for this. TLS is not required but recommended in production.

Yes, rules can be applied to individual buckets like so - bucket: “my_bucket_name”. This will ensure the rules associated with this only apply to my_bucket_name.

Rate is the usage during regular operations and Burst is when there is a sudden spike of traffic for a few seconds, you can set a separate limit for this.

There is a global anonymous setting, above all other rules, called anonymous: “allow” that sets anonymous access to everything.

Below each individual specific rule there is a setting called anonymous: “deny”. This takes precedence over the global one we mentioned earlier.

You can rate limit a specific prefix with my_bucket/my_prefix.

You can rate limit specific API calls by mentioning the type like so api: “s3.ListObjectsV2”.

In the config YAML there is a section called tls: under which these settings can be set.

In the config YAML there is a section called autoTLS: under which these settings can be set.

You don't need to port forward to access the Enterprise Console via the Enterprise Firewall. Just visit the port set in config which defaults to console: ":8002". If you don't have this exposed externally you can port forward to the service the firewall is running as on port 8002 or whichever is the console port that you have set.