Obtaining S3 credentials in Ozone

Learn how to authenticate an Ozone cluster using Kerberos, generating S3-compatible access keys, and configuring the AWS CLI to interact directly with Ozone storage.

Access to an Ozone environment with Kerberos authentication enabled.
AWS CLI installed on your workstation.
A valid Kerberos keytab file or principal password.

Open a terminal on your device.

Perform the following command to get the permanent credentials:

kinit -kt [***PATH_TO_KEYTAB_FILE***] [***HOSTNAME***] && ozone s3 getsecret

Example,

kinit -kt /cdep/keytabs/svc-iceberg-rest-catalog.keytab svc-iceberg-rest-catalog/icebergclient@example.com && ozone s3 getsecret

Note down the awsAccessKey and awsSecret values displayed in the terminal output.
Configure the AWS client:
```
aws configure
```
When prompted, provide the following information:
- AWS Access Key ID: Enter the awsAccessKey obtained earlier.
- AWS Secret Access Key: Enter the awsSecret obtained earlier.
- Default region name: Enter the region that’s appropriate for your installation. For example, us-east-1.
- Default output format: Leave it blank.
Press Enter.