Aarkam / Aarkam Wiki / AM CLI / S3 Storage, Buckets & Cryptographic Tenancy Reference ARK-CLI-0304
Unified S3 Data Plane (SAT & SCT) S3 & Tenancy AM CLI • ARK-CLI-0304

S3 Storage, Buckets & Cryptographic Tenancy Reference

Authoritative command reference for am s3 (Native S3 Client, Buckets, Streaming Copy), am object (HRW Chunk Locating, Parity Verification), am tenant, and am quota.

Last updated: Nov 03, 2026 Classification: Sovereign Tier-4 Enterprise
Document Identifier ARK-CLI-0304
Standard Status
Production Standard
Architecture Tier Unified S3 Data Plane (SAT & SCT)
Release Version V-1.0.0-GA (Production Stable)
Architecture Tier Scope: Unified S3 Data Plane The am s3 suite operates directly against the Rokka S3 Gateway (Port 7772 HTTP / 57772 HTTPS) using AWS Signature Version 4 (SigV4). In Aarkam - SAT, am acts as an all-in-one replacement for AWS CLI and MinIO mc, eliminating third-party tools in dark-site datacenters.

This reference documents native S3 bucket management, streaming file ingestion with ANSI throughput progress, cryptographic object chunk tracing, multi-tenant namespace partitioning, and bandwidth quota enforcement.

1. am s3 — Native AWS SigV4 S3 Client

1.1 Profile Configuration (am s3 config set & get)

Configures local S3 endpoint profiles, API credentials, and sovereign region bindings in ~/.aarkam/s3.json:

bash 
# Set default S3 credentials and endpoint
am s3 config set \
  --endpoint https://storage.internal:57772 \
  --access-key "ARK_ADMIN_ACCESS_KEY" \
  --secret-key "ARK_ADMIN_SECRET_KEY" \
  --region sa-central-1

# Inspect active S3 configuration profile
am s3 config get

1.2 S3 Bucket Operations (mb, rb, buckets)

bash 
# Create S3 bucket
am s3 mb s3://enterprise-vault

# List all S3 buckets for the authenticated tenant
am s3 buckets

# Delete empty bucket (use --force to purge objects)
am s3 rb s3://enterprise-vault --force

1.3 High-Speed Streaming Copy (am s3 cp)

Automatically detects upload (local -> s3://) vs. download (s3:// -> local) with real-time transfer progress:

bash 
# Upload file to S3
am s3 cp /data/production-db.tar.gz s3://enterprise-vault/production-db.tar.gz

# Download file from S3
am s3 cp s3://enterprise-vault/production-db.tar.gz /restore/production-db.tar.gz

# List objects with prefix
am s3 objects enterprise-vault --prefix "2026/Q3/"

# Generate time-limited presigned URL (valid for 2 hours)
am s3 presign s3://enterprise-vault/audit.pdf --expires 2h

2. am object — Chunk Inspection & Parity Verification

Provides low-level inspection of distributed Cauchy chunk shards across physical hosts:

bash 
# Locate physical storage hosts and racks hosting an object's chunks
am object locate 5be9c0c1-12f3-4c3e-972f-d27cbffc4164

# Probe all K+M chunks across nodes and verify CRC32C / Cauchy parity integrity
am object verify 5be9c0c1-12f3-4c3e-972f-d27cbffc4164

# Inspect object size, stripe geometry, and storage footprint
am object inspect 5be9c0c1-12f3-4c3e-972f-d27cbffc4164

3. am tenant & am quota — Tenancy & Rate Limits

Enforces cryptographic namespace isolation, API key lifecycle, and capacity limits:

bash 
# Create new enterprise tenant namespace
am tenant create "saudi-telecom-corp" --contact "dpo@stc.com.sa" --max-buckets 100

# Issue S3 Access Key and Secret Key for tenant
am tenant key-create "saudi-telecom-corp" --description "Backup Pipeline Agent"

# Enforce capacity and network bandwidth quota limits
am quota set --tenant "saudi-telecom-corp" --max-capacity 500TB --max-bandwidth-mbps 10000
← Previous Article
Storage Fleet, Nodes & Volumes Reference
 Next Article →
Erasure Coding, Storage Engines & Self-Healing Reference