rustfs · majinghe · Sep 9, 2026 · Sep 8, 2026
diff --git a/content/de/administration/data/object/object-lock.md b/content/de/administration/data/object/object-lock.md
@@ -7,7 +7,7 @@ RustFS Object Lock applies write-once, read-many protection to individual object
 
 ## Overview
 
-Object Lock requires bucket versioning and must be enabled when the bucket is created. Each overwrite creates a new version; retention and Legal Hold protect a specific version rather than the object key as a whole.
+Object Lock requires bucket versioning. You can enable it when creating a bucket or use the S3 `PutObjectLockConfiguration` API on an existing bucket whose versioning is enabled. Each overwrite creates a new version; retention and Legal Hold protect a specific version rather than the object key as a whole.
 
 | Protection | Behavior |
 | --- | --- |

diff --git a/content/de/installation/linux/quick-start.md b/content/de/installation/linux/quick-start.md
@@ -39,7 +39,7 @@ RUSTFS_ACCESS_KEY=<your-access-key>
 RUSTFS_SECRET_KEY=<your-secret-key>   ; e.g. output of: openssl rand -base64 24
 ```
 
-Use an uppercase alphanumeric access key. Do not use unmodified Base64 output for `RUSTFS_ACCESS_KEY`, because Base64 can contain `/`, which conflicts with the AWS Signature Version 4 credential scope. See [Credential Management](/en/operations/credentials) for details.
+Use an uppercase alphanumeric access key. Do not use unmodified Base64 output for `RUSTFS_ACCESS_KEY`, because Base64 can contain `/`, which conflicts with the AWS Signature Version 4 credential scope. See [Credential Management](/operations/credentials) for details.
 
 ```bash
 sudo systemctl restart rustfs

diff --git a/content/de/reference/cli.md b/content/de/reference/cli.md
@@ -1,9 +1,9 @@
 ---
 title: "CLI Reference"
-description: "Reference for the rustfs command-line interface, including the server, info, and tls subcommands, key flags with environment variable equivalents, and volume path syntax."
+description: "Reference for the rustfs subcommands, server flags, environment variable equivalents, and volume path syntax."
 ---
 
-The `rustfs` binary ships three subcommands. Running `rustfs` with no subcommand starts the server.
+The `rustfs` binary ships six subcommands. Running `rustfs` with no subcommand starts the server.
 
 ## Subcommands
 
@@ -12,6 +12,9 @@ The `rustfs` binary ships three subcommands. Running `rustfs` with no subcommand
 | `rustfs server [OPTIONS] <VOLUMES>...` | Start the object storage server (default when no subcommand is given). |
 | `rustfs info [--all] [--json] [system\|runtime\|build\|config\|deps]` | Display system, runtime, build, configuration, or dependency information. |
 | `rustfs tls inspect --path <DIR>` | Inspect a TLS certificate directory layout and parsing status. |
+| `rustfs diagnose [OPTIONS] <PATHS>...` | Analyze log files and report probable failure causes. |
+| `rustfs inspect <COMMAND>` | Inspect persisted bucket metadata without a running server. |
+| `rustfs connect <COMMAND>` | Configure outbound RustFS Connect integration. |
 
 ```bash title="Examples"
 rustfs server /data/rustfs
@@ -56,7 +59,7 @@ Every server flag has an environment variable equivalent; the flag wins when bot
 | `--kms-local-master-key` | `RUSTFS_KMS_LOCAL_MASTER_KEY` | unset | Master key for local KMS key-file encryption. |
 | `--kms-vault-address` | `RUSTFS_KMS_VAULT_ADDRESS` | unset | Vault address for the Vault backends. |
 | `--kms-vault-token` | `RUSTFS_KMS_VAULT_TOKEN` | unset | Vault token for the Vault backends. |
-| `--kms-vault-mount-path` | `RUSTFS_KMS_VAULT_MOUNT_PATH` | unset | Vault mount path. |
+| `--kms-vault-mount-path` | `RUSTFS_KMS_VAULT_MOUNT_PATH` | unset | Transit mount for `vault-transit` (defaults to `transit`); deprecated and unused for `vault` / `vault-kv2`. |
 | `--kms-default-key-id` | `RUSTFS_KMS_DEFAULT_KEY_ID` | unset | Default KMS key ID for encryption. |
 | `--kms-allow-insecure-dev-defaults` | `RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS` | `false` | Allow development-only insecure KMS defaults. |
 | `--buffer-profile` | `RUSTFS_BUFFER_PROFILE` | `GeneralPurpose` | Workload profile for adaptive buffer sizing. |

diff --git a/content/de/reference/environment-variables.md b/content/de/reference/environment-variables.md
@@ -56,12 +56,14 @@ See [CORS Configuration](/administration/cors) for configuration and verificatio
 | `RUSTFS_MTLS_CLIENT_CERT` | unset | Client certificate presented for internode mTLS connections. |
 | `RUSTFS_MTLS_CLIENT_KEY` | unset | Client private key for internode mTLS connections. |
 | `RUSTFS_KMS_ENABLE` | `false` | Enable KMS-backed server-side encryption. |
-| `RUSTFS_KMS_BACKEND` | `local` | KMS backend: `local`, `vault` / `vault-kv2` (Vault KV2 + Transit), or `vault-transit`. |
+| `RUSTFS_KMS_BACKEND` | `local` | KMS backend: `local`, `vault` / `vault-kv2` (Vault KV2 storage with local data-key wrapping), or `vault-transit`. |
 | `RUSTFS_KMS_KEY_DIR` | unset | Key directory for the `local` backend. |
 | `RUSTFS_KMS_LOCAL_MASTER_KEY` | unset | Master key protecting local KMS key files. |
 | `RUSTFS_KMS_VAULT_ADDRESS` | unset | Vault server address for the Vault backends. |
 | `RUSTFS_KMS_VAULT_TOKEN` | unset | Vault token for the Vault backends. |
-| `RUSTFS_KMS_VAULT_MOUNT_PATH` | unset | Vault mount path for the Vault backends. |
+| `RUSTFS_KMS_VAULT_MOUNT_PATH` | `transit` | Transit mount for `vault-transit`; deprecated and unused for `vault` / `vault-kv2`. |
+| `RUSTFS_KMS_VAULT_KV_MOUNT` | `secret` | KV v2 mount for the `vault` / `vault-kv2` backend. |
+| `RUSTFS_KMS_VAULT_KEY_PREFIX` | `rustfs/kms/keys` | Key record prefix within the KV v2 mount for `vault` / `vault-kv2`. |
 | `RUSTFS_KMS_DEFAULT_KEY_ID` | unset | Default KMS key ID used for encryption. |
 | `RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS` | `false` | Allow development-only insecure KMS defaults. Never enable in production. |
 
@@ -103,14 +105,14 @@ Metrics collection intervals follow the pattern `RUSTFS_METRICS_<SCOPE>_INTERVAL
 | `RUSTFS_SCANNER_MAX_WAIT_SECS` | preset | Overrides the maximum scanner sleep in seconds. |
 | `RUSTFS_SCANNER_CYCLE` | preset | Overrides the scan cycle interval in seconds (e.g. `3600`). |
 | `RUSTFS_SCANNER_START_DELAY_SECS` | unset | Startup delay in seconds before the first scan cycle. |
-| `RUSTFS_SCANNER_CYCLE_MAX_DURATION_SECS` | `0` | Caps one cycle's runtime in seconds; `0` disables the budget. |
+| `RUSTFS_SCANNER_CYCLE_MAX_DURATION_SECS` | `1800` | Caps one cycle's runtime in seconds; `0` disables the budget. |
 | `RUSTFS_SCANNER_CYCLE_MAX_OBJECTS` | `0` | Caps objects processed per cycle; `0` disables the budget. |
 | `RUSTFS_SCANNER_CYCLE_MAX_DIRECTORIES` | `0` | Caps directories entered per cycle; `0` disables the budget. |
 | `RUSTFS_SCANNER_BITROT_CYCLE_SECS` | `2592000` | Periodic deep (bitrot) scan cycle in seconds (30 days). `0`/`true`/`on` makes every cycle deep; `false`/`off` disables deep scans. |
 | `RUSTFS_SCANNER_IDLE_MODE` | `true` | When `true` the scanner throttles itself; `false` runs at full speed. |
-| `RUSTFS_SCANNER_CACHE_SAVE_TIMEOUT_SECS` | `30` | Scanner cache save timeout in seconds (minimum `1`). |
-| `RUSTFS_SCANNER_MAX_CONCURRENT_SET_SCANS` | `0` | Caps concurrent erasure-set scan tasks; `0` keeps topology-based concurrency. |
-| `RUSTFS_SCANNER_MAX_CONCURRENT_DISK_SCANS` | `0` | Caps concurrent disk bucket walks per set; `0` keeps disk-count-based concurrency. |
+| `RUSTFS_SCANNER_CACHE_SAVE_TIMEOUT_SECS` | `14` | Scanner cache save timeout in seconds (minimum `1`). |
+| `RUSTFS_SCANNER_MAX_CONCURRENT_SET_SCANS` | `4` | Caps concurrent erasure-set scan tasks; `0` keeps topology-based concurrency. |
+| `RUSTFS_SCANNER_MAX_CONCURRENT_DISK_SCANS` | `4` | Caps concurrent disk bucket walks per set; `0` keeps disk-count-based concurrency. |
 | `RUSTFS_SCANNER_YIELD_EVERY_N_OBJECTS` | `128` | How often scanner object loops yield to the async runtime; `0` disables the extra yield. |
 | `RUSTFS_SCANNER_ALERT_EXCESS_VERSIONS` | `100` | Object version count that triggers scanner alerts. |
 | `RUSTFS_SCANNER_ALERT_EXCESS_VERSION_SIZE` | `1099511627776` | Cumulative version bytes (1 TiB) that trigger scanner alerts. |

diff --git a/content/de/security-compliance/encryption/kms.md b/content/de/security-compliance/encryption/kms.md
@@ -3,7 +3,7 @@ title: "SSE-KMS"
 description: "Configure SSE-KMS with a local or HashiCorp Vault KMS backend for RustFS."
 ---
 
-RustFS Key Management Service (KMS) generates and wraps per-object data encryption keys for [SSE-S3](./sse-s.md) and SSE-KMS. This guide configures SSE-KMS at server startup with a local key store, Vault KV v2 plus Transit, or Vault Transit.
+RustFS Key Management Service (KMS) generates and wraps per-object data encryption keys for [SSE-S3](./sse-s.md) and SSE-KMS. This guide configures SSE-KMS at server startup with a local key store, Vault KV v2, or Vault Transit.
 
 ## Requirements
 
@@ -25,7 +25,7 @@ RustFS does not store a recoverable copy of your KMS master key outside the conf
 | Backend | `RUSTFS_KMS_BACKEND` | Key storage and wrapping | Intended use |
 | --- | --- | --- | --- |
 | Local | `local` | Key files on the RustFS host | Development, testing, or a carefully backed-up single-host deployment |
-| Vault KV2 | `vault` or `vault-kv2` | Metadata in Vault KV v2; wrapping through Vault Transit | Centralized production key management |
+| Vault KV2 | `vault` or `vault-kv2` | Master key material in Vault KV v2; data-key wrapping in RustFS | Centralized key storage |
 | Vault Transit | `vault-transit` | Cryptographic operations through Vault Transit | Centralized production key management without the KV2 backend mode |
 
 SSE-S3 and SSE-KMS both require the KMS service to be running. Configuring a bucket default alone does not make encrypted writes succeed when KMS is unavailable.
@@ -58,17 +58,20 @@ sudo systemctl status rustfs --no-pager
 
 ## Configure Vault KV2
 
-Enable a KV v2 engine for key metadata and a Transit engine for key wrapping. Then configure every RustFS node:
+Enable a KV v2 engine for master key material and metadata. RustFS reads the master key material and wraps data keys locally; this backend does not call Vault Transit. Configure every RustFS node:
 
 ```ini title="/etc/default/rustfs"
 RUSTFS_KMS_ENABLE=true
 RUSTFS_KMS_BACKEND=vault-kv2
 RUSTFS_KMS_VAULT_ADDRESS=https://vault.example.com:8200
 RUSTFS_KMS_VAULT_TOKEN=<your-vault-token>
-RUSTFS_KMS_VAULT_MOUNT_PATH=transit
+RUSTFS_KMS_VAULT_KV_MOUNT=secret
+RUSTFS_KMS_VAULT_KEY_PREFIX=rustfs/kms/keys
 ```
 
-The server startup interface uses `secret` as the KV mount and `rustfs/kms/keys` as the key prefix. Use a Vault token that can read and write that KV path and perform the required Transit operations.
+The KV mount defaults to `secret` and the key prefix to `rustfs/kms/keys`; the variables above let you select different paths. Use a Vault token authorized for the configured KV data and metadata paths. `RUSTFS_KMS_VAULT_MOUNT_PATH` is deprecated and unused for the KV2 backend.
+
+Master key material is Base64-encoded in KV2. Any identity with KV read access to the key path can recover the plaintext master key, so restrict that access to trusted RustFS identities.
 
 RustFS validates the Vault URL and rejects insecure development defaults unless `RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS=true` is set. Use HTTPS and a certificate trusted by the RustFS hosts in production.
 

diff --git a/content/de/security-compliance/iam/index.md b/content/de/security-compliance/iam/index.md
@@ -11,7 +11,7 @@ RustFS distinguishes the following identity types:
 
 | Identity | Created by | Typical use |
 | --- | --- | --- |
-| Root credentials | `RUSTFS_ACCESS_KEY` / `RUSTFS_SECRET_KEY` environment variables at server start | Initial setup and break-glass administration. The root account bypasses policy checks (owner semantics). |
+| Root credentials | `RUSTFS_ACCESS_KEY` / `RUSTFS_SECRET_KEY` environment variables at server start | Initial setup and break-glass administration. The root account bypasses IAM identity-policy evaluation (owner semantics). |
 | IAM users | Console or admin API (`add-user`) | Long-term named accounts for people or applications. |
 | Groups | Console or admin API (`update-group-members`) | Attach one policy set to many users at once. Users inherit the policies of every group they belong to. |
 | Service accounts (access keys) | Console or admin API (`add-service-account`) | Derived credentials that belong to a parent user. They inherit the parent's permissions, optionally restricted further by an embedded session policy, and can carry an expiration time. |
@@ -20,7 +20,7 @@ RustFS distinguishes the following identity types:
 
 :::warning
 
-Root credentials cannot be restricted by policies. Use them only to bootstrap the deployment, then create IAM users and service accounts for day-to-day work.
+Root credentials bypass IAM identity policies, but bucket policies can still deny root S3 requests. Only `GetBucketPolicy`, `PutBucketPolicy`, and `DeleteBucketPolicy` bypass a bucket-policy deny so the owner can recover access. Use root credentials only to bootstrap the deployment, then create IAM users and service accounts for day-to-day work.
 
 :::
 
@@ -41,7 +41,7 @@ RustFS ships these built-in (canned) policies: `readwrite`, `readonly`, `writeon
 When an identity has multiple attached policies, RustFS merges their statements (dropping duplicates) and evaluates the merged document:
 
 1. **Explicit deny wins.** All `Deny` statements are checked first; if any matching `Deny` statement applies to the request, the request is rejected regardless of any `Allow`.
-2. **Owner shortcut.** The root (owner) account is allowed once no explicit deny matched.
+2. **Owner shortcut.** The root account bypasses IAM identity-policy evaluation; the bucket-policy checks and exceptions described above still apply.
 3. **Explicit allow required.** Otherwise, at least one `Allow` statement must match the requested action and resource.
 4. **Default deny.** If no statement matches, the request is denied.
 

diff --git a/content/de/security-compliance/iam/sts.md b/content/de/security-compliance/iam/sts.md
@@ -57,7 +57,7 @@ RustFS implements an AWS-compatible STS endpoint at the server root (`POST /` wi
 
 ### AssumeRole
 
-The request must be signed (AWS Signature V4) by a long-term IAM credential — temporary credentials and service accounts cannot call `AssumeRole`. The calling identity also needs the `sts:AssumeRole` action allowed by its policies (all built-in policies include it).
+The request must be signed (AWS Signature V4) by a long-term IAM credential — temporary credentials and service accounts cannot call `AssumeRole`. With built-in IAM authorization, RustFS evaluates `sts:AssumeRole` for regular IAM users in deny-only mode: a matching explicit `Deny` rejects the request, but a separate `Allow` is not required. The user must have at least one applicable user or group policy binding, and all bound policy names must resolve.
 
 Form parameters:
 

diff --git a/content/en/administration/data/object/object-lock.md b/content/en/administration/data/object/object-lock.md
@@ -7,7 +7,7 @@ RustFS Object Lock applies write-once, read-many protection to individual object
 
 ## Overview
 
-Object Lock requires bucket versioning and must be enabled when the bucket is created. Each overwrite creates a new version; retention and Legal Hold protect a specific version rather than the object key as a whole.
+Object Lock requires bucket versioning. You can enable it when creating a bucket or use the S3 `PutObjectLockConfiguration` API on an existing bucket whose versioning is enabled. Each overwrite creates a new version; retention and Legal Hold protect a specific version rather than the object key as a whole.
 
 | Protection | Behavior |
 | --- | --- |

diff --git a/content/en/installation/linux/quick-start.md b/content/en/installation/linux/quick-start.md
@@ -39,7 +39,7 @@ RUSTFS_ACCESS_KEY=<your-access-key>
 RUSTFS_SECRET_KEY=<your-secret-key>   ; e.g. output of: openssl rand -base64 24
 ```
 
-Use an uppercase alphanumeric access key. Do not use unmodified Base64 output for `RUSTFS_ACCESS_KEY`, because Base64 can contain `/`, which conflicts with the AWS Signature Version 4 credential scope. See [Credential Management](/en/operations/credentials) for details.
+Use an uppercase alphanumeric access key. Do not use unmodified Base64 output for `RUSTFS_ACCESS_KEY`, because Base64 can contain `/`, which conflicts with the AWS Signature Version 4 credential scope. See [Credential Management](/operations/credentials) for details.
 
 ```bash
 sudo systemctl restart rustfs

diff --git a/content/en/reference/cli.md b/content/en/reference/cli.md
@@ -1,9 +1,9 @@
 ---
 title: "CLI Reference"
-description: "Reference for the rustfs command-line interface, including the server, info, and tls subcommands, key flags with environment variable equivalents, and volume path syntax."
+description: "Reference for the rustfs subcommands, server flags, environment variable equivalents, and volume path syntax."
 ---
 
-The `rustfs` binary ships three subcommands. Running `rustfs` with no subcommand starts the server.
+The `rustfs` binary ships six subcommands. Running `rustfs` with no subcommand starts the server.
 
 ## Subcommands
 
@@ -12,6 +12,9 @@ The `rustfs` binary ships three subcommands. Running `rustfs` with no subcommand
 | `rustfs server [OPTIONS] <VOLUMES>...` | Start the object storage server (default when no subcommand is given). |
 | `rustfs info [--all] [--json] [system\|runtime\|build\|config\|deps]` | Display system, runtime, build, configuration, or dependency information. |
 | `rustfs tls inspect --path <DIR>` | Inspect a TLS certificate directory layout and parsing status. |
+| `rustfs diagnose [OPTIONS] <PATHS>...` | Analyze log files and report probable failure causes. |
+| `rustfs inspect <COMMAND>` | Inspect persisted bucket metadata without a running server. |
+| `rustfs connect <COMMAND>` | Configure outbound RustFS Connect integration. |
 
 ```bash title="Examples"
 rustfs server /data/rustfs
@@ -56,7 +59,7 @@ Every server flag has an environment variable equivalent; the flag wins when bot
 | `--kms-local-master-key` | `RUSTFS_KMS_LOCAL_MASTER_KEY` | unset | Master key for local KMS key-file encryption. |
 | `--kms-vault-address` | `RUSTFS_KMS_VAULT_ADDRESS` | unset | Vault address for the Vault backends. |
 | `--kms-vault-token` | `RUSTFS_KMS_VAULT_TOKEN` | unset | Vault token for the Vault backends. |
-| `--kms-vault-mount-path` | `RUSTFS_KMS_VAULT_MOUNT_PATH` | unset | Vault mount path. |
+| `--kms-vault-mount-path` | `RUSTFS_KMS_VAULT_MOUNT_PATH` | unset | Transit mount for `vault-transit` (defaults to `transit`); deprecated and unused for `vault` / `vault-kv2`. |
 | `--kms-default-key-id` | `RUSTFS_KMS_DEFAULT_KEY_ID` | unset | Default KMS key ID for encryption. |
 | `--kms-allow-insecure-dev-defaults` | `RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS` | `false` | Allow development-only insecure KMS defaults. |
 | `--buffer-profile` | `RUSTFS_BUFFER_PROFILE` | `GeneralPurpose` | Workload profile for adaptive buffer sizing. |