Storage Configuration

This page is for platform administrators of the Private Virtual Appliance deployment. Tenant users connecting their own S3 bucket (BYOS) should see Storage instead.

Overview

The Enclave appliance needs a storage backend to persist encrypted file data. All data written to storage is ciphertext only — the appliance encrypts every file before it leaves the application layer.

Backend	Best for
AWS S3 / S3-compatible	Cloud-adjacent deployments with internet access; high durability
NFS	On-premise or air-gapped environments with existing NAS infrastructure
Local Disk	Single-node lab or evaluation deployments only

Configuration is done at Admin → Platform Infra → Storage.

AWS S3 / S3-compatible

Supports standard AWS S3, and any S3-compatible object store (MinIO, Ceph Object Gateway, Wasabi, Backblaze B2).

Prerequisites

An S3 bucket (or compatible endpoint) reachable from the appliance over HTTPS
Because the appliance runs on VMware (not EC2), there is no instance profile — use Assume Role or Static Credentials
For S3-compatible stores: the endpoint URL and a bucket created in advance

Step 0 — Create an S3 bucket

Sign in to the AWS Console → navigate to S3 → Create bucket
Enter a bucket name and choose an AWS region
Keep Block all public access enabled (default)
Click Create bucket — note the bucket name and region for later

Auth methods

Assume Role (recommended for AWS S3)
Static Credentials

The appliance authenticates using a dedicated IAM user and then assumes a role that holds the S3 permissions. Long-lived credentials are not stored for S3 access.

If you already created an enclave-appliance IAM user during KMS setup, skip Step 1 and reuse that user — just add the new AssumeRole permission in Step 3b.

Step 1 — Create a dedicated IAM user for the appliance

In the AWS Console, go to IAM → Users → Create user
User name: enclave-appliance (or any name you prefer)
Do not attach any permissions — click Next → Create user
Open the user → Security credentials tab → Create access key
Choose “Application running outside AWS” → Create access key
Save the Access Key ID and Secret Access Key

Step 2 — Create an IAM role for S3 access

Go to IAM → Roles → Create role
Trusted entity type: AWS account → This account
Do not attach permissions yet → click Next
Role name: enclave-s3-role (or any name you prefer) → Create role

Step 3 — Set the trust policy

Open the enclave-s3-role role → Trust relationships tab → Edit trust policy
Replace the content with:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "AllowEnclaveApplianceToAssume",
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::YOUR_ACCOUNT_ID:user/enclave-appliance"
    },
    "Action": "sts:AssumeRole"
  }]
}

Replace YOUR_ACCOUNT_ID with your 12-digit AWS account ID. Using an IAM user as the principal avoids the “Invalid principal in policy” error — the user exists before the role.

Click Update policy

Step 3b — Allow the user to call AssumeRole

Go to the enclave-appliance user → Permissions tab → Add permissions → Create inline policy
JSON:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
    "Resource": "arn:aws:iam::YOUR_ACCOUNT_ID:role/enclave-s3-role"
  }]
}

Name it enclave-assume-s3-role → Create policy

Step 3c — Attach S3 permissions to the role

Go back to enclave-s3-role → Permissions tab → Add permissions → Create inline policy
JSON:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "EnclavePlatformS3Access",
    "Effect": "Allow",
    "Action": [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:HeadBucket"
    ],
    "Resource": [
      "arn:aws:s3:::YOUR_BUCKET_NAME",
      "arn:aws:s3:::YOUR_BUCKET_NAME/*"
    ]
  }]
}

Name it enclave-s3-permissions → Create policy
Copy the Role ARN from the role Summary page

Step 4 — Configure in EnclaveGo to Admin → Platform Infra → Storage → Add Storage:

Field	Value
Storage type	S3
Auth method	Assume Role
Access Key ID	`enclave-appliance` user access key
Secret Access Key	`enclave-appliance` user secret key
Role ARN	`arn:aws:iam::YOUR_ACCOUNT_ID:role/enclave-s3-role`
Bucket	Bucket name from Step 0
Region	AWS region of the bucket
Endpoint	Leave blank for standard AWS S3
Path Prefix	Optional subdirectory

Click Test Connection, then Save and Activate.

Use an IAM user’s access key and secret directly. Simpler to set up; suitable for S3-compatible stores that do not support role assumption.

Static credentials are stored encrypted in the appliance database. Rotate them regularly and restrict permissions to the specific bucket.

Step 1 — Create an IAM user with S3 permissionsIn your AWS account (or S3-compatible admin console), create a user with the following permissions on your bucket:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:HeadBucket"
    ],
    "Resource": [
      "arn:aws:s3:::YOUR_BUCKET_NAME",
      "arn:aws:s3:::YOUR_BUCKET_NAME/*"
    ]
  }]
}

Generate an access key for the user.Step 2 — Configure in EnclaveGo to Admin → Platform Infra → Storage → Add Storage:

Field	Value
Storage type	S3
Auth method	Static Credentials
Access Key ID	Access key
Secret Access Key	Secret key
Bucket	Your bucket name
Region	Region (use `us-east-1` or closest for S3-compatible stores)
Endpoint	Leave blank for AWS S3; enter API URL for S3-compatible stores (e.g. `https://minio.yourcompany.com`)
Path Prefix	Optional subdirectory

Click Test Connection, then Save and Activate.

NFS

NFS is the recommended option for fully on-premise or air-gapped deployments where no cloud object storage is available.

Prerequisites

An NFS v3 or v4 share exported and mountable from the appliance VM
The share must be mounted on the appliance at a stable path before configuring storage (the appliance does not mount NFS shares itself — it reads/writes to an already-mounted path)
Read/write permissions for the enclave process user on the mount

SSH into the appliance VM and mount the share:

sudo mount -t nfs your-nfs-server:/export/enclave /mnt/enclave-storage

To make the mount persistent across reboots, add it to /etc/fstab:

your-nfs-server:/export/enclave  /mnt/enclave-storage  nfs  defaults,_netdev  0  0

Configure in Enclave

Go to Admin → Platform Infra → Storage → Add Storage, select NFS:

Field	Value
Mount Point	`/mnt/enclave-storage` (or your chosen path)

Click Test Connection, then Save and Activate. The appliance verifies the path is accessible and writable.

Enclave writes files under <mount_point>/tenants/<tenant_id>/ and creates subdirectories automatically. Ensure the NFS share has sufficient capacity and monitor it externally — Enclave does not track NFS utilisation.

Local Disk

Local disk writes encrypted file data directly to the appliance VM’s disk. Suitable for evaluation or single-node lab deployments only.

Local disk storage is not replicated. If the VM disk is lost, all file data is lost. Do not use local disk for production deployments.

Go to Admin → Platform Infra → Storage → Add Storage, select Local Disk:

Field	Value
Mount Point	An absolute path on the appliance disk (e.g. `/var/enclave/storage`)

The path must exist and be writable. Enclave creates subdirectories automatically.

Activating the storage backend

After saving, the backend must be activated before the appliance can accept file uploads:

In Admin → Platform Infra → Storage, locate the saved backend
Click Activate
The appliance immediately begins routing all new file uploads to this backend

Only one platform storage backend can be active at a time. Activating a new backend does not migrate existing files — files stored under the previous backend remain there. Contact support@kvelden.com if you need to migrate data between backends.

Testing a saved backend

To re-run the connectivity test at any time, hover over the backend row in Admin → Platform Infra → Storage and click Test. The appliance performs a live head-check and reports success or the specific error. No data is written during the test.

Get Started

Deployment

Platform Guide

Key Management

Storage

Organization

Security & Trust

Overview

AWS S3 / S3-compatible

Prerequisites

Step 0 — Create an S3 bucket

Auth methods

NFS

Prerequisites

Configure in Enclave

Local Disk

Activating the storage backend

Testing a saved backend

​Overview

​AWS S3 / S3-compatible

​Prerequisites

​Step 0 — Create an S3 bucket

​Auth methods

​NFS

​Prerequisites

​Mounting the NFS share on the appliance

​Configure in Enclave

​Local Disk

​Activating the storage backend

​Testing a saved backend

Overview

AWS S3 / S3-compatible

Prerequisites

Step 0 — Create an S3 bucket

Auth methods

NFS

Prerequisites

Mounting the NFS share on the appliance

Configure in Enclave

Local Disk

Activating the storage backend

Testing a saved backend