4 files changed, 29 insertions, 3 deletions
diff --git a/weed/command/filer.go b/weed/command/filer.go
index 3f616e624..f07c605d7 100644
--- a/weed/command/filer.go
+++ b/weed/command/filer.go
@@ -134,6 +134,7 @@ func init() {
 	filerS3Options.idleTimeout = cmdFiler.Flag.Int("s3.idleTimeout", 120, "connection idle seconds")
 	filerS3Options.concurrentUploadLimitMB = cmdFiler.Flag.Int("s3.concurrentUploadLimitMB", 0, "limit total concurrent upload size for S3, 0 means unlimited")
 	filerS3Options.concurrentFileUploadLimit = cmdFiler.Flag.Int("s3.concurrentFileUploadLimit", 0, "limit number of concurrent file uploads for S3, 0 means unlimited")
+	filerS3Options.enableIam = cmdFiler.Flag.Bool("s3.iam", true, "enable embedded IAM API on the same S3 port")
 
 	// start webdav on filer
 	filerStartWebDav = cmdFiler.Flag.Bool("webdav", false, "whether to start webdav gateway")
diff --git a/weed/command/iam.go b/weed/command/iam.go
index 8fae7ec96..77f3a9014 100644
--- a/weed/command/iam.go
+++ b/weed/command/iam.go
@@ -44,13 +44,34 @@ func init() {
 
 var cmdIam = &Command{
 	UsageLine: "iam [-port=8111] [-filer=<ip:port>[,<ip:port>]...] [-master=<ip:port>,<ip:port>]",
-	Short:     "start a iam API compatible server",
-	Long:      `start a iam API compatible server.
+	Short:     "[DEPRECATED] start a standalone iam API compatible server",
+	Long: `[DEPRECATED] start a standalone iam API compatible server.
+
+	DEPRECATION NOTICE:
+	The standalone 'weed iam' command is deprecated and will be removed in a future release.
+	
+	The IAM API is now embedded in the S3 server by default. Simply use 'weed s3' instead,
+	which provides both S3 and IAM APIs on the same port (enabled by default with -iam=true).
+	
+	This simplifies deployment by running a single server instead of two separate servers,
+	following the pattern used by MinIO and Ceph RGW.
+	
+	To use the embedded IAM API:
+	  weed s3 -port=8333          # IAM API is available on the same port
+	
+	To disable the embedded IAM API (if you prefer the old behavior):
+	  weed s3 -iam=false          # Run S3 without IAM
+	  weed iam -port=8111         # Run IAM separately (deprecated)
 
 	Multiple filer addresses can be specified for high availability, separated by commas.`,
 }
 
 func runIam(cmd *Command, args []string) bool {
+	glog.Warningf("================================================================================")
+	glog.Warningf("DEPRECATION WARNING: 'weed iam' is deprecated and will be removed in a future release.")
+	glog.Warningf("The IAM API is now embedded in 'weed s3' by default (use -iam=true, which is the default).")
+	glog.Warningf("Please migrate to using 'weed s3' which provides both S3 and IAM APIs on the same port.")
+	glog.Warningf("================================================================================")
 	return iamStandaloneOptions.startIamServer()
 }
 
@@ -89,7 +110,7 @@ func (iamopt *IamOptions) startIamServer() bool {
 	if iamApiServer_err != nil {
 		glog.Fatalf("IAM API Server startup error: %v", iamApiServer_err)
 	}
-	
+
 	// Register shutdown handler to prevent goroutine leak
 	grace.OnInterrupt(func() {
 		iamApiServer.Shutdown()
diff --git a/weed/command/s3.go b/weed/command/s3.go
index 5f62e8e58..5691489f4 100644
--- a/weed/command/s3.go
+++ b/weed/command/s3.go
@@ -58,6 +58,7 @@ type S3Options struct {
 	idleTimeout               *int
 	concurrentUploadLimitMB   *int
 	concurrentFileUploadLimit *int
+	enableIam                 *bool
 }
 
 func init() {
@@ -86,6 +87,7 @@ func init() {
 	s3StandaloneOptions.idleTimeout = cmdS3.Flag.Int("idleTimeout", 120, "connection idle seconds")
 	s3StandaloneOptions.concurrentUploadLimitMB = cmdS3.Flag.Int("concurrentUploadLimitMB", 0, "limit total concurrent upload size, 0 means unlimited")
 	s3StandaloneOptions.concurrentFileUploadLimit = cmdS3.Flag.Int("concurrentFileUploadLimit", 0, "limit number of concurrent file uploads, 0 means unlimited")
+	s3StandaloneOptions.enableIam = cmdS3.Flag.Bool("iam", true, "enable embedded IAM API on the same port")
 }
 
 var cmdS3 = &Command{
@@ -279,6 +281,7 @@ func (s3opt *S3Options) startS3Server() bool {
 		IamConfig:                 iamConfigPath, // Advanced IAM config (optional)
 		ConcurrentUploadLimit:     int64(*s3opt.concurrentUploadLimitMB) * 1024 * 1024,
 		ConcurrentFileUploadLimit: int64(*s3opt.concurrentFileUploadLimit),
+		EnableIam:                 *s3opt.enableIam, // Embedded IAM API (enabled by default)
 	})
 	if s3ApiServer_err != nil {
 		glog.Fatalf("S3 API Server startup error: %v", s3ApiServer_err)
diff --git a/weed/command/server.go b/weed/command/server.go
index 49aa15c6e..954e3b93f 100644
--- a/weed/command/server.go
+++ b/weed/command/server.go
@@ -173,6 +173,7 @@ func init() {
 	s3Options.idleTimeout = cmdServer.Flag.Int("s3.idleTimeout", 120, "connection idle seconds")
 	s3Options.concurrentUploadLimitMB = cmdServer.Flag.Int("s3.concurrentUploadLimitMB", 0, "limit total concurrent upload size for S3, 0 means unlimited")
 	s3Options.concurrentFileUploadLimit = cmdServer.Flag.Int("s3.concurrentFileUploadLimit", 0, "limit number of concurrent file uploads for S3, 0 means unlimited")
+	s3Options.enableIam = cmdServer.Flag.Bool("s3.iam", true, "enable embedded IAM API on the same S3 port")
 
 	sftpOptions.port = cmdServer.Flag.Int("sftp.port", 2022, "SFTP server listen port")
 	sftpOptions.sshPrivateKey = cmdServer.Flag.String("sftp.sshPrivateKey", "", "path to the SSH private key file for host authentication")