Loki S3 Backend Storage Configuration

Grafana Loki
,
1

Hi,

In our current loki distributed deployment model, we have configured AWS s3 as backend storage and we have used below configuration –

storage:
type: s3
bucketNames:
chunks: loki-test-west-chunk
ruler: loki-test-west
admin: loki-test-west
s3:
bucketNames: loki-test-west
bucketNames.chunks: loki-test-west-chunk
endpoint: s3.us-west-2.amazonaws.com
region: us-west-2
secretAccessKey:
accessKeyId:

We are aware that it’s not a best practice to use keys directly on our deployment instead -
Is there a way we can use IRSA/ Pod identity over there to allow loki to access S3
can we have to pass this values as a secrets.

Please suggest if any other ways to tackle this.

Thank you,

2

I don’t run Loki on EKS, but there is nothing stopping you from using pot identity. I could be wrong since I don’t use the community helm chart, but I didn’t see pod identity related code in there, so you may have to cook your own.

Alternatively, you could just use your EKS host’s IAM role. This obviously will give all pods running on your EKS cluster the same permission, so not as desirable, but if you are not running anything else on the EKS cluster it’s an easy solution.