First Issue: What IAM roles are needed?

[derrickburns]

deployment:
annotations: {}
# iam.amazonaws.com/role: prometheus

[arthur-c]

@derrickburns ,

Thanos needs to write in a bucket, so if you are using AWS you need to give a S3 access to the thanos pods (at least for sidecar, store, compact)

Here it's just an annotation example when using kube2iam as an IAM provider.