OBSDOCS-1254: Document AWS STS

Signed-off-by: Pavol Loffay <[email protected]>

Author: pavolloffay

modules/distr-tracing-tempo-object-storage-setup-aws-sts-install.adoc

@@ -0,0 +1,83 @@
+// Module included in the following assemblies:
+//
+//* observability/distr_tracing/distr_tracing_tempo/distr-tracing-tempo-installing.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="distr-tracing-tempo-object-storage-setup-aws-sts-install_{context}"]
+= Setting up the Amazon S3 storage with the Security Token Service
+
+You can set up the Amazon S3 storage with the Security Token Service (STS) by using the AWS Command Line Interface (AWS CLI).
+
+:FeatureName: The Amazon S3 storage with the Security Token Service
+include::snippets/technology-preview.adoc[leveloffset=+1]
+
+.Prerequisites
+
+* You have installed the latest version of the AWS CLI.
+
+.Procedure
+
+. Create an AWS S3 bucket.
+
+. Create the following `trust.json` file for the AWS IAM policy that will set up a trust relationship for the AWS IAM role, created in the next step, with the service account of the TempoStack instance:
++
+[source,yaml]
+----
+{
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+        "Effect": "Allow",
+        "Principal": {
+          "Federated": "arn:aws:iam::${<aws_account_id>}:oidc-provider/${<oidc_provider>}" # <1>
+        },
+        "Action": "sts:AssumeRoleWithWebIdentity",
+        "Condition": {
+          "StringEquals": {
+            "${OIDC_PROVIDER}:sub": [
+              "system:serviceaccount:${<openshift_project_for_tempostack>}:tempo-${<tempostack_cr_name>}" # <2>
+              "system:serviceaccount:${<openshift_project_for_tempostack>}:tempo-${<tempostack_cr_name>}-query-frontend"
+           ]
+         }
+       }
+     }
+    ]
+}
+----
+<1> OIDC provider that you have configured on the {product-title}. You can get the configured OIDC provider value also by running the following command: `$ oc get authentication cluster -o json | jq -r '.spec.serviceAccountIssuer' | sed 's~http[s]*://~~g'`.
+<2> Namespace in which you intend to create the TempoStack instance.
+
+. Create an AWS IAM role by attaching the `trust.json` policy file that you created:
++
+[source,terminal]
+----
+$ aws iam create-role \
+      --role-name "tempo-s3-access" \
+      --assume-role-policy-document "file:///tmp/trust.json" \
+      --query Role.Arn \
+      --output text
+----
+
+. Attach an AWS IAM policy to the created role:
++
+[source,terminal]
+----
+$ aws iam attach-role-policy \
+      --role-name "tempo-s3-access" \
+      --policy-arn "arn:aws:iam::aws:policy/AmazonS3FullAccess"
+----
+
+. In the {product-title}, create an object storage secret with keys as follows:
++
+[source,yaml]
+----
+apiVersion: v1
+kind: Secret
+metadata:
+  name: minio-test
+stringData:
+  bucket: <s3_bucket_name>
+  region: <s3_region>
+  role_arn: <s3_role_arn>
+type: Opaque
+----

observability/distr_tracing/distr_tracing_tempo/distr-tracing-tempo-installing.adoc

@@ -61,6 +61,16 @@ include::modules/distr-tracing-tempo-install-tempomonolithic-cli.adoc[leveloffse
 
 include::modules/distr-tracing-tempo-storage-ref.adoc[leveloffset=+1]
 
+include::modules/distr-tracing-tempo-object-storage-setup-aws-sts-install.adoc[leveloffset=+2]
+
+[role="_additional-resources"]
+.Additional resources
+
+* link:https://docs.aws.amazon.com/iam/[AWS Identity and Access Management Documentation]
+* link:https://docs.aws.amazon.com/cli/[AWS Command Line Interface Documentation]
+* xref:../../../authentication/identity_providers/configuring-oidc-identity-provider.adoc#configuring-oidc-identity-provider[Configuring an OpenID Connect identity provider]
+* link:https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html[Identify AWS resources with Amazon Resource Names (ARNs)]
+
 [role="_additional-resources"]
 [id="additional-resources_dist-tracing-tempo-installing"]
 == Additional resources

snippets/distr-tracing-tempo-required-secret-parameters.adoc

@@ -51,6 +51,16 @@ See link:https://operator.min.io/[MinIO Operator].
 
 `access_key_secret: <s3_access_key_secret>`
 
+|Amazon S3 with Security Token Service (STS)
+|
+`name: tempostack-dev-s3 # example`
+
+`bucket: <s3_bucket_name> # link:https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html[Amazon S3 documentation]`
+
+`region: <s3_region>`
+
+`role_arn: <s3_role_arn>`
+
 |Microsoft Azure Blob Storage
 |
 `name: tempostack-dev-azure # example`