To set up trace and log rehydration from your Amazon S3 bucket, you’ll need to create an AWS IAM role with:
You can use the AWS Management Console or Terraform to create the necessary AWS resources. After you’ve created the IAM policy and role, you’ll need to contact your Honeycomb account team to finish setting up your S3 archive.
First, create an IAM policy with permissions for listing and retrieving objects from your Amazon S3 bucket:
Sign in to the AWS Management Console and open the IAM console.
In the navigation pane on the left, choose Policies.
Select Create policy.
In the Policy editor, select the JSON option.
Paste the following JSON policy document into the editor, replacing <bucket name> with the name of your Amazon S3 bucket
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAccessToArchiveBucket",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Resource": [
"arn:aws:s3:::<bucket name>/*",
"arn:aws:s3:::<bucket name>"
]
}
]
}
If there are no warnings or errors, select Next.
Name the policy and provide an optional description. Remember the name of the policy, you’ll need it when creating the IAM role.
Select Create Policy.
Next, create an IAM role with permissions to interact with your Amazon S3 bucket, and give Honeycomb permission to use this role when interacting with the bucket.
Sign in to the AWS Management Console and open the IAM console.
In the navigation pane, choose Roles and then choose Create role.
Select the Custom trust policy role type.
In the Custom trust policy section, use one of the following custom trust policies for the role:
For Production US teams:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::702835727665:role/production-eks-bulk-ingest-role"
},
"Action": "sts:AssumeRole"
}
]
}
For Production EU teams:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::919259170365:role/production-eu1-eks-bulk-ingest-role"
},
"Action": "sts:AssumeRole"
}
]
}
Select Next.
In the Permissions policies section, type the name of the IAM policy that has the permissions on your Amazon S3 bucket in the search bar.
Select the checkbox to the left of the IAM policy name in the results below the Search bar.
You can skip setting a permissions boundary, which will be at the bottom of this page.
Select Next.
Give the IAM role a name and an optional description.
Select Create Role.
To complete your setup, share the following information with your Honeycomb account team:
s3_prefix from your OpenTelemetry Collector exporter configuration, if specified.s3_partition_format from your OpenTelemetry Collector exporter configuration, if specified.