Amazon S3
Create the buckets
Bucket names are global: pick your own. Create both in Relic's region.
This command creates the artifacts bucket:
aws s3api create-bucket --bucket example-relic-artifacts --region eu-central-1 \
--create-bucket-configuration LocationConstraint=eu-central-1
This command creates the temporary bucket:
aws s3api create-bucket --bucket example-relic-temporary --region eu-central-1 \
--create-bucket-configuration LocationConstraint=eu-central-1
Lifecycle rules
This rule expires everything in the temporary bucket after one day:
aws s3api put-bucket-lifecycle-configuration --bucket example-relic-temporary \
--lifecycle-configuration '{"Rules":[{"ID":"expire-staged-uploads","Status":"Enabled","Filter":{},
"Expiration":{"Days":1},"AbortIncompleteMultipartUpload":{"DaysAfterInitiation":1}}]}'
This rule cleans up incomplete multipart uploads in the artifacts bucket:
aws s3api put-bucket-lifecycle-configuration --bucket example-relic-artifacts \
--lifecycle-configuration '{"Rules":[{"ID":"abort-incomplete-uploads","Status":"Enabled","Filter":{},
"AbortIncompleteMultipartUpload":{"DaysAfterInitiation":1}}]}'
IAM policy
Grant Relic this policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:ListBucket"],
"Resource": ["arn:aws:s3:::example-relic-artifacts", "arn:aws:s3:::example-relic-temporary"]
},
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
"Resource": ["arn:aws:s3:::example-relic-artifacts/*", "arn:aws:s3:::example-relic-temporary/*"]
}
]
}
Without s3:ListBucket, garbage collection, the storage check and /readyz
fail.
With SSE-KMS and a customer managed key, also allow kms:GenerateDataKey and
kms:Decrypt on that key.
Credentials
With RELIC_OBJECT_STORAGE_ACCESS_KEY and RELIC_OBJECT_STORAGE_SECRET_KEY
empty, Relic uses the AWS default credential chain: IRSA, EKS Pod Identity, the
EC2 instance profile or ECS task role, or AWS_* variables.
Encryption and storage class
New buckets encrypt with SSE-S3. For a KMS key or another storage class:
RELIC_OBJECT_STORAGE_SSE=aws:kms
RELIC_OBJECT_STORAGE_SSE_KMS_KEY_ID=alias/relic
RELIC_OBJECT_STORAGE_STORAGE_CLASS=INTELLIGENT_TIERING
Avoid classes with retrieval delays (Glacier Flexible Retrieval, Deep Archive).
Settings
RELIC_OBJECT_STORAGE_REGION=eu-central-1
RELIC_OBJECT_STORAGE_ARTIFACTS_BUCKET=example-relic-artifacts
RELIC_OBJECT_STORAGE_TEMPORARY_BUCKET=example-relic-temporary
Leave RELIC_OBJECT_STORAGE_ENDPOINT empty. The region must match the buckets'
region.
Helm, with IRSA:
seaweedfs:
enabled: false
serviceAccount:
annotations:
eks.amazonaws.com/role-arn: arn:aws:iam::<account>:role/relic
objectStorage:
endpoint: ""
region: eu-central-1
defaultCredentials: true
artifactsBucket: example-relic-artifacts
temporaryBucket: example-relic-temporary
With a static key pair, the chart requires the endpoint: leave out
defaultCredentials, set objectStorage.endpoint to
https://s3.eu-central-1.amazonaws.com, and put the keys in the Secret (see
External object storage).
Costs on AWS
Every download is a GetObject, and egress and requests cost money. The daily
storage check also lists the artifacts bucket and reads up to 10 GiB. Run Relic
in the buckets' region, and consider a VPC gateway endpoint for S3 to skip the
NAT gateway.