From 25cf96b2b771619d5a1ff3a144a9cd19db8b5ad2 Mon Sep 17 00:00:00 2001 From: Matt Finkel Date: Fri, 31 Jul 2026 17:32:07 +0100 Subject: [PATCH] Document S3 environment credential resolution The S3 provider section only showed static credentials, so there was no indication that omitting the access key and secret key makes the api server resolve credentials from its environment instead. Add an Authentication subsection describing both credential modes, the resolution order, when resolution happens, and the fact that EKS Pod Identity is not supported. Signed-off-by: Matt Finkel --- docs/reference/configuration/file-storage.md | 32 ++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/docs/reference/configuration/file-storage.md b/docs/reference/configuration/file-storage.md index b97a6157..39ee6769 100644 --- a/docs/reference/configuration/file-storage.md +++ b/docs/reference/configuration/file-storage.md @@ -46,6 +46,38 @@ dt.file-storage.s3.secret-key= dt.file-storage.s3.region=us-east-1 ``` +#### Authentication + +The `s3` provider supports two credential modes. + +**Static credentials.** Configure `dt.file-storage.s3.access-key` and `dt.file-storage.s3.secret-key`. +Both properties require each other. If you configure only one of them, Dependency-Track fails to start. +This mode works with any S3-compatible object store. + +**Environment credentials.** Omit both properties. Dependency-Track resolves credentials from its +environment instead, using the first of these sources that provides them: + +1. The `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables +2. The shared AWS configuration file, `~/.aws/credentials` by default +3. IAM Roles for Service Accounts (IRSA) on Amazon EKS +4. Task roles on Amazon ECS +5. Instance profiles on Amazon EC2 + +```ini +dt.file-storage.provider=s3 +dt.file-storage.s3.endpoint=https://s3.us-east-1.amazonaws.com +dt.file-storage.s3.bucket=dtrack-files +dt.file-storage.s3.region=us-east-1 +``` + +Dependency-Track resolves credentials when it verifies the bucket during startup. +If no source provides credentials, startup fails. + +!!! note + Amazon EKS Pod Identity is not supported. The S3 client does not read the token file that the + Pod Identity Agent provides, and it rejects the agent's endpoint because that address is not a + loopback address. Use IRSA on Amazon EKS. + Configuration: - [`dt.file-storage.s3.endpoint`](properties.md#dtfile-storages3endpoint)