Integration

In order to connect to the AWS S3 storage in the ArangoPlatform:

AWS S3 Access Keys

Storage Integration requires static credentials in order to access AWS S3 API. Credentials can be provided via the Kubernetes Secret.

kubectl create secret generic credentials --from-literal 'accessKey=<AWS Access Key ID>' --from-literal 'secretKey=<AWS Secret Access Key>'

Permissions

The provided credentials need the following S3 permissions on the configured bucket:

Action	Purpose
s3:CreateBucket	Create the bucket if it does not exist
s3:ListBucket	Check bucket existence and list objects
s3:GetObject	Read objects and object metadata
s3:PutObject	Write objects (including multipart uploads)
s3:AbortMultipartUpload	Clean up incomplete multipart uploads
s3:DeleteObject	Delete objects

Example IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:CreateBucket", "s3:ListBucket"],
      "Resource": "arn:aws:s3:::<Bucket Name>"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:AbortMultipartUpload", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::<Bucket Name>/*"
    }
  ]
}

If the bucket already exists and is managed externally, s3:CreateBucket can be omitted.

Object

Once the Secret is created, we are able to create ArangoPlatformStorage.

echo "---
apiVersion: platform.arangodb.com/v1beta1
kind: ArangoPlatformStorage
metadata:
  name: deployment
  namespace: namespace
spec:
  backend:
    s3:
      allowInsecure: true # If public certs are not installed, this needs to be set to false
      bucketName: <Bucket Name>
      bucketPath: <Bucket Path>
      credentialsSecret:
        name: credentials 
      endpoint: https://s3.eu-central-1.amazonaws.com # AWS S3 Region Endpoint
      region: eu-central-1 # AWS Region
" | kubectl apply -f -