Skip to content

docs: add use_fips_sts_endpoint to sigv4 config#17304

Merged
jan--f merged 1 commit intoprometheus:mainfrom
Devansh-ops:docs/sigv4-fips-sts-endpoint
Nov 7, 2025
Merged

docs: add use_fips_sts_endpoint to sigv4 config#17304
jan--f merged 1 commit intoprometheus:mainfrom
Devansh-ops:docs/sigv4-fips-sts-endpoint

Conversation

@Devansh-ops
Copy link
Contributor

What this PR does

Adds use_fips_sts_endpoint to the sigv4 block in docs/configuration/configuration.md, including a short description, and minimum version note, The field enables use of the FIPS-compliant AWS STS endpoint when assuming roles.

  • Field added in both occurrences of the shared <http_config> → sigv4 section in the page.
  • Notes that Prometheus v2.54.0+ is required (first release with prometheus/common v0.55.0).

Rationale / background

Environment variable–based selection (AWS_USE_FIPS_ENDPOINT) no longer drives STS FIPS usage for this path; the documented way is the config knob use_fips_sts_endpoint. This closes the docs gap so users can discover the option directly from the Prometheus configuration page.

References:

  • Feature introduced in prometheus/common and consumed by Prometheus in v2.54.0. link
  • Related discussion: AWS_USE_FIPS_ENDPOINT no longer works for this case.
  • Operator surfaced the option in prometheus-operator and adjusted wording shortly after; this change aligns the server docs.

Example

remote_write:
  - url: https://aps-workspaces.us-east-1.amazonaws.com/workspaces/XXXX/api/v1/remote_write
    http_config:
      sigv4:
        region: us-east-1
        role_arn: arn:aws:iam::111122223333:role/prom-remote-write
        use_fips_sts_endpoint: true

Which issue(s) does the PR fix:

Related

Does this PR introduce a user-facing change?

NONE

Checklist

  • Changes limited to documentation (docs/configuration/configuration.md).
  • DCO sign-off on commits (git commit -s).
  • Comments follow style (capitalized, end with a period).
  • Kept wording consistent with nearby sigv4 entries.

Reviewers to ping (suggested): @roidelapluie @metalmatze

Signed-off-by: Devansh Sehgal <devanshsehgal02@gmail.com>
@Devansh-ops Devansh-ops marked this pull request as ready for review October 7, 2025 20:44
Copy link
Member

@metalmatze metalmatze left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This code lives within the AWS SDK, right? I can't find a trace in the Prometheus code. If this is what the upstream SDK wants to do, I'm totally fine updating the docs here.

@roidelapluie
Copy link
Member

This code lives within the AWS SDK, right? I can't find a trace in the Prometheus code. If this is what the upstream SDK wants to do, I'm totally fine updating the docs here.

https://github.com/prometheus/sigv4/blob/fd9fd9a3b8ce1c2fda36568b5f96ce10d3672a4c/sigv4_config.go#L31

@jan--f jan--f merged commit 198d665 into prometheus:main Nov 7, 2025
28 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add use_fips_sts_endpoint to sigv4 documentation.

4 participants