Skip to content

Update Amazon S3 destination permissions #35356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maycmlee merged 2 commits into from
Mar 18, 2026
Merged

Update Amazon S3 destination permissions #35356

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ddf5336
update permissions
maycmlee Mar 17, 2026
5c7fe40
Update content/en/observability_pipelines/destinations/amazon_s3.md
maycmlee Mar 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion content/en/observability_pipelines/destinations/amazon_s3.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,11 @@ You can route logs from Observability Pipelines to Snowflake using the Amazon S3

#### Permissions

{{% observability_pipelines/aws_authentication/amazon_security_lake/permissions %}}
To send logs to Amazon S3, the Observability Pipelines Worker requires the following policy permissions:

- `s3:ListBucket`
- `s3:PutObject`
- `s3:GetObject`
Comment on lines +131 to +135
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Remove unnecessary s3:GetObject from S3 sink permissions

When users are configuring only the Observability Pipelines Amazon S3 destination (that is, the common write-only case without the optional archive/rehydration flow), this new bullet tells them to grant the worker read access to every object in the bucket even though the underlying sink does not need it. Vector's official aws_s3 sink permissions table (https://vector.dev/docs/reference/configuration/sinks/aws_s3/) lists only s3:ListBucket for healthcheck and s3:PutObject for normal operation, so documenting s3:GetObject here expands privileges unnecessarily for buckets that may contain sensitive logs.

Useful? React with 👍 / 👎.


### Event batching

Expand Down
Loading