Document S3 environment credential resolution - #207
Merged
nscuro merged 4 commits intoAug 16, 2026
Conversation
2 tasks
nscuro
requested changes
Aug 16, 2026
nscuro
left a comment
nscuro
left a comment
Member
There was a problem hiding this comment.
One small correction please, otherwise good to go.
Please also make sure to sign-off your commits so the DCO check passes.
The S3 provider section only showed static credentials, so there was no indication that omitting the access key and secret key makes the api server resolve credentials from its environment instead. Add an Authentication subsection describing both credential modes, the resolution order, when resolution happens, and the fact that EKS Pod Identity is not supported. Signed-off-by: Matt Finkel <finkel.matt@gmail.com>
The api server change was reworked: ambient AWS credential resolution is now opt-in via dt.file-storage.s3.credentials-source=aws, and the default keeps the original behavior, including anonymous access when no credentials are configured. Describe all three modes. Signed-off-by: Matt Finkel <finkel.matt@gmail.com>
Anonymous write access is not supported and will not be patched around; see the discussion in DependencyTrack/dependency-track#6851. Document that uploads fail when no credentials are configured. Signed-off-by: Matt Finkel <finkel.matt@gmail.com>
The api server now fails startup when access-key or secret-key is missing with credentials-source=static, instead of sending unsigned requests. Drop the outdated anonymous access paragraph. Signed-off-by: Matt Finkel <finkel.matt@gmail.com>
fffinkel
force-pushed
the
s3-ambient-aws-credentials
branch
from
August 16, 2026 15:34
46c8669 to
85dc49f
Compare
nscuro
approved these changes
Aug 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
The S3 provider section of
docs/reference/configuration/file-storage.mdshowed static credentials as the only option:Nothing told an AWS reader that omitting both properties makes the api server resolve credentials from its environment. This adds an "Authentication" subsection describing both credential modes, the resolution order, when resolution happens, and the fact that EKS Pod Identity is not supported.
Depends on
This documents behavior introduced by DependencyTrack/dependency-track#6851, which is not merged yet. Please do not merge this before that change lands, or the page will describe behavior the api server does not have.
Additional details
properties.mdis deliberately untouched. The api server change also editsapplication.properties, so the generated property descriptions fordt.file-storage.s3.access-keyanddt.file-storage.s3.secret-keyare now stale. PerAGENTS.mdI did not hand-edit a generated file, and theUpdate config docsworkflow regenerates it once the api server change merges. Say the word if you would rather I runmake generate-config-docsand include the result here.Diataxis. This is a reference page, so the new section only describes. The reasoning for the change, and the argument for preferring roles over long-lived keys, is deliberately left out. That belongs in Concepts, or in the follow-up section of ADR-004 in the api server repo, where I recorded it.
Pod Identity exclusion. Worth stating explicitly rather than leaving readers to infer it from silence. The api server's S3 client does not read the token file the Pod Identity Agent provides, and it rejects the agent's endpoint because that address is not a loopback address.
Verification
make lint-markdownreports 0 errors across 106 files.make lint-prosereports 0 errors for this page. Three warnings remain, all on pre-existing lines I did not touch (is selected,multiple,will). The passive-voice warnings my own additions triggered are fixed.make buildcompletes a strict build with no errors, and the newproperties.md#...anchor links all resolve.