feat: add SessionName and Tags support for STS AssumeRole - #76
Merged
Conversation
Add optional SessionName and Tags fields to SigV4Config to enable
per-caller identity attribution (RoleSessionName) and cost allocation
session tags when assuming IAM roles via STS. This mirrors the
capability introduced in agentgateway PR #2435, enabling AWS billing
chargeback by team/tenant/environment for Prometheus remote write
traffic through assumed roles.
- SessionName validated against AWS constraints: ^[\w+=,.@-]{2,64}$
- Tags validated: key ≤ 128, value ≤ 256, both require role_arn
- SessionName and Tags threaded through to stscreds.AssumeRoleProvider
- New unit tests cover YAML parsing, validation boundary conditions,
and end-to-end STS AssumeRole request body verification via mock server
Signed-off-by: dongjiang <dongjiang1989@126.com>
5 tasks
dongjiang1989
added a commit
to dongjiang1989/prometheus
that referenced
this pull request
Sep 2, 2026
Bump github.com/prometheus/sigv4 from v0.4.1 to v0.5.0, which adds SessionName and Tags fields for STS AssumeRole (prometheus/sigv4#76). The updated NewSigV4RoundTripper signature uses variadic options and remains backward-compatible with existing callers. Document the new session_name and tags fields, along with the previously undocumented service_name field, in both the alertmanager and remote_write sigv4 configuration blocks. Also replace the deprecated expfmt.Negotiate call in web/federate.go with the explicit expfmt.NegotiateAccept form to satisfy staticcheck. Signed-off-by: dongjiang1989 <dongjiang1989@126.com>
dongjiang1989
added a commit
to dongjiang1989/prometheus
that referenced
this pull request
Sep 2, 2026
Bump github.com/prometheus/sigv4 from v0.4.1 to v0.5.0. The new release adds SessionName and Tags fields for STS AssumeRole (prometheus/sigv4#76). The updated NewSigV4RoundTripper signature uses variadic options and remains backward-compatible, so no Prometheus code changes are required beyond the version bump. service_name was already part of the struct in v0.4.1 but was missing from the documentation — it is now documented alongside the new fields. Also replace deprecated expfmt.Fmt* constants with expfmt.NewFormat (expfmt.Type*) in web/federate.go to fix the SA1019 staticcheck failure introduced by the prometheus/common v0.71.0 transitive bump. Signed-off-by: dongjiang1989 <dongjiang1989@126.com>
4 tasks
dongjiang1989
added a commit
to dongjiang1989/alertmanager
that referenced
this pull request
Sep 2, 2026
- Update github.com/prometheus/sigv4 from v0.4.1 to v0.5.0 - Add support for new SessionName field (maps to AWS RoleSessionName) - Add support for new Tags field (maps to STS session tags for cost allocation) - Both fields require role_arn and are passed to STS AssumeRole - Add comprehensive AWS STS tag validation: * Call sigv4.Validate() for field-level validation * Enforce 50-tag limit (AWS STS maximum) * Reject reserved 'aws:' prefix in tag keys - Add test cases for all validation rules - Update documentation with AWS constraints This mirrors the capability from prometheus/sigv4#76, enabling AWS billing chargeback by team/tenant/environment for SNS notifications through assumed roles. Signed-off-by: dongjiang1989 <dongjiang1989@126.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add optional SessionName and Tags fields to SigV4Config to enable per-caller identity attribution (RoleSessionName) and cost allocation session tags when assuming IAM roles via STS. This mirrors the capability introduced in agentgateway PR #2435, enabling AWS billing chargeback by team/tenant/environment for Prometheus remote write traffic through assumed roles.