prometheus / prometheus/prometheus
Add an option to specify an AWS vpc endpoint URL to bypass the internet when using sigv4 authentication
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 66.1k
- Forks
- 10.8k
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 131
Description
Proposal
Bypassing the Internet when targeting AWS managed services for Prometheus doesn't have to traverse the internet, and firewalls. More secure and direct.
remote_write:
url: "https://aps-workspaces.us-east-1.amazonaws.com/workspaces/ws-0000000.../api/v1/remote_write"
...
sigv4:
region: us-east-1
role_arn: arn:aws:iam::00000000:role/AMP-Central-Role
# perhaps adding this key: value pair
endpoint: https://vpce-000000000-ovk33724.sts.us-east-1.vpce.amazonaws.com
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the remote_write sigv4 configuration and how AWS service requests choose their endpoint. Use the proposed endpoint field and VPC endpoint URL as the expected behavior; done means Prometheus can target the private endpoint for SigV4-authenticated remote writes without using the internet.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go
- Domain
- backend, cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100