mirror of https://github.com/hashicorp/boundary
docs: Add S3 compliant storage (#4954)
* docs: Add S3 compliant storage * docs: remote storage state (#4949) * docs: remote storage state document new remote storage state on the worker * docs: Add link on worker storage page * docs: Address feedback * docs: Call out example * docs: Fix a typo * Update website/content/docs/configuration/session-recording/create-storage-bucket.mdx Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com> * Apply batch of suggestions from code review Co-authored-by: Hugo <10965479+hugoghx@users.noreply.github.com> * docs: Clarify support statement * docs: Revise support statement --------- Co-authored-by: Elim Tsiagbey <elim.tsiagbey@hashicorp.com> Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com> Co-authored-by: Hugo <10965479+hugoghx@users.noreply.github.com>pull/4984/head
Dan Heath
2 years ago
committed by
GitHub
parent
85b9adea81
commit
c4a01eb398
@ -0,0 +1,106 @@
|
||||
---
|
||||
layout: docs
|
||||
page_title: Configure S3-compliant storage
|
||||
description: |-
|
||||
How to configure an S3-compliant storage provider for Boundary session recording.
|
||||
---
|
||||
|
||||
# Configure an S3-compliant storage provider
|
||||
|
||||
<EnterpriseAlert product="boundary">This feature requires <a href="https://www.hashicorp.com/products/boundary">HCP Boundary or Boundary Enterprise</a></EnterpriseAlert>
|
||||
|
||||
The [MinIO plugin](https://github.com/hashicorp/boundary-plugin-minio/) lets you configure S3-compliant storage providers for session recording.
|
||||
|
||||
HashiCorp has tested and confirmed that you can configure the following S3-compliant storage products for session recording using the MinIO plugin:
|
||||
|
||||
- [Hitachi Content Platform](#hitachi-content-platform-configuration)
|
||||
|
||||
You can also configure other providers' S3-compliant storage products for session recording storage.
|
||||
We will update the list of providers as we test them.
|
||||
|
||||
## Requirements
|
||||
|
||||
Before you can create a storage bucket in Boundary, you must ensure that your environment meets certain requirements.
|
||||
|
||||
Session recording requires specific configuration for both the external storage provider and the Boundary worker.
|
||||
|
||||
Refer to [Configure workers for session recording](/boundary/docs/configuration/session-recording/configure-worker-storage) to learn about configuring self-managed workers for session recording.
|
||||
|
||||
When you determine storage requirements for the external bucket, you should consider:
|
||||
|
||||
- [BSR storage considerations](/boundary/docs/configuration/session-recording#storage-considerations)
|
||||
- [Storage bucket retention policies](/boundary/docs/configuration/session-recording/configure-storage-policy)
|
||||
|
||||
### S3-compliant storage provider requirements
|
||||
|
||||
- A storage bucket
|
||||
|
||||
You must associate the Boundary storage bucket with a third-party storage bucket. A third-party storage bucket contains the bucket name, endpoint URL, optional region, optional prefix, and the service account credentials needed to access the bucket.
|
||||
|
||||
- A service account and access keys for the storage provider
|
||||
|
||||
You must provide service account access keys when you configure a Boundary storage bucket later on.
|
||||
|
||||
Refer to your storage provider's documentation to learn how to set up a service account.
|
||||
|
||||
- The storage bucket must be configured with R/W access. If you use a
|
||||
restricted IAM user policy, the following policy actions must be allowed at a minimum.
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Action": [
|
||||
"s3:PutObject",
|
||||
"s3:GetObject",
|
||||
"s3:GetObjectAttributes",
|
||||
"s3:DeleteObject"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": "arn:aws:s3:::test-session-recording-bucket/*"
|
||||
},
|
||||
{
|
||||
"Action": "s3:ListBucket",
|
||||
"Effect": "Allow",
|
||||
"Resource": "arn:aws:s3:::test-session-recording-bucket"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
### Hitachi Content Platform configuration
|
||||
|
||||
HashiCorp has tested and confirmed that you can configure the Hitachi Content Platform for external session recording storage using the MinIO plugin.
|
||||
It is included as an example in this topic.
|
||||
You should be able to configure other S3-compliant storage providers to work for session recording storage as well, but we have not tested other providers.
|
||||
|
||||
You must have an account with Hitachi Content Platform to create storage buckets.
|
||||
You can sign up for an account at the following URL:
|
||||
|
||||
[https://trycontent.hitachivantara.com](https://trycontent.hitachivantara.com)
|
||||
|
||||
When you sign up for an account, Hitachi sends you the details you need to connect to the instance including the endpoint, S3 access key ID, and S3 secret key.
|
||||
Log in to Hitachi's S3 console to create a storage bucket, and make a note of the bucket's name.
|
||||
|
||||
In Boundary, set the following environment variables using your Hitachi credentials and the name of the bucket:
|
||||
|
||||
```
|
||||
export BUCKET_NAME=<YOUR_HITACHI_BUCKET_NAME>
|
||||
export STORAGE_ACCESS_KEY_ID=<YOUR_HITACHI_ACCESS_KEY_ID>
|
||||
export STORAGE_SECRET_ACCESS_KEY=<YOUR_HITACHI_SECRET_KEY>
|
||||
```
|
||||
|
||||
<Note>
|
||||
|
||||
Credential rotation is not supported for Hitachi Content Platform.
|
||||
|
||||
</Note>
|
||||
|
||||
## Resources
|
||||
|
||||
Refer to your S3-compliant storage provider's documentation for more information about configuring storage buckets and service accounts.
|
||||
|
||||
## Next steps
|
||||
|
||||
After you configure the external storage provider, you can [create the storage bucket](/boundary/docs/configuration/session-recording/create-storage-bucket) in Boundary.
|
||||
Loading…
Reference in new issue