Object Storage

Amazon S3 and Amazon S3 Compatible Storage Providers

Set the following configuration in your aws-supplemental-values.yaml Helm configuration file or storage-values.yaml Helm configuration file.

You can configure secret references in the aws-secrets.yaml file, the storage-secrete.yaml file, or directly on the cluster.

Beginning with the 2025-11 release, fileingestioncdc adds the following parameters.

Connecting Services to S3 through IAM

Assign an IAM role to connect services to Amazon S3. Configure service accounts and IAM role annotations in your Helm values file.

• Create a service account for each service by setting serviceAccount.create: true in your Helm values.

  Note Flink services do not require this configuration. The Flink Operator manages the service account.
• Create an IAM policy with the following statement:

  "Action": [
    "s3:PutObject",
    "s3:ListBucket",
    "s3:GetObject",
    "s3:DeleteObject",
    "s3:AbortMultipartUpload"
  ],
  "Effect": "Allow",
  "Resource": [
    "<s3_bucket_ARN>/*",
    "<s3_bucket_ARN>"
  ]

  Note The <s3_bucket_ARN> placeholder represents the Amazon Resource Name for the S3 bucket of the service.
• Create an IAM role that applies the IAM policy.
  Note Most IAM roles use the following naming convention: <release-name>-<service-name>-role. For example, systemlink-feedservice-role. Flink services share the same configuration as the Flink Operator and use: <release-name>-flink-role.

assetservicecdc:
  highAvailability:
    storage:
      s3:
        authType: "AWS_IAM"

flinkoperator:
  flink-kubernetes-operator:
    jobServiceAccount:
      annotations:
        eks.amazonaws.com/role-arn: "arn:aws:iam::<account-id>:role/<release-name>-flink-role"

dataframeservice:
  storage:
    s3:
      authType: "AWS_IAM"
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: "arn:aws:iam::<account-id>:role/<release-name>-dataframeservice-role"

dataframeservice:
  sldremio:
    distStorage:
      aws:
        authentication: "metadata"

dataframeservice:
  sldremio:
    storage:
      s3:
        authType: "EC2_METADATA"
        roleArn: "arn:aws:iam::<account-id>:role/<release-name>-dataframeservice-role"

feedservice:
  storage:
    s3:
      authType: "AWS_IAM"
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: "arn:aws:iam::<account-id>:role/<release-name>-feedservice-role"

fileingestion:
  storage:
    s3:
      authType: "AWS_IAM"
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: "arn:aws:iam::<account-id>:role/<release-name>-fileingestion-role"

fileingestioncdc:
  highAvailability:
    storage:
      s3:
        authType: "AWS_IAM"

flinkoperator:
    flink-kubernetes-operator:
      jobServiceAccount:
        annotations:
          eks.amazonaws.com/role-arn: "arn:aws:iam::<account-id>:role/<release-name>-flink-role"

nbexecservice:
  storage:
    s3:
      authType: "AWS_IAM"
  serviceAccount:
    annotations:
      eks.amazonaws.com/role-arn: "arn:aws:iam::<account-id>:role/<release-name>-executions-role"

systemscdc:
  highAvailability:
    storage:
      s3:
        authType: "AWS_IAM"

flinkoperator:
  flink-kubernetes-operator:
    jobServiceAccount:
      annotations:
        eks.amazonaws.com/role-arn: "arn:aws:iam::<account-id>:role/<release-name>-flink-role"

Configuring Dremio Authentication for S3

Dremio requires authentication for two S3 storage paths.

• Data storage — The DataFrame Service S3 bucket that stores table data. Dremio accesses this bucket through EC2 instance metadata by assuming the DataFrame Service IAM role.
• Distributed storage — A separate S3 bucket used by Dremio for query coordination and caching. Beginning with the 2026-05 release, NI recommends authenticating distributed storage through the EKS pod identity. For earlier releases, or when pod identity is not available, use EC2 metadata authentication.

Complete the following steps to configure Dremio authentication.

1. Ensure that the trust policy for the DataFrame Service IAM role allows both of the following principals.
   • The EKS pod identity agent (pods.eks.amazonaws.com) must have the sts:AssumeRole permission and the sts:TagSession permission.
   • The EC2 node group role that runs Dremio pods must have the sts:AssumeRole permission.
   Note The DataFrame Service role requires the EC2 node group role as a trusted principal. Dremio accesses the DataFrame Service S3 bucket by assuming this role through EC2 metadata authentication. If you created the DataFrame Service role following Connecting Services to S3 through IAM, update the trust policy to include the EC2 node group role ARN.
2. Grant the IAM role for the EC2 node group that runs Dremio pods permission to assume the DataFrame Service IAM role. To grant this permission, add the following statement to the role policy for the node group.

   {
     "Action": [
       "sts:AssumeRole"
     ],
     "Effect": "Allow",
     "Resource": "<dataframeservice_role_ARN>"
   }

3. Set dataframeservice.storage.s3.authType to AWS_IAM.
4. Set dataframeservice.sldremio.storage.s3.authType to EC2_METADATA.
5. Set dataframeservice.sldremio.storage.s3.roleArn to the DataFrame Service IAM role ARN.
6. Configure the distributed storage authentication using one of the following options.

   Table 36. Options for Configuring Distributed Storage Authentication

   Option	Steps
   EKS Pod Identity Note NI recommends this option	Create a Dremio distributed storage IAM role. Create an IAM policy with the following statements. Add a statement to allow global S3 bucket discovery. { "Action": [ "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*" } Add a statement to allow access to the distributed storage bucket. { "Action": [ "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Effect": "Allow", "Resource": [ "<distributed_storage_bucket_ARN>", "<distributed_storage_bucket_ARN>/*" ] } Create the IAM role with a trust policy that allows the EKS pod identity agent (pods.eks.amazonaws.com) with sts:AssumeRole and sts:TagSession permissions. Attach the IAM policy to the role. Create EKS pod identity associations between the Dremio distributed storage role, the dremio-coordinator service account, and the dremio-executor service account. Set dataframeservice.sldremio.distStorage.aws.authentication to podIdentity.
   EC2 Metadata Note Use this option when pod identity is not available	Add a statement to the role policy for the EC2 node group to allow global S3 bucket discovery. { "Action": [ "s3:GetBucketLocation", "s3:ListAllMyBuckets" ], "Effect": "Allow", "Resource": "arn:aws:s3:::*" } Add a statement to the EC2 node group role policy to allow access to the distributed storage bucket. { "Action": [ "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Effect": "Allow", "Resource": [ "<distributed_storage_bucket_ARN>", "<distributed_storage_bucket_ARN>/*" ] } Note If the DataFrame Service S3 bucket and Dremio distributed storage bucket are the same, use the same bucket ARN in the following areas. The role policy of the DataFrame Service. The previous statements. Set dataframeservice.sldremio.distStorage.aws.authentication to metadata.

7. If your S3 buckets use SSE-KMS encryption, ensure that the following roles have kms:GenerateDataKey and kms:Decrypt permissions on the KMS key.
   • DataFrame Service IAM role
   • Dremio distributed storage role
     Note If your distributed storage authentication uses EC2 Metadata, set the EC2 node group role.
8. Remove the Dremio S3 access key configuration from the secrets when using IAM-based authentication.

For security reasons, NI recommends running Dremio on a dedicated node group.

To use EC2 metadata authentication from pods, you must have an Instance Metadata Service (IMDS) hop limit greater than 1. A hop limit greater than or equal to 2 allows pods to retrieve credentials in addition to the node.

Connecting Services to S3 using Access Keys

Connect your services to S3 through access keys in the following scenarios.

• S3-compatible storage providers — Only Amazon S3 supports IAM role-based authentication. For other S3 compatible providers, use access key authentication.
• AWS deployments without an IAM role configuration — If Pod Identity and IRSA are not available, you can use access key authentication.

feedservice:
  storage:
    s3:
      secretName: "feeds-s3-credentials"
      accessKeyIdName: "aws-access-key-id"
      accessKeyName: "aws-secret-access-key"
      authType: "ACCESS_KEY"
      bucket: "systemlink-feeds"
      scheme: "https://"
      host: "s3.amazonaws.com"
      port: 443
      region: "us-east-1"

feedservice:
  secrets:
    s3:
      accessKeyId: "<your-access-key-id>"
      accessKey: "<your-secret-access-key>"

The same pattern applies to other services when IAM authentication is not available.

Azure Blob Storage Providers

Set the following configuration in your azure-supplemental-values.yaml Helm configuration file or storage-values.yaml Helm configuration file.

You can configure secret references in the azure-secrets.yaml file, the storage-secrets.yaml file, or directly on the cluster.

Connecting Services to Azure Blob Storage

To configure Azure Blob Storage authentication, you must configure both the values file and the secrets file.

Configure Azure Blob Storage authentication using the values file and secrets file.

In your azure-supplemental-values.yaml or storage-values.yaml file, specify the Azure storage parameters.

feedservice:
  storage:
    type: "azure"
    azure:
      accountName: "<your-azure-storage-account-name>"
      blobApiHost: "blob.core.windows.net"

In your azure-secrets.yaml file, provide the access credentials.

feedservice:
  secrets:
    azure:
      accessKey: "<your-azure-storage-access-key>"

The same pattern applies to other services.

Limits and Cost Considerations for File Storage

To adjust limits and cost considerations for file storage services, refer to the following configurations.