grafana tempo sigv4 support for prometheus backend?

Question

Can grafana tempo backend sign (sigv4) it's request that it sends to aws prometheus (AMP)?

metrics_generator:
  registry:
    external_labels:
      source: tempo
      cluster: example
  storage:
    path: /tmp/tempo/generator/wal
    remote_write:
      - url: https://aps-workspaces.eu-central-1.amazonaws.com/workspaces/ws-2354ezthd34w4ter/api/v1/remote_write
        send_exemplars: true

Or is there a proxy server that can be run in the middle between tempo and prometheus that does the signing job?

Answer 1

aws-sigv4-proxy solves this issue for me.

docker run --name sigv4proxy -ti --rm \
--network=host \
public.ecr.aws/aws-observability/aws-sigv4-proxy:1.6.1 \
-v --name aps --region eu-central-1 \
--host aps-workspaces.eu-central-1.amazonaws.com

Now tempo can use localhost to access AMP (aws managed prometheus)

  storage:
    path: /tmp/tempo/generator/wal
    remote_write:
      - url: http://localhost:8080/workspaces/ws-1d8a668e-382b-4c49-9354-ad099f2b6260/api/v1/remote_write #http://prometheus:9090/api/v1/write
        send_exemplars: true