Chapter 4. Choose a LokiStack storage backend

Selecting the right object storage backend is critical for LokiStack performance, cost, and reliability. As a cluster administrator, you must confirm that your choice meets your log volume and retention requirements.

¹ CA bundle required when using: custom endpoints with self-signed certificates, VPC endpoints with internal CAs, or private link configurations with custom certificate chains. Not required when using standard public cloud endpoints with publicly trusted certificates.

² Ceph RGW (RADOS Gateway) is also known as NooBaa in Rook implementations of OpenShift Data Foundation.

³ CA bundle required when using self-signed certificates or internal certificate authorities. Not required when using publicly trusted certificates from a recognized CA.

⁴ S3 Compatible storage includes NetApp StorageGRID, Cloudian HyperStore, and other S3-compatible providers.

Key considerations:

The credentials used to access S3-compatible object storage must have specific permissions to allow LokiStack to read, write, and manage log data.

Required S3 API permissions

The following S3 API permissions are required for LokiStack to function correctly:

Example IAM policy for AWS S3

If using Amazon S3, create an IAM policy with the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::<bucket_name>"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:GetObjectTagging",
        "s3:PutObjectTagging"
      ],
      "Resource": "arn:aws:s3:::<bucket_name>/*"
    }
  ]
}

Replace <bucket_name> with your actual S3 bucket name.

Permissions for S3-compatible storage

For S3-compatible storage providers (NetApp StorageGRID, Cloudian HyperStore, and others), ensure the access credentials have equivalent permissions to the S3 API operations listed above. The exact configuration method varies by storage provider.

Consult your storage provider’s documentation for: