STS and Custom Cloudwatch Endpoints

[mrazavi32]

Does the Cloudwatch exporter support the use of temp credentials/Security Token Service and C2S endpoints (non-public AWS endpoints)?

[jscheid]

I'm pretty sure it doesn't. Would you accept a PR that adds this feature?

[brian-brazil]

Per https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.html it should be possible via file.

[jscheid]

Thanks for the link but I can't see immediately what you're referring to. I'd like to point at a custom http URL, but I think https://github.com/prometheus/cloudwatch_exporter/blob/cbe73e796998012504485bc3f01298b6403d4615/src/main/java/io/prometheus/cloudwatch/CloudWatchCollector.java#L225 means that the URL is always derived from the region and always using https. Am I missing something?

[or-shachar]

@jscheid is this still an issue? would like to elaborate a little more?

[matthiasr]

I am wary of allowing users to override (potentially security relevant) endpoints. Under what circumstances is this necessary? The exporter uses a few different APIs; would the user have to provide URLs to all of them, or is there any higher-level setting that would allow achieving this intention less verbosely?