[release v2.2] Backport https://github.com/cortexproject/cortex/pull/4897 to fix IDM…

tempodb/backend/s3/awssdkauth.go

@@ -0,0 +1,40 @@
+package s3
+
+import (
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/defaults"
+	mcreds "github.com/minio/minio-go/v7/pkg/credentials"
+	"github.com/pkg/errors"
+)
+
+func NewAWSSDKAuth(region string) *AWSSDKAuth {
+	dc := defaults.Config().WithRegion(region)
+	creds := defaults.CredChain(dc, defaults.Handlers())
+	return &AWSSDKAuth{
+		creds: creds,
+	}
+}
+
+// AWSSDKAuth retrieves credentials from the aws-sdk-go.
+type AWSSDKAuth struct {
+	creds *credentials.Credentials
+}
+
+// Retrieve retrieves the keys from the environment.
+func (a *AWSSDKAuth) Retrieve() (mcreds.Value, error) {
+	val, err := a.creds.Get()
+	if err != nil {
+		return mcreds.Value{}, errors.Wrap(err, "retrieve AWS SDK credentials")
+	}
+	return mcreds.Value{
+		AccessKeyID:     val.AccessKeyID,
+		SecretAccessKey: val.SecretAccessKey,
+		SessionToken:    val.SessionToken,
+		SignerType:      mcreds.SignatureV4,
+	}, nil
+}
+
+// IsExpired returns if the credentials have been retrieved.
+func (a *AWSSDKAuth) IsExpired() bool {
+	return a.creds.IsExpired()
+}

tempodb/backend/s3/s3.go

@@ -356,6 +356,7 @@ func createCore(cfg *Config, hedge bool) (*minio.Core, error) {
 	}
 
 	creds := credentials.NewChainCredentials([]credentials.Provider{
+		wrapCredentialsProvider(NewAWSSDKAuth(cfg.Region)),
 		wrapCredentialsProvider(&credentials.EnvAWS{}),
 		wrapCredentialsProvider(&credentials.Static{
 			Value: credentials.Value{