S3 Evidence Vault
Configure S3 storage for scheduled artifact uploads. Every artifact lands under a date/type/source key, so evidence is easy to find and audit.
Authentication Methods
Three ways to authenticate, in order of preference:
IAM Role (recommended)
Attach an IAM role to the node instance profile. No credentials to manage.
IRSA (EKS)
Use IAM Roles for Service Accounts on EKS for pod-level credentials.
Kubernetes Secret
Create a secret with AWS credentials:
Where the Secret Lives
The agent reads the credentials secret from the scanned pod's own namespace, never the agent's, and there's no override flag. This is a deliberate boundary: a node agent that could read secrets in any namespace would let any S3-opted-in pod reach any secret in the cluster.
So every namespace that uses S3 export needs its own copy of the secret. The annotations pick the secret's name; the namespace is fixed.
Annotation Configuration
Configure S3 settings via pod or namespace annotations:
| Annotation | Description |
|---|---|
| reel.io/s3-bucket | S3 bucket name |
| reel.io/s3-region | AWS region |
| reel.io/s3-secret | Name of Kubernetes secret with AWS credentials (always read from the workload's own namespace, see below) |
When settings collide, the most specific wins: CLI flags > pod annotations > namespace annotations. See Scheduling for details.
Complete Example
S3 Key Pattern
Artifacts are organized in S3 with the following key structure:
| Type | Extension |
|---|---|
| sbom, cbom, volatile, metadata, malware | .json |
| checkpoint, layer, frame, memory | .tar.zst or .core.zst |