# How to config temporal S3 authentication in temporal helm chart?

**URL:** <https://community.temporal.io/t/how-to-config-temporal-s3-authentication-in-temporal-helm-chart/7245>\
**Category:** Community Support\
**Tags:** s3\
**Created:** [February 12, 2023, 10:27am UTC](https://community.temporal.io/t/how-to-config-temporal-s3-authentication-in-temporal-helm-chart/7245 "2023-02-12T10:27:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jalal\_zivari](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/jalal_zivari/32/3312_2.png) [@jalal\_zivari](https://community.temporal.io/u/jalal_zivari)\
**Post date:** [February 12, 2023, 10:27am UTC](https://community.temporal.io/t/how-to-config-temporal-s3-authentication-in-temporal-helm-chart/7245/1 "2023-02-12T10:27:21Z")

</div>

I installed temporal using helm chart from below link:

> **[GitHub - temporalio/helm-charts: Temporal Helm charts](https://github.com/temporalio/helm-charts)**
>
> Temporal Helm charts. Contribute to temporalio/helm-charts development by creating an account on GitHub.

**helm command was:**

#helmstage upgrade --install -f values/values.archival.s3.yaml -f values/values.mysql.yaml temporal-test . -n test

everything was ok and service deployed successfully.

then i updated values/values.archival.s3.yaml as below:

```auto
server:
  archival:
    history:
      state: "enabled"
      enableRead: true
      provider:
        s3store:
          region: "default"
          endpoint: "http://ceph-infra-s3:8080"
          s3ForcePathStyle: true
    visibility:
      state: "enabled"
      enableRead: true
      provider:
        s3store:
          region: "default"
          endpoint: "http://ceph-infra-s3:8080"
          s3ForcePathStyle: true

  namespaceDefaults:
    archival:
      history:
        state: "enabled"
        URI: "s3://temporal-development"
      visibility:
        state: "enabled"
        URI: "s3://temporal-development"

```

but i don’t now how and where can i config s3 authentication accesskey and secretkey.

should i create a secret? if yes where can i use the created secret ?

---

<div class="post-metadata">

**Author:** ![tihomir](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/tihomir/32/6580_2.png) [@tihomir](https://community.temporal.io/u/tihomir)\
**Post date:** [February 13, 2023, 3:20pm UTC](https://community.temporal.io/t/how-to-config-temporal-s3-authentication-in-temporal-helm-chart/7245/3 "2023-02-13T15:20:15Z")

</div>

Hi, authentication is not exposed via config directly and you’d have to set it up via AWS apis (env var option is probably the easiest), see [here](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials). Also [this](https://community.temporal.io/t/inject-host-access-key-and-secret-to-temporal-s3-archiver/3473) older forum post might help.

---

<div class="post-metadata">

**Author:** ![jalal\_zivari](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/jalal_zivari/32/3312_2.png) [@jalal\_zivari](https://community.temporal.io/u/jalal_zivari)\
**Post date:** [February 14, 2023, 7:34am UTC](https://community.temporal.io/t/how-to-config-temporal-s3-authentication-in-temporal-helm-chart/7245/5 "2023-02-14T07:34:08Z")

</div>

Thank you for your reply.  
Where should I set these environments?  
Should I set them in Kubernetes pods, for example?

---

<div class="post-metadata">

**Author:** ![tihomir](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/tihomir/32/6580_2.png) [@tihomir](https://community.temporal.io/u/tihomir)\
**Post date:** [February 14, 2023, 5:11pm UTC](https://community.temporal.io/t/how-to-config-temporal-s3-authentication-in-temporal-helm-chart/7245/6 "2023-02-14T17:11:38Z")

</div>

> Should I set them in Kubernetes pods

That should work (via env/envFrom fields in your pod config). Let us know if you run into issues with that.

---

<div class="post-metadata">

**Author:** ![jalal\_zivari](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/jalal_zivari/32/3312_2.png) [@jalal\_zivari](https://community.temporal.io/u/jalal_zivari)\
**Post date:** [February 20, 2023, 7:11am UTC](https://community.temporal.io/t/how-to-config-temporal-s3-authentication-in-temporal-helm-chart/7245/7 "2023-02-20T07:11:51Z")

</div>

I set it but it didn’t work  
I got this error when I tried to create a new namespace  
#tctl --namespace default namespace register --retention 30

Error: Register namespace operation failed.  
Error Details: rpc error: code = Unknown desc = NoCredentialProviders: no valid providers in chain. Deprecated.  
For verbose messaging see aws.Config.CredentialsChainVerboseErrors

---

<div class="post-metadata">

**Author:** ![tihomir](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/tihomir/32/6580_2.png) [@tihomir](https://community.temporal.io/u/tihomir)\
**Post date:** [February 20, 2023, 3:17pm UTC](https://community.temporal.io/t/how-to-config-temporal-s3-authentication-in-temporal-helm-chart/7245/8 "2023-02-20T15:17:19Z")

</div>

I’m not sure, did you try using the shared credentials file options? This seems not Temporal issue but maybe something with aws go sdk, see for example [here](https://github.com/aws/aws-sdk-go/issues/2914).