level=info ts=2025-10-03T08:34:52.296662765Z caller=retention.go:80 msg="marking block for deletion" blockID=9ed07faa-275d-495d-b211-61ed48b0f271 tenantID=single-tenant

level=error ts=2025-10-03T08:34:52.351880904Z caller=retention.go:83 msg="failed to mark block compacted during retention" blockID=9ed07faa-275d-495d-b211-61ed48b0f271 tenantID=single-tenant err="error copying obj meta to compacted obj meta: User: arn:aws:sts::123456789:assumed-role/role-name/session is not authorized to perform: s3:PutObject on resource: \"arn:aws:s3:::bucket-name/single-tenant/9ed07faa-275d-495d-b211-61ed48b0f271/meta.compacted.json\" with an explicit deny in a resource-based policy"

storage:
    trace:
      backend: s3
      s3:
        bucket: bucket-name
        endpoint: s3.amazonaws.com
        region: region        
        access_key: ""
        secret_key: ""
        insecure: false
        sse:
          type: SSE-KMS
          kms_key_id: 1234-1234-1234-1234-1234
        tags: 
          creator: tempo
      wal:
        path: /tmp/tempo/wal

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyUnencryptedUploads",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::bucket-name/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    },
    {
      "Sid": "DenyWrongKey",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::bucket-name/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:region:123456789:key/1234-1234-1234-1234-1234"
        }
      }
    }
  ]
}