quay · stevsmit · Jun 24, 2026
diff --git a/modules/config-fields-storage-aws.adoc b/modules/config-fields-storage-aws.adoc
@@ -1,6 +1,6 @@
 :_mod-docs-content-type: CONCEPT
 [id="supported-aws-storage-backends"]
 = Supported AWS storage backends

 {productname} supports multiple Amazon Web Services (AWS) storage backends:

@@ -33,7 +33,7 @@
    - default
 # ...
 ----
 <1> The `S3Storage` storage driver should only be used for AWS S3 buckets. Note that this differs from general S3 access, where the RadosGW driver or other storage services can be used. For an example, see "Example B: Using RadosGW with general S3 access".
 <2> The Amazon Web Services region. Defaults to `us-east-1`.

 [id="config-fields-storage-aws-sts"]
@@ -61,11 +61,35 @@
    - default
 # ...
 ----
 <1> The unique Amazon Resource Name (ARN). 
 <2> The generated AWS S3 user access key.
 <3> The generated AWS S3 user secret key.
 <4> The Amazon Web Services region. Defaults to `us-east-1`.
 
+[id="config-fields-storage-aws-sts-cco"]
+== AWS S3 storage with Operator STS and CCO
+
+On STS-enabled AWS clusters, including {product-rosa} and OpenShift Dedicated, the {productname} Operator can provision short-lived credentials through the Cloud Credential Operator when you set the IAM role ARN on the Operator subscription and use unmanaged object storage. Use the `S3Storage` driver without `s3_access_key` or `s3_secret_key` in the config bundle.
+
+.AWS S3 storage with Operator STS example
+[source,yaml]
+----
+# ...
+DISTRIBUTED_STORAGE_CONFIG:
+  default:
+    - S3Storage
+    - host: s3.<region>.amazonaws.com
+      s3_bucket: <s3_bucket_name>
+      s3_region: <region>
+      storage_path: /datastorage/registry
+DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
+DISTRIBUTED_STORAGE_PREFERENCE:
+  - default
+# ...
+----
+
+For installation and IAM role setup, see link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/red_hat_quay_operator_features/index#configuring-quay-sts-cco-s3-storage[Configuring AWS S3 storage with STS and the Cloud Credential Operator].
+
 [id="aws-cloudfront-storage-example"]
 == AWS CloudFront storage
 
@@ -76,8 +100,8 @@
 [NOTE]
 ====
 * When configuring AWS Cloudfront storage, the following conditions must be met for proper use with {productname}:
 ** You must set an *Origin path* that is consistent with {productname}'s storage path as defined in your `config.yaml` file. Failure to meet this require results in a `403` error when pulling an image. For more information, see link:https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginPath[Origin path].
 ** You must configure a link:https://docs.aws.amazon.com/whitepapers/latest/secure-content-delivery-amazon-cloudfront/s3-origin-with-cloudfront.html[*Bucket policy*] and a link:https://docs.aws.amazon.com/AmazonS3/latest/userguide/cors.html[*Cross-origin resource sharing (CORS)*] policy. 
 ====

 .Cloudfront S3 example YAML
@@ -127,5 +151,5 @@
 }

 ----
 <1> The identifier, or account ID, of the AWS account that owns the CloudFront OAI and S3 bucket.
 <2> The CloudFront Origin Access Identity (OAI) that accesses the S3 bucket. 

diff --git a/modules/configuring-aws-sts-quay.adoc b/modules/configuring-aws-sts-quay.adoc
@@ -5,6 +5,9 @@
 [role="_abstract"]
 AWS Security Token Service (STS) is a web service for requesting temporary, limited-privilege credentials for AWS IAM users. You can configure AWS STS with {productname} to authenticate with Amazon S3 using temporary credentials. 
 
-AWS STS enhances security and ensures proper authentication and authorization for object storage access. It is available for standalone {productname} deployments, {productname-ocp}, and {productname} on Red{nbsp}Hat OpenShift Service on AWS (ROSA). AWS STS is useful for clusters using Amazon S3 as an object storage. It allows {productname} to use STS protocols to authenticate with Amazon S3, which can enhance the overall security of the cluster and help to ensure that access to sensitive data is properly authenticated and authorized.
+AWS STS enhances security and ensures proper authentication and authorization for object storage access. It is available for standalone {productname} deployments, {productname-ocp}, {product-rosa}, and OpenShift Dedicated.
 
-Configuring AWS STS for {ocp} or ROSA requires creating an AWS IAM user, creating an S3 role, and configuring your {productname} `config.yaml` file to include the proper resources.
+Use the following approaches depending on your deployment:
+
+* *{ocp}*: Configure `STSS3Storage` with an IAM role ARN and IAM user access keys in your `config.yaml` tile. See link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/red_hat_quay_operator_features/index#configuring-quay-ocp-aws-sts[Configuring {productname-ocp} to use AWS STS].
+* *{product-rosa} or OpenShift Dedicated with CCO (recommended for {producty})*: Set the IAM role ARN on the Operator subscription and configure `S3Storage` without static keys. See link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/red_hat_quay_operator_features/index#configuring-quay-sts-cco-s3-storage[Configuring AWS S3 storage with STS and the Cloud Credential Operator].
diff --git a/modules/configuring-quay-rosa-aws-sts.adoc b/modules/configuring-quay-rosa-aws-sts.adoc
@@ -3,7 +3,12 @@
 = Configuring {productname} on {product-rosa} to use AWS STS
 
 [role="_abstract"]
-To configure your {productname} deployment on {product-rosa} to use AWS STS for S3 authentication, you can update the IAM role trust policy to use federated identity, configure the `config.yaml` file, and annotate the service account with the role ARN. 
+To configure your {productname} deployment on {product-rosa} to use AWS STS for S3 authentication, you can update the IAM role trust policy to use federated identity, configure the `config.yaml` file, and annotate the service account with the role ARN.
+
+[NOTE]
+====
+For {productname} {producty} on STS-enforced clusters, Red Hat recommends link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/red_hat_quay_operator_features/index#configuring-quay-sts-cco-s3-storage[Configuring AWS S3 storage with STS and the Cloud Credential Operator], which uses the Cloud Credential Operator instead of manual service account annotations.
+====
 
 This procedure enables web identity federation for temporary credential authentication.
 

diff --git a/modules/configuring-quay-sts-cco-s3-storage.adoc b/modules/configuring-quay-sts-cco-s3-storage.adoc
@@ -0,0 +1,132 @@
+:_mod-docs-content-type: PROCEDURE
+[id="configuring-quay-sts-cco-s3-storage"]
+= Configuring AWS S3 storage with STS and the Cloud Credential Operator
+
+[role="_abstract"]
+On STS-enabled {ocp} clusters on AWS, including {product-rosa}, and Red Hat OpenShift Dedicated, you can configure {productname-ocp} to use your own S3 bucket without static AWS access keys. Set the IAM role ARN on the {productname} Operator subscription, set `objectstorage` to `unmanaged`, and configure `S3Storage` in the config bundle without `s3_access_key` or `s3_secret_key`. The Operator creates a Cloud Credential Operator (CCO) `CredentialRequest` and mounts short-lived credentials into the `quay-app` pods.
+
+[NOTE]
+====
+This procedure requires {ocp} 4.14 or later on AWS with CCO in STS-compatible mode. It applies only when `objectstorage` is `unmanaged`. If `ROLEARN` is not set on the Operator subscription, existing installations are unchanged.
+====
+
+.Prerequisites
+
+* An STS-enabled AWS cluster ({product-rosa}, OpenShift Dedicated, or self-managed {ocp} on AWS).
+* An IAM role with an OIDC trust policy for the `quay-app` service account and permissions to access your S3 bucket.
+* A `QuayRegistry` with `objectstorage` set to `unmanaged`.
+* Cluster administrator access to install the Operator and edit the `configBundleSecret`.
+
+.Procedure
+
+. Get the cluster `serviceAccountIssuer` value:
++
+[source,terminal]
+----
+$ oc get authentication.config.openshift.io cluster -o jsonpath='{.spec.serviceAccountIssuer}' | sed -e 's|^https://||'
+----
++
+.Example output
+[source,terminal]
+----
+oidc.op1.openshiftapps.com/1234567890
+----
+
+. Create or update the IAM role trust policy so the `quay-app` service account can assume the role. Replace the account ID, OIDC provider path, namespace, and registry name with your values:
++
+[source,json]
+----
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Federated": "arn:aws:iam::<aws_account_id>:oidc-provider/<serviceAccountIssuer>"
+      },
+      "Action": "sts:AssumeRoleWithWebIdentity",
+      "Condition": {
+        "StringEquals": {
+          "<serviceAccountIssuer>:sub": "system:serviceaccount:<quay_namespace>:<registry_name>-quay-app"
+        }
+      }
+    }
+  ]
+}
+----
+
+. Attach an IAM policy that grants the S3 permissions required by {productname}, including `s3:GetObject`, `s3:PutObject`, `s3:DeleteObject`, `s3:ListBucket`, `s3:GetBucketLocation`, `s3:ListBucketMultipartUploads`, `s3:AbortMultipartUpload`, and `s3:ListMultipartUploadParts`.
+
+. Install or upgrade the {productname} Operator and set the **Role ARN** field to your IAM role ARN. The Operator exposes this field when AWS token authentication is enabled on the cluster. Alternatively, set the `ROLEARN` environment variable on the Operator subscription.
+
+. Configure your `QuayRegistry` with unmanaged object storage:
++
+[source,yaml]
+----
+apiVersion: quay.redhat.com/v1
+kind: QuayRegistry
+metadata:
+  name: <registry_name>
+  namespace: <quay_namespace>
+spec:
+  components:
+    - kind: objectstorage
+      managed: false
+  configBundleSecret: <config_bundle_secret_name>
+----
+
+. Update the `config.yaml` file in your `configBundleSecret` to use `S3Storage` without static credentials:
++
+[source,yaml]
+----
+# ...
+DISTRIBUTED_STORAGE_CONFIG:
+  default:
+    - S3Storage
+    - host: s3.<region>.amazonaws.com
+      s3_bucket: <s3_bucket_name>
+      s3_region: <region>
+      storage_path: /datastorage/registry
+DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
+DISTRIBUTED_STORAGE_PREFERENCE:
+  - default
+# ...
+----
++
+[IMPORTANT]
+====
+Do not set `s3_access_key` or `s3_secret_key` in the config bundle when using the Operator STS path. If static AWS keys are present while `ROLEARN` is set, the Operator sets `RolloutBlocked` with reason `ConflictingCredentials`.
+====
+
+. Wait for the Operator to create and provision the CCO `CredentialRequest`. Verify the request and secret:
++
+[source,terminal]
+----
+$ oc get credentialsrequest -n <quay_namespace>
+----
++
+[source,terminal]
+----
+$ oc get secret <registry_name>-quay-app-aws -n <quay_namespace>
+----
+
+. Verify the `QuayRegistry` is available and not blocked:
++
+[source,terminal]
+----
+$ oc get quayregistry <registry_name> -n <quay_namespace> -o jsonpath='{.status.conditions[?(@.type=="Available")].status}{"\n"}'
+----
++
+If the `QuayRegistry` resource is unavailable, check for the following conditions:
++
+`CredentialRequestNotProvisioned`:: CCO has not yet provisioned credentials, or the IAM role or trust policy is misconfigured. Verify the `CredentialRequest` status and IAM role configuration.
++
+`ConflictingCredentials`:: Remove `s3_access_key` and `s3_secret_key` from `DISTRIBUTED_STORAGE_CONFIG` in the config bundle.
+
+. Push and pull an image to confirm S3 access through STS credentials.
+
+[role="_additional-resources"]
+.Additional resources
+
+* link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/configure_red_hat_quay/index#config-fields-storage-aws-sts-cco[AWS S3 storage with Operator STS and CCO]
+* link:https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws/4/html/authentication_and_authorization/assuming-an-aws-iam-role-for-a-service-account[Assuming an AWS IAM role for a service account on {product-rosa}]
diff --git a/modules/new-features-and-enhancements-quay-ocp-318.adoc b/modules/new-features-and-enhancements-quay-ocp-318.adoc
@@ -4,5 +4,13 @@
 
 The following updates have been made to {productname-ocp}.
 
-[id="example_one"]
-== Example one
+[id="operator-sts-cco-unmanaged-s3"]
+== AWS STS authentication for unmanaged S3 storage on {product-rosa} and OpenShift Dedicated
+
+The {productname} Operator integrates with the {ocp} Cloud Credential Operator (CCO) so that `quay-app` pods can authenticate to AWS S3 without static access keys when `objectstorage` is set to `unmanaged`. This supports STS-enforced clusters, including {product-rosa} and OpenShift Dedicated, where IAM-role-only policies prohibit long-lived credentials.
+
+When you set the IAM role ARN on the Operator subscription (`ROLEARN`), the Operator detects STS-capable AWS clusters, creates a `CredentialRequest`, and mounts CCO-provisioned credentials into `quay-app` pods. Configure `S3Storage` in the config bundle with bucket and region details only — do not include `s3_access_key` or `s3_secret_key`.
+
+If `ROLEARN` is not set, existing installations are unchanged. The Operator blocks rollout with actionable conditions when credentials conflict or CCO provisioning fails.
+
+For more information, see link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/red_hat_quay_operator_features/index#configuring-quay-sts-cco-s3-storage[Configuring AWS S3 storage with STS and the Cloud Credential Operator].
diff --git a/modules/new-quay-config-fields-318.adoc b/modules/new-quay-config-fields-318.adoc
@@ -2,4 +2,13 @@
 [id="new-quay-config-fields-318"]
 = {productname} configuration fields updates and changes
 
-The following configuration fields have been added to {productname} 3.18.
+The following configuration fields have been added or changed in {productname} 3.18.
+
+[id="s3storage-sts-cco-no-static-keys"]
+== S3Storage configuration without static AWS keys on {productname-ocp}
+
+When you use the Operator STS and CCO integration on STS-enabled AWS clusters, configure `DISTRIBUTED_STORAGE_CONFIG` with the `S3Storage` driver and omit `s3_access_key` and `s3_secret_key`. The Operator supplies credentials through the CCO-provisioned secret mounted at `/var/run/secrets/cloud/credentials`.
+
+This differs from the `STSS3Storage` driver used with static IAM user keys in standalone or generic {ocp} deployments. Do not combine static AWS keys in the config bundle with the Operator `ROLEARN` setting.
+
+For configuration steps, see link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/configure_red_hat_quay/index#config-fields-storage-aws-sts-cco[AWS S3 storage with Operator STS and CCO] and link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/red_hat_quay_operator_features/index#configuring-quay-sts-cco-s3-storage[Configuring AWS S3 storage with STS and the Cloud Credential Operator].
diff --git a/red_hat_quay_operator_features/master.adoc b/red_hat_quay_operator_features/master.adoc
@@ -100,6 +100,7 @@ include::modules/configuring-aws-sts-quay.adoc[leveloffset=+1]
 include::modules/creating-iam-user-aws-sts-quay.adoc[leveloffset=+2]
 include::modules/creating-s3-role-aws-sts.adoc[leveloffset=+2]
 
+include::modules/configuring-quay-sts-cco-s3-storage.adoc[leveloffset=+2]
 include::modules/configuring-quay-ocp-aws-sts.adoc[leveloffset=+2]
 include::modules/configuring-quay-rosa-aws-sts.adoc[leveloffset=+2]
 

diff --git a/release_notes/master.adoc b/release_notes/master.adoc
@@ -34,7 +34,7 @@ endif::downstream[]
 include::modules/rn_overview.adoc[leveloffset=+1]
 include::modules/rn-3-18-0.adoc[leveloffset=+2]
 include::modules/new-features-and-enhancements-318.adoc[leveloffset=+3]
-//include::modules/new-features-and-enhancements-quay-ocp-318.adoc[leveloffset=+3]
+include::modules/new-features-and-enhancements-quay-ocp-318.adoc[leveloffset=+3]
 include::modules/new-quay-config-fields-318.adoc[leveloffset=+3]
 include::modules/new-api-endpoints-318.adoc[leveloffset=+3]
 //include::modules/notable-technical-changes-318.adoc[leveloffset=+3]