This release contains 5 PRs from 2 authors. Thank you!

Changelog

3.2.5

[CHANGE] Alertmanager: Enforce that SNS receivers provide explicit credentials (access key and secret key) by default. This prevents malicious users from creating a SNS receiver with a custom URL that then receives the Alertmanager's AWS credentials. The existing behaviour can be restored by setting -alertmanager.require-explicit-sns-credentials=false. #17320
[CHANGE] Alertmanager: Reject SNS receivers that set use_aws_http_client. The AWS SDK HTTP client does not use the Alertmanager receivers firewall, so this setting could be used to reach addresses blocked by -alertmanager.receivers-firewall-block-private-addresses or -alertmanager.receivers-firewall-block-cidr-networks. #17320
[CHANGE] Alertmanager: Enforce restrictions on tenant configuration when loading configuration from storage, not just when receiving it via API. This ensures that new restrictions introduced cannot be circumvented by existing config. Existing tenants' configuration that fails validation can be exempted from this restriction with -alertmanager.tenants-exempt-from-config-validation-for-existing-config. #17320

All changes in this release: mimir-3.2.4...mimir-3.2.5