Understanding Sentry Relay Modes for Enterprise Data Security

Relay can run in several primary modes, which are stored in the configuration file under the relay.mode field. The field determines whether Relay operates in managed, static, or proxy mode, and it controls how Relay obtains project settings for processing events.

managed mode is only available for commercial and enterprise plans. https://sentry.io/pricing/

In Sentry, event handling is configured based on project and organization settings. Some settings, such as privacy controls, are defined at the organization level and inherited by all projects; each project also has its own settings. Relay processes events according to the inherited project settings of the event’s destination.

Relay periodically refreshes its configuration by polling Sentry. Sentry does not need to see your Relay. For details on intervals, timeouts, and retries, see the configuration options.

https://docs.sentry.io/product/relay/options/

Managed Mode

Managed

is the default mode for Relay. Because the settings are fetched from Sentry, authentication is required in this mode. If authentication fails, Relay will reject all events.

When Relay receives an event from your application, it requests the project settings from Sentry to process the event. If Sentry cannot provide settings for a specific project, all data for that project is discarded.

To activate managed mode, set the following configuration:

relay:
  mode: managed

Static Mode

In static mode, projects must be configured manually. Relay will only process events for projects defined in the static configuration and will reject events for all other projects.

This mode is useful when you know the project that will send events and need explicit control over which projects the Relay forwards events for.

In static mode, Relay does not register upstream because it does not query upstream information. After processing events for configured projects, it forwards them upstream together with the client authentication information (DSN).

To activate static mode, set the following configuration:

relay:
  mode: static

To configure projects, add files in the projects/<PROJECT_ID>.json format to the Relay configuration folder. See the project configuration documentation for details.

https://docs.sentry.io/product/relay/projects/

Proxy Mode

Proxy

mode is similar to static mode but forwards events from unknown projects. In this mode, handling of events for statically configured projects is the same as in static mode. Events from projects without static configuration are minimally processed and forwarded (proxied).

Rate limiting still applies to all projects in proxy mode, whether they are statically configured or proxied.

To activate proxy mode, set the following configuration:

relay:
  mode: proxy