Vertesia Documentation

Amazon S3 Integration

Introduction

The Amazon S3 integration provides in-place access to binaries stored in S3 as Vertesia content objects.

Vertesia uses Workload Identity Federation to access AWS services and act as an OIDC Identity Provider for AWS.

In practice this means that Vertesia presents a Vertesia-generated, cryptographically-signed token (JWT), that is verified by AWS Secure Token Service, and then STS issues in exchange a short lived access token that assign the role and permissions defined in the AWS configuration.

This guide describes the process of configuring AWS to let Vertesia access external S3 buckets from other organizations.

Configure OIDC Provider

Folllow the Amazon Bedrock documentation to configure Vertesia as an OIDC Provider and then come back to continue with this guide.

On the provider you already configured for Bedrock, add a new audience: blobs.

If you don’t want to configure access to Bedrock then you just need to configure the OIDC provider with the blobs audience.

Create IAM Role for S3

  • Go to IAM, select Roles
  • Create a new Role (e.g. Vertesia Blobs)
  • Select Web Identity as Trusted Entity Type, select the newly created sts.vertesia.io Identity Provider, and blobs as audience.
  • Add the following Condition:

    • Key: sts.vertesia.io:sub

    • Condition StringEqual

    • Value: project:ORG_ID:PROJECT_ID
      You need to replace the values ORG_ID with your Vertesia Organization ID, and PROJECT_ID with the Project ID in Vertesia that will access S3. If you want to let all projects from your Vertesia organization access S3, then you can use * for the project ID.
      Note: if you use “*” then you should use StringLike as operator.

      Examples:

    • A single project given its ID is allowed: project:<YOUR_ORG_ID>:<YOUR_PROJECT_ID>

    • All projects from the organization are allowed: project:<YOUR_ORG_ID>:*

  • Enter a Role Name, and you can review and Create Role
  • Select the new role created, and take note of the Role ARN now displayed.
    Example: arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:role/<YOUR_IAM_ROLE_NAME>

Role Policy

You need to attach a policy to your role. The minimal configuration for a policy to access s3 a bucket is:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRoleWithWebIdentity",
                "s3:Get*",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::/*"
        }
    ]
}

Note that sts:AssumeRoleWithWebIdentity is required. Action s3:ListBucket is optional, but required for AWS SDK checksums for presigned URLs .

Configure the Vertesia Project

You need now to configure the project you want to use to access blobs in S3 by specifying the role ARN you created at the previous step.

Go to Settings > Integrations

Enable the AWS integration and paste the role ARN you previously created then click on Save.

Create Content Objects from S3 blobs

To create a content object from a S3 blob you can use the operations

POST “https://<content-store-server>/api/v1/objects”

With a payload like the following one:

{
  name: "my-photo",
  content: {
    source: "s3://vertesia-test/my-photo.jpg#eu-north-1",
    name: "my-photo.jpg",
    type: "image/jpeg",
  },
}

You can also add a type property as a sibling of the name property if you already know the type of the object to create. If you don’t add a type, then Vertesia will figure out the type to use.

Important Note

In the example above the blob URI is ending with a #eu-north-1 hash. This is used to specify the region of the bucket, otherwise if no region is specified S3 will fail.

Was this page helpful?