Vertesia Documentation

Amazon S3 Integration

Introduction

The Amazon S3 integration provides in-place access to binaries stored in S3 as Vertesia content objects.

Vertesia uses Workload Identity Federation to access AWS services and act as an OIDC Identity Provider for AWS.

In practice this means that Vertesia presents a Vertesia-generated, cryptographically-signed token (JWT), that is verified by AWS Secure Token Service, and then STS issues in exchange a short lived access token that assign the role and permissions defined in the AWS configuration.

This guide describes the process of configuring AWS to let Vertesia access external S3 buckets from other organizations.

Configure OIDC Provider

Follow the Amazon Bedrock documentation to configure Vertesia as an OIDC Provider and then come back to continue with this guide.

On the provider you already configured for Bedrock, add a new audience: blobs

If you don’t want to configure access to Bedrock, then you just need to configure the OIDC provider with the blobs audience.

Create IAM Role for S3

  • Go to IAM, select Roles

  • Create a new Role (e.g. Vertesia Blobs)

  • Select Web Identity as the Trusted Entity Type, select sts.vertesia.io as the Identity Provider, and select blobs as the audience.

  • Add the following Condition:

    • Key: sts.vertesia.io:sub
    • Condition: StringEquals
    • Value: project:<YOUR_ORG_ID>:<YOUR_PROJECT_ID>

    You need to replace the values <YOUR_ORG_ID> with your Vertesia Organization ID, and <YOUR_PROJECT_ID> with the Project ID in Vertesia that will access S3. If you want to let all projects from your Vertesia organization access S3, then you can use * for the project ID. If you use *, then use the StringLike as operator as the condition.

    • Example for allowing a single project: project:<YOUR_ORG_ID>:<YOUR_PROJECT_ID>
    • Example for allowing all projects from the organization: project:<YOUR_ORG_ID>:*

  • Select Create inline policy

    You need to attach a policy to your role. A minimal configuration for a policy to access an S3 bucket is below. Note that the sts:AssumeRoleWithWebIdentity action is required. The s3:ListBucket action is optional, but required for AWS SDK checksums for presigned URLs.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRoleWithWebIdentity",
                "s3:Get*",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::/*"
        }
    ]
}
  • Enter a Role Name, review, and select Create Role.
  • Select the new role created, and take note of the Role ARN now displayed.
    • Example: arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:role/<YOUR_IAM_ROLE_NAME>

Configure the Vertesia Project

You need now to configure the project you want to use to access blobs in S3 by specifying the role ARN you created at the previous step.

Go to Settings > Integrations

Enable the AWS integration, paste the role ARN you previously created and click on Save.

Create Content Objects from S3 blobs

To create a content object from an S3 blob, use the create object operation with a payload like the following one:

{
  name: "my-photo",
  content: {
    source: "s3://vertesia-test/my-photo.jpg#eu-north-1",
    name: "my-photo.jpg",
    type: "image/jpeg",
  },
}

You can also add a type property as a sibling of the name property if you already know the type of the object to create. If you don’t add a type, then Vertesia will figure out the type to use.

Important Note

In the example above the blob URI is ending with a #eu-north-1 hash. This is used to specify the region of the bucket, otherwise if no region is specified S3 will fail.

Was this page helpful?