--- title: "Amazon S3 Integration" source: "https://docs.vertesiahq.com/integrations/s3" markdown: "https://docs.vertesiahq.com/llms/integrations/s3.md" --- # Amazon S3 Integration ## Introduction The Amazon S3 integration provides in-place access to binaries stored in S3 as Vertesia content objects. Vertesia uses Workload Identity Federation to access AWS services and act as an OIDC Identity Provider for AWS. In practice this means that Vertesia presents a Vertesia-generated, cryptographically-signed token (JWT), that is verified by AWS Secure Token Service, and then STS issues in exchange a short lived access token that assign the role and permissions defined in the AWS configuration. **This guide describes** the process of configuring AWS to let Vertesia access external S3 buckets from other organizations. ## Configure OIDC Provider Folllow the [Amazon Bedrock documentation](/environments/aws#configure-oidc-provider) to configure Vertesia as an OIDC Provider and then come back to continue with this guide. On the provider you already configured for Bedrock, add a new audience: **blobs**. If you don’t want to configure access to Bedrock then you just need to configure the OIDC provider with the **blobs** audience. ## Create IAM Role for S3 * Go to IAM, select Roles * Create a new Role (e.g. *Vertesia Blobs*) * Select Web Identity as Trusted Entity Type, select the newly created sts.vertesia.io Identity Provider, and **blobs** as audience. * Add the following Condition: * Key: sts.vertesia.io:sub * Condition StringEqual * Value: project:ORG\_ID:PROJECT\_ID You need to replace the values ORG\_ID with your Vertesia Organization ID, and PROJECT\_ID with the Project ID in Vertesia that will access S3. If you want to let all projects from your Vertesia organization access S3, then you can use *\** for the project ID. **Note:** if you use “*\*”* then you should use *StringLike* as operator. **Examples:** * A single project given its ID is allowed: project:\:\ * All projects from the organization are allowed: project:\:\* * Enter a Role Name, and you can review and **Create Role** * Select the new role created, and take note of the Role ARN now displayed. **Example:** arn:aws:iam::\:role/\ ### Role Policy You need to attach a policy to your role. The minimal configuration for a policy to access s3 a bucket is: ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "sts:AssumeRoleWithWebIdentity", "s3:Get*", "s3:ListBucket" ], "Resource": "arn:aws:s3:::/*" } ] } ``` **Note** that `sts:AssumeRoleWithWebIdentity` is required. Action `s3:ListBucket` is optional, but required for AWS SDK checksums for presigned URLs . ## Configure the Vertesia Project You need now to configure the project you want to use to access blobs in S3 by specifying the role ARN you created at the previous step. Go to **Settings \> Integrations** Enable the AWS integration and paste the role ARN you previously created then click on **Save**. ![][image1] ## Create Content Objects from S3 blobs To create a content object from a S3 blob you can use the operations **POST “https://\/api/v1/objects”** With a payload like the following one: ```javascript { name: "my-photo", content: { source: "s3://vertesia-test/my-photo.jpg#eu-north-1", name: "my-photo.jpg", type: "image/jpeg", }, } ``` You can also add a **type** property as a sibling of the name property if you already know the type of the object to create. If you don’t add a type, then Vertesia will figure out the type to use. **Important Note** In the example above the blob URI is ending with a **\#eu-north-1** hash. This is used to specify the region of the bucket, otherwise if no region is specified S3 will fail. [image1]: