Private Image Link Access Via AWS S3

Enable AWS bucket access permissions to view private images in Arize

If your S3 images are encrypted using the AWS managed KMS encryption key, please reach out to [e-mail] for more assistance.

Step 1. Ingest Embeddings Using Links To Your Private S3 Bucket

Add private S3 image URLs or URIs in the link_to_data_column_name (Python Pandas) or link_to_data (Python Single Record or any Data Connector in the UI).

Once you upload to Arize, navigate to the 'Embeddings' tab to enable bucket access in S3. Click 'View Bucket Policy' to uncover bucket access information.

Click View Bucket Policy To Get Started

Note: Link to data currently only supports links to image files. Learn more about ingesting image data on the Computer Vision model type page.

pageImage Classification

Step 2. AWS Bucket Access Permissions

Tag your bucket with the key arize-integration-key, the provided tag value, and AWS Policy.

AWS Bucket Access Policy

Add Proof Of Ownership: Bucket Tag

In Arize: Copy the arize-integration-key value

Arize Integration Key & Value

In AWS Console: Navigate to your S3 bucket -> Properties -> Edit Bucket Tags

Navigate To Your Bucket Tags

In AWS Console: Set tag Key = arize-integration-key and Value as the value copied from the Arize UI

Add Arize Key Name & Value In S3

Enable Bucket Access: AWS Policy

In Arize UI: Copy the AWS policy from the Arize UI

AWS Policy to Copy and Paste to AWS S3

In the AWS console: Navigate to your S3 bucket -> Permission -> Edit Bucket Policy

Add/Edit bucket policy

In the AWS console: Paste AWS policy from Arize UI and edit the bucket name in the resource field

Add Access Policy To AWS From Arize

Step 3. Configure Encryption Key Access

S3 objects can be encrypted in several different ways:

• If your image objects are encrypted using the default AWS managed S3-SSE encryption method, proceed to Step 4.

• If your image objects are encrypted using the AWS managed KMS encryption key, please reach out to [e-mail] for assistance.

• If your image objects are encrypted using your own customer managed KMS key, perform the following steps:

  • Navigate to the KMS page on the AWS console.

  • Select the key in question.

  • Scroll to the bottom of the page, and click on the "Add other AWS accounts" button.

  • Enter in the account id that appears in the instructions above. (i.e. arn:aws::<account_id>) and save your changes.

  

  • For more information on configuring other AWS account access to a customer managed key, see the AWS documentation for other account KMS encryption key access.

Step 4. Reload Page!

Reload the Arize UI to load your image data!