Bring your own bucket (BYOB)

1. Provision the KMS Key

   W&B requires you to provision a KMS Key to encrypt and decrypt the data on the S3 bucket. The key usage type must be ENCRYPT_DECRYPT. Assign the following policy to the key:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid" : "Internal",
         "Effect" : "Allow",
         "Principal" : { "AWS" : "<Your_Account_Id>" },
         "Action" : "kms:*",
         "Resource" : "<aws_kms_key.key.arn>"
       },
       {
         "Sid" : "External",
         "Effect" : "Allow",
         "Principal" : { "AWS" : "<aws_principal_and_role_arn>" },
         "Action" : [
           "kms:Decrypt",
           "kms:Describe*",
           "kms:Encrypt",
           "kms:ReEncrypt*",
           "kms:GenerateDataKey*"
         ],
         "Resource" : "<aws_kms_key.key.arn>"
       }
     ]
   }
   

   Replace <Your_Account_Id> and <aws_kms_key.key.arn> accordingly.

   If you are using SaaS Cloud or Dedicated cloud, replace <aws_principal_and_role_arn> with the corresponding value:

   • For SaaS Cloud: arn:aws:iam::725579432336:role/WandbIntegration
   • For Dedicated cloud: arn:aws:iam::830241207209:root

   This policy grants your AWS account full access to the key and also assigns the required permissions to the AWS account hosting the W&B Platform. Keep a record of the KMS Key ARN.

2. Provision the S3 Bucket

   Follow these steps to provision the S3 bucket in your AWS account:

   1. Create the S3 bucket with a name of your choice. Optionally create a folder which you can configure as sub-path to store all W&B files.

   2. Enable server side encryption, using the KMS key from the previous step.

   3. Configure CORS with the following policy:

      [
        {
            "AllowedHeaders": [
                "*"
            ],
            "AllowedMethods": [
                "GET",
                "HEAD",
                "PUT"
            ],
            "AllowedOrigins": [
                "*"
            ],
            "ExposeHeaders": [
                "ETag"
            ],
            "MaxAgeSeconds": 3000
        }
      ]
      

      If data in your bucket expires due to an object lifecycle management policy, you may lose the ability to read the history of some runs.

   4. Grant the required S3 permissions to the AWS account hosting the W&B Platform, which requires these permissions to generate pre-signed URLs that AI workloads in your cloud infrastructure or user browsers utilize to access the bucket.

      {
        "Version": "2012-10-17",
        "Id": "WandBAccess",
        "Statement": [
          {
            "Sid": "WAndBAccountAccess",
            "Effect": "Allow",
            "Principal": { "AWS": "<aws_principal_and_role_arn>" },
              "Action" : [
                "s3:GetObject*",
                "s3:GetEncryptionConfiguration",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads",
                "s3:ListBucketVersions",
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:PutObject",
                "s3:GetBucketCORS",
                "s3:GetBucketLocation",
                "s3:GetBucketVersioning"
              ],
            "Resource": [
              "arn:aws:s3:::<wandb_bucket>",
              "arn:aws:s3:::<wandb_bucket>/*"
            ]
          }
        ]
      }
      

      Replace <wandb_bucket> accordingly and keep a record of the bucket name. If you are using Dedicated cloud, share the bucket name with your W&B team in case of instance level BYOB. In case of team level BYOB on any deployment type, configure the bucket while creating the team.

      If you are using SaaS Cloud or Dedicated cloud, replace <aws_principal_and_role_arn> with the corresponding value.

      • For SaaS Cloud: arn:aws:iam::725579432336:role/WandbIntegration
      • For Dedicated cloud: arn:aws:iam::830241207209:root

For more details, see the AWS self-managed hosting guide.

If you’re connecting to a cloud-native storage bucket in another cloud or to an S3-compatible storage bucket like MinIO for team-level BYOB in your Dedicated cloud or Self-managed instance, refer to Cross-cloud or S3-compatible storage for team-level BYOB. In such cases, you must specify the storage bucket using the GORILLA_SUPPORTED_FILE_STORES environment variable for your W&B instance, before you configure it for a team using the instructions below.

To configure a storage bucket at the team level when you create a W&B Team:

1. Provide a name for your team in the Team Name field.

2. Select External storage for the Storage type option.

3. Choose either New bucket from the dropdown or select an existing bucket.

   Multiple W&B Teams can use the same cloud storage bucket. To enable this, select an existing cloud storage bucket from the dropdown.

4. From the Cloud provider dropdown, select your cloud provider.

5. Provide the name of your storage bucket for the Name field. If you have a Dedicated cloud or Self-managed instance on Azure, provide the values for Account name and Container name fields.

6. (Optional) Provide the bucket sub-path in the optional Path field. Do this if you would not like W&B to store any files in a folder at the root of the bucket.

7. (Optional if using AWS bucket) Provide the ARN of your KMS encryption key for the KMS key ARN field.

8. (Optional if using Azure bucket) Provide the values for the Tenant ID and the Managed Identity Client ID fields.

9. (Optional on SaaS Cloud) Optionally invite team members when creating the team.

10. Press the Create Team button.

An error or warning appears at the bottom of the page if there are issues accessing the bucket or the bucket has invalid settings.