diff --git a/examples/byob-sse-s3/README.md b/examples/byob-sse-s3/README.md index faa1a7e6..e5f81fde 100644 --- a/examples/byob-sse-s3/README.md +++ b/examples/byob-sse-s3/README.md @@ -4,7 +4,7 @@ Weights & Biases can connect to a S3 bucket created and owned by the customer. This is called BYOB (Bring your own bucket). More details (here)[https://docs.wandb.ai/guides/hosting/data-security/secure-storage-connector]. -This example does not deploy a Weights & Biases instance. It deploys all required resourfces (S3 bucket and permissions) in the customers account and grants the W&B AWS account access to the bucket and the KMS key. +This example does not deploy a Weights & Biases instance. It deploys all required resources (S3 bucket and permissions) in the customer's account and grants the W&B AWS account access to them. This module uses AE256 Encryption to protect the object store. @@ -55,54 +55,4 @@ Do not configure a KMS key on the object store. Your configuration should look l ### Creating S3 Bucket -Lastly, you'll need to create the S3 bucket. Make sure to enable CORS access. Your CORS configuration should look like the following: - -```xml - - - - * - GET - HEAD - PUT - * - ETag - 3000 - - -``` - -As stated above, server side encryption will be handled via SSE-S3 encryption with AE256. - -Finally, grant the Weights & Biases Deployment account access to this S3 bucket: - -```json -{ - "Version": "2012-10-17", - "Id": "WandBAccess", - "Statement": [ - { - "Sid": "WAndBAccountAccess", - "Effect": "Allow", - "Principal": { "AWS": "arn:aws:iam::830241207209:root" }, - "Action": [ - "s3:GetObject*", - "s3:GetEncryptionConfiguration", - "s3:ListBucket", - "s3:ListBucketMultipartUploads", - "s3:ListBucketVersions", - "s3:AbortMultipartUpload", - "s3:DeleteObject", - "s3:PutObject", - "s3:GetBucketCORS", - "s3:GetBucketLocation", - "s3:GetBucketVersioning" - ], - "Resource": [ - "arn:aws:s3:::", - "arn:aws:s3:::/*" - ] - } - ] -} -``` +Please refer to the (public documentation)[https://docs.wandb.ai/guides/hosting/data-security/secure-storage-connector#provision-the-kms-key] on how to create all required resources manually. \ No newline at end of file diff --git a/examples/byob/README.md b/examples/byob/README.md index b14dc92c..be9854ba 100644 --- a/examples/byob/README.md +++ b/examples/byob/README.md @@ -4,7 +4,7 @@ Weights & Biases can connect to a S3 bucket created and owned by the customer. This is called BYOB (Bring your own bucket). More details (here)[https://docs.wandb.ai/guides/hosting/data-security/secure-storage-connector]. -This example does not deploy a Weights & Biases instance. It deploys all required resourfces (S3 bucket, KMS and permissions) in the customers account and grants the W&B AWS account access to the bucket and the KMS key. +This example does not deploy a Weights & Biases instance. It deploys all required resources (S3 bucket, KMS key and permissions) in the customer's account and grants the W&B AWS account access to them. --- diff --git a/modules/secure_storage_connector/README.md b/modules/secure_storage_connector/README.md index 2112ec03..27382705 100644 --- a/modules/secure_storage_connector/README.md +++ b/modules/secure_storage_connector/README.md @@ -4,7 +4,7 @@ Weights & Biases can connect to a S3 bucket created and owned by the customer. This is called BYOB (Bring your own bucket). More details (here)[https://docs.wandb.ai/guides/hosting/data-security/secure-storage-connector]. -This example does not deploy a Weights & Biases instance. It deploys all required resourfces (S3 bucket, KMS and permissions) in the customers account and grants the W&B AWS account access to the bucket and the KMS key. +This example does not deploy a Weights & Biases instance. It deploys all required resources (S3 bucket, KMS key and permissions) in the customer's account and grants the W&B AWS account access to them. ---