> ## Documentation Index
> Fetch the complete documentation index at: https://arize-ax.mintlify.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Private image link access via AWS S3

> Enable AWS bucket access permissions to view private images in Arize

<Info>
  If your S3 images are encrypted using the [AWS managed KMS encryption key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk), please reach out to [support@arize.com](mailto:support@arize.com) for more assistance.
</Info>

## **Step 1. Ingest Embeddings Using Links To Your Private S3 Bucket**

Add private S3 image URLs or URIs in the `link_to_data_column_name` ([Python Pandas](/ax/machine-learning/machine-learning/api-reference-ml/python-sdk/arize-pandas/embeddingcolumnnames)) or `link_to_data` ([Python Single Record](/ax/machine-learning/machine-learning/api-reference-ml/python-sdk/arize-log/embedding) or any Data Connector in the UI).

Once you upload to Arize, navigate to the 'Embeddings' tab to enable bucket access in S3. Click 'View Bucket Policy' to uncover bucket access information.

<Frame caption="Click View Bucket Policy To Get Started">
  <img src="https://storage.googleapis.com/arize-phoenix-assets/assets/images/arize-docs-images/92fe08ee-image.jpeg" />
</Frame>

**Note**: `Link to data` currently only supports links to image files. Learn more about ingesting image data on the Computer Vision model type page.

<Card href="/ax/machine-learning/computer-vision/use-cases-cv/computer-vision-cv" arrow="true">Image Classification </Card>

## **Step 2. AWS Bucket Access Permissions**

Tag your bucket with the key `arize-integration-key`, the provided tag value, and AWS Policy.

<Frame caption="AWS Bucket Access Policy">
  <img src="https://storage.googleapis.com/arize-phoenix-assets/assets/images/arize-docs-images/984d8519-image.jpeg" />
</Frame>

### **Add Proof Of Ownership: Bucket Tag**

**In Arize:** Copy the `arize-integration-key` value

<Frame caption="Arize Integration Key & Value">
  <img src="https://storage.googleapis.com/arize-phoenix-assets/assets/images/arize-docs-images/bff4e2d8-image.jpeg" />
</Frame>

**In AWS Console:** Navigate to your S3 bucket -> Properties -> Edit Bucket Tags

<Frame caption="Navigate To Your Bucket Tags">
  <img src="https://storage.googleapis.com/arize-phoenix-assets/assets/images/arize-docs-images/623639f2-image.jpeg" />
</Frame>

**In AWS Console:** Set tag Key = `arize-integration-key` and Value as the value copied from the Arize UI

<Frame caption="Add Arize Key Name & Value In S3">
  <img src="https://storage.googleapis.com/arize-phoenix-assets/assets/images/arize-docs-images/129002ae-image.jpeg" />
</Frame>

### **Enable Bucket Access: AWS Policy**

**In Arize UI:** Copy the AWS policy from the Arize UI

<Frame caption="AWS Policy to Copy and Paste to AWS S3">
  <img src="https://storage.googleapis.com/arize-phoenix-assets/assets/images/arize-docs-images/ac12ea98-image.jpeg" />
</Frame>

\*\*In the AWS console: \*\*Navigate to your S3 bucket -> Permission -> Edit Bucket Policy

<Frame caption="Add/Edit bucket policy">
  <img src="https://storage.googleapis.com/arize-phoenix-assets/assets/images/arize-docs-images/05f821e4-image.jpeg" />
</Frame>

\*\*In the AWS console: \*\*Paste AWS policy from Arize UI and edit the bucket name in the `resource` field

<Frame caption="Add Access Policy To AWS From Arize">
  <img src="https://storage.googleapis.com/arize-phoenix-assets/assets/images/arize-docs-images/bd1bbbb8-image.jpeg" />
</Frame>

## **Step 3. Configure Encryption Key Access**

S3 objects can be encrypted in several different ways:

* If your image objects are encrypted using the [default AWS managed S3-SSE encryption method](https://docs.aws.amazon.com/AmazonS3/latest/userguide/specifying-s3-encryption.html), proceed to Step 4.

* If your image objects are encrypted using the [AWS managed KMS encryption key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk)[,](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk)please reach out to [support@arize.com](mailto:support@arize.com) for assistance.

* If your image objects are encrypted using your own [customer managed KMS key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk), perform the following steps:

  * Navigate to the KMS page on the AWS console.

  * Select the key in question.

  * Scroll to the bottom of the page, and click on the "Add other AWS accounts" button.

  * Enter in the account id that appears in the instructions above. (i.e. `arn:aws::<account_id>`) and save your changes.

  <Frame caption="">
    <img src="https://storage.googleapis.com/arize-phoenix-assets/assets/images/arize-docs-images/17f9f2d2-image.jpeg" />
  </Frame>

  * For more information on configuring other AWS account access to a customer managed key, see the[AWS documentation for other account KMS encryption key access](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external-accounts.html#cross-account-console).

## **Step 4. Reload Page!**

Reload the Arize UI to load your image data!