31:[{"id":"3a89863d8af95c489c63051c11c97fcf5d509bc242ed2d1dae597b5310ac41ccc15a9faa4979a663d7df130f8f25dc15d227bdad83e295a35c19f492a652cf87","href":"https://static.observableusercontent.com/files/3a89863d8af95c489c63051c11c97fcf5d509bc242ed2d1dae597b5310ac41ccc15a9faa4979a663d7df130f8f25dc15d227bdad83e295a35c19f492a652cf87","name":"privtateFileStorageEditTrustPolicy.png","type":"image/png","lastModified":1684853345565.407,"size":322521},{"id":"2e22a370364d279559f0598089aa8b23faa4210c3a2f8597d6d10752ba6a4976b39f9cf2c7662c040bf984cf3a58fca9802c65e1ec8ddb74fba4c50d02474aaf","href":"https://static.observableusercontent.com/files/2e22a370364d279559f0598089aa8b23faa4210c3a2f8597d6d10752ba6a4976b39f9cf2c7662c040bf984cf3a58fca9802c65e1ec8ddb74fba4c50d02474aaf","name":"privateFileStorageReplaceRootArn.png","type":"image/png","lastModified":1684853776057.523,"size":362969},{"id":"30a4a1b3ba97ffc1698212ad6c3e250e262f867b2b148608f65b62909d4281dab11a72b3df000eacc612dbf646251956158c4bb562ec569bc8b22564645f9d5d","href":"https://static.observableusercontent.com/files/30a4a1b3ba97ffc1698212ad6c3e250e262f867b2b148608f65b62909d4281dab11a72b3df000eacc612dbf646251956158c4bb562ec569bc8b22564645f9d5d","name":"privateFileStorageCopyRoleArn.png","type":"image/png","lastModified":1684858617439.893,"size":313615},{"id":"1b09bf46c5dca7b06308bf6cd0dd9678b33c83d31aef9d38c6c91b26c14afdc6ff55edce46dc24113381f429b7ae09f9dcf5a4e7be8b153eeae545250b694e5c","href":"https://static.observableusercontent.com/files/1b09bf46c5dca7b06308bf6cd0dd9678b33c83d31aef9d38c6c91b26c14afdc6ff55edce46dc24113381f429b7ae09f9dcf5a4e7be8b153eeae545250b694e5c","name":"privateFileStorageS3Bucket.png","type":"image/png","lastModified":1684859758040.947,"size":314961},{"id":"1b2ad26ff0b3591154cc3e41b2e15598463fcfe3d1ef6bbc1f66018a2cb3b595790480579d3e4ec11a9016f253299f1e2b6408f14117308ac61702edfc0d4281","href":"https://static.observableusercontent.com/files/1b2ad26ff0b3591154cc3e41b2e15598463fcfe3d1ef6bbc1f66018a2cb3b595790480579d3e4ec11a9016f253299f1e2b6408f14117308ac61702edfc0d4281","name":"privateFileStorageS3Permissions.png","type":"image/png","lastModified":1684860114000.987,"size":233104},{"id":"1f3f6269e50626e9a07e312dad229eaa01b55273af5f6c4753d23634528490cbcca3c0e92b9dc9bfd0cc56530d5a7c238eb98ac37a96f8cab8c81fe5045d04b5","href":"https://static.observableusercontent.com/files/1f3f6269e50626e9a07e312dad229eaa01b55273af5f6c4753d23634528490cbcca3c0e92b9dc9bfd0cc56530d5a7c238eb98ac37a96f8cab8c81fe5045d04b5","name":"privateFileStorageEditCors.png","type":"image/png","lastModified":1684860425099.232,"size":406335},{"id":"1636d94bb723bc656c57f6aac3729c16536af247ea6704416b5a9ccd29bcd839e90328a69d08077a9fb0f8eefcdcfa3888c31cbf51006d16620b5156d50ff921","href":"https://static.observableusercontent.com/files/1636d94bb723bc656c57f6aac3729c16536af247ea6704416b5a9ccd29bcd839e90328a69d08077a9fb0f8eefcdcfa3888c31cbf51006d16620b5156d50ff921","name":"privateFileStoragePolicy3@1.png","type":"image/png","lastModified":1684863100500.751,"size":157653},{"id":"d11cab5f89914933b2fcca9dbbc177c518a6c737163080103d7a63f75a79facb340145a97bdc27114728902fd3d29b2d2eba9bd21ccd7d679f24945c23379559","href":"https://static.observableusercontent.com/files/d11cab5f89914933b2fcca9dbbc177c518a6c737163080103d7a63f75a79facb340145a97bdc27114728902fd3d29b2d2eba9bd21ccd7d679f24945c23379559","name":"privateFileStoragePermissionsTab.png","type":"image/png","lastModified":1684776226255.411,"size":287263},{"id":"3b681fca4dbdfacfd828528bbe888caf74ccc5c20cee4488609de663dc5eab3f08bbe68d968d212d7bd1d81c05794144e3551b76d4feb1dea49e600690c3cdd3","href":"https://static.observableusercontent.com/files/3b681fca4dbdfacfd828528bbe888caf74ccc5c20cee4488609de663dc5eab3f08bbe68d968d212d7bd1d81c05794144e3551b76d4feb1dea49e600690c3cdd3","name":"privateFileStorageCreateBucket.png","type":"image/png","lastModified":1684777605001.745,"size":584686},{"id":"cb1f75dcd7a290806ec1458f80a53157c183c3b404429b02c297d70eb6e279230d53f73cd81a56afada5a110a8fdd6105c06d4377d68f05ac72e0489f838de73","href":"https://static.observableusercontent.com/files/cb1f75dcd7a290806ec1458f80a53157c183c3b404429b02c297d70eb6e279230d53f73cd81a56afada5a110a8fdd6105c06d4377d68f05ac72e0489f838de73","name":"privateFileStorageObsWorkspaceName.png","type":"image/png","lastModified":1685547050109.855,"size":199270},{"id":"43f6c93c4a3a93282f49864e860b41ccd6094e6c26964e302c8d16c513f398739899ce53128e63bebd0d03c22f581fbe9f99d3d40b97f6f281e95ec1c0dd045b","href":"https://static.observableusercontent.com/files/43f6c93c4a3a93282f49864e860b41ccd6094e6c26964e302c8d16c513f398739899ce53128e63bebd0d03c22f581fbe9f99d3d40b97f6f281e95ec1c0dd045b","name":"privateFileStorageNameBucket.png","type":"image/png","lastModified":1684781381871.693,"size":346337},{"id":"556ed6d7ef6ea626e2bbe52acfbdce90bbe1f3b622ca03ae6f66154a3d0c08271a53de7de515e3dd7f1d9f2b5438801eaff3d81e4974839b028ce44851174e6b","href":"https://static.observableusercontent.com/files/556ed6d7ef6ea626e2bbe52acfbdce90bbe1f3b622ca03ae6f66154a3d0c08271a53de7de515e3dd7f1d9f2b5438801eaff3d81e4974839b028ce44851174e6b","name":"privateFileStorageCreateFinal@1.png","type":"image/png","lastModified":1684781791497.623,"size":281211},{"id":"6ec0f5fd6589ac6a43db2d53f0c4881727371c7000c27bf9d1b6dd0528fcacd45d24fa05786ae10b0390080354624b23641324e2c5bcf75fd4a0179779b3b866","href":"https://static.observableusercontent.com/files/6ec0f5fd6589ac6a43db2d53f0c4881727371c7000c27bf9d1b6dd0528fcacd45d24fa05786ae10b0390080354624b23641324e2c5bcf75fd4a0179779b3b866","name":"privateFileStorageSeeBucket.png","type":"image/png","lastModified":1684782375415.117,"size":346050},{"id":"8380d0415e124636efc5b15ccc9c399ca47739768974da177822edbe9fbad0dfe41ebba22abdc66698e5aaba398de18cf8abb8521bc2f9a301627dd24464714c","href":"https://static.observableusercontent.com/files/8380d0415e124636efc5b15ccc9c399ca47739768974da177822edbe9fbad0dfe41ebba22abdc66698e5aaba398de18cf8abb8521bc2f9a301627dd24464714c","name":"privateFileStorageNavIAM.png","type":"image/png","lastModified":1684784012341.026,"size":341100},{"id":"ce48aba088d151824842b3f7c74243d1491f27b928b5d465bbc2e936a724c1309a92bfdcba2cae7668f34b0a0a51bba1e5bb71293cd87c4a312d752d2947de91","href":"https://static.observableusercontent.com/files/ce48aba088d151824842b3f7c74243d1491f27b928b5d465bbc2e936a724c1309a92bfdcba2cae7668f34b0a0a51bba1e5bb71293cd87c4a312d752d2947de91","name":"privateFileStoragePolicy1.png","type":"image/png","lastModified":1684785381030.608,"size":660121},{"id":"2ed79c799af27726f8c20ae3044dfe3bfc45cb794fabadf7ea61775ec23879da30a1f5ad7a23de1df92d5965b823634f153a24282cf5fce32ae0789457b9d6cb","href":"https://static.observableusercontent.com/files/2ed79c799af27726f8c20ae3044dfe3bfc45cb794fabadf7ea61775ec23879da30a1f5ad7a23de1df92d5965b823634f153a24282cf5fce32ae0789457b9d6cb","name":"privateFileStoragePolicy2.png","type":"image/png","lastModified":1684785593499.579,"size":300183},{"id":"77b072cb92b6cd83018d5798e71c722965535eba8727bbbdeb8fdd9bed17a71058de29b70ce78404ab54dd34a8670c7d9f39e9ab2a1509f6abd2d211c19ab343","href":"https://static.observableusercontent.com/files/77b072cb92b6cd83018d5798e71c722965535eba8727bbbdeb8fdd9bed17a71058de29b70ce78404ab54dd34a8670c7d9f39e9ab2a1509f6abd2d211c19ab343","name":"privateFileStoragePolicy4.png","type":"image/png","lastModified":1684786917604.594,"size":401170},{"id":"f05557261967b34a8690721e3f567ebd2e9e90b4e63298263b72ed5b0713955662cf60f8f3b99c00f822874552d4901e6e002a90169ab3d5c359849e44d1338c","href":"https://static.observableusercontent.com/files/f05557261967b34a8690721e3f567ebd2e9e90b4e63298263b72ed5b0713955662cf60f8f3b99c00f822874552d4901e6e002a90169ab3d5c359849e44d1338c","name":"privateFileStoragePolicy5.png","type":"image/png","lastModified":1684787293874.347,"size":350265},{"id":"7059ba7dee9ea092a3c6bf1e356d99ee1f7415893e53630f8896ff620ee7c26e5cc107872036376bbead2701600f8621d9e6df51d168056e9d3b6b765eb9d4be","href":"https://static.observableusercontent.com/files/7059ba7dee9ea092a3c6bf1e356d99ee1f7415893e53630f8896ff620ee7c26e5cc107872036376bbead2701600f8621d9e6df51d168056e9d3b6b765eb9d4be","name":"privateFileStoragePolicy6.png","type":"image/png","lastModified":1684787572857.372,"size":413415},{"id":"fd92894325b86f296872887b2ac62293d91a00324cc1eddcc161f9bbdc6d7d71ef5d57b7e91bf66108106a08803065e9cc133fd8c4622305f0ad25625bb8fd2f","href":"https://static.observableusercontent.com/files/fd92894325b86f296872887b2ac62293d91a00324cc1eddcc161f9bbdc6d7d71ef5d57b7e91bf66108106a08803065e9cc133fd8c4622305f0ad25625bb8fd2f","name":"privateFileStoragePolicy7.png","type":"image/png","lastModified":1684788611172.565,"size":87040},{"id":"8769f05622bb83a6f8a45169e450940bfeb5295f4e977789c10a06c6e405c7be9e14416fdce910c1614af3c58d6d59b3c8d9d47cb41d477bca60f93a50552b44","href":"https://static.observableusercontent.com/files/8769f05622bb83a6f8a45169e450940bfeb5295f4e977789c10a06c6e405c7be9e14416fdce910c1614af3c58d6d59b3c8d9d47cb41d477bca60f93a50552b44","name":"privateFileStoragePolicyCreateRole.png","type":"image/png","lastModified":1684788982577.307,"size":439096},{"id":"3b7fbd215c7ee94650de632f887e4ea5ffff1cba4cd64899e86127b4ee72ff41bd63849216904e5f349c7fb2dc4444bac4de19772697a4ca65929709f1779253","href":"https://static.observableusercontent.com/files/3b7fbd215c7ee94650de632f887e4ea5ffff1cba4cd64899e86127b4ee72ff41bd63849216904e5f349c7fb2dc4444bac4de19772697a4ca65929709f1779253","name":"privateFileStorageolicyTrustedEntityAnotherAws.png","type":"image/png","lastModified":1684789600335.829,"size":307775},{"id":"144ee29b58e54d1a8c34114deec8c4d57a1c14123bf0620deca6272dce552d7a82ef0e05d3885d22e4db3acf2d558aedcedde9fea11fe544f02c44a330cb226b","href":"https://static.observableusercontent.com/files/144ee29b58e54d1a8c34114deec8c4d57a1c14123bf0620deca6272dce552d7a82ef0e05d3885d22e4db3acf2d558aedcedde9fea11fe544f02c44a330cb226b","name":"privateFileStorageRequireExternalID.png","type":"image/png","lastModified":1684790660965.861,"size":297240},{"id":"883e80eafe5bf97044900fb433208ea13c76cd3cbe02a5d1afbb3a18541700cdcccf9600f188c50c5fed57e5bfe6174fae45a03ea93f248d68e58a0cf1a719ab","href":"https://static.observableusercontent.com/files/883e80eafe5bf97044900fb433208ea13c76cd3cbe02a5d1afbb3a18541700cdcccf9600f188c50c5fed57e5bfe6174fae45a03ea93f248d68e58a0cf1a719ab","name":"privateFileStorageFinishCreateRole.png","type":"image/png","lastModified":1684791335761.771,"size":430014},{"id":"12923acbedd22d0f0577848ecba9092cd1cbf9825e2c242366c30baa38570c020123606c372d0330363adf0183778c4312d9b892a527af9b28e895e258a40f12","href":"https://static.observableusercontent.com/files/12923acbedd22d0f0577848ecba9092cd1cbf9825e2c242366c30baa38570c020123606c372d0330363adf0183778c4312d9b892a527af9b28e895e258a40f12","name":"privateFileStorageCreateRoleFinish.png","type":"image/png","lastModified":1684792183569.842,"size":203170},{"id":"2ee15263d273296381081eac9074d61174dc8fdd46b2f45882f79f671e892ce99faeb2782f46fd2e04960d48df4dc9f0feb9ffee763b116bae1bbe1d233e1422","href":"https://static.observableusercontent.com/files/2ee15263d273296381081eac9074d61174dc8fdd46b2f45882f79f671e892ce99faeb2782f46fd2e04960d48df4dc9f0feb9ffee763b116bae1bbe1d233e1422","name":"privateFileStorageSelectRoleName@1.png","type":"image/png","lastModified":1684792461855.427,"size":184151},{"id":"76047d05e4d2238cdeef8bd00c29d14e3814b8c1e46d66bf65a720ef43504e8e149e45126636639c48551ff00c2bfccd79cbd355d509613b88adc91d13bb059b","href":"https://static.observableusercontent.com/files/76047d05e4d2238cdeef8bd00c29d14e3814b8c1e46d66bf65a720ef43504e8e149e45126636639c48551ff00c2bfccd79cbd355d509613b88adc91d13bb059b","name":"privateFileStorageTrustRelationshipsTab.png","type":"image/png","lastModified":1684792566437.677,"size":262518},{"id":"01500d903c5f3571a756319f7674975a003aed55d09dc5a678a8f19763709e1087af6637206fc7578f933290a5c3fb7db3b7d647f49de7f17b728ead2a01f057","href":"https://static.observableusercontent.com/files/01500d903c5f3571a756319f7674975a003aed55d09dc5a678a8f19763709e1087af6637206fc7578f933290a5c3fb7db3b7d647f49de7f17b728ead2a01f057","name":"privateFileStorageChoosePolicyForRole@1.png","type":"image/png","lastModified":1685119139789.342,"size":484171},{"id":"bb9b228de94927ae87d8832318521204d7a819502593371e2837c81cfa87d6ed0c1d337c86b50e349ae2a5cd4705620304f03a5903219ddb61461e72bb4ac447","href":"https://static.observableusercontent.com/files/bb9b228de94927ae87d8832318521204d7a819502593371e2837c81cfa87d6ed0c1d337c86b50e349ae2a5cd4705620304f03a5903219ddb61461e72bb4ac447","name":"privateFileStorageAttachPolicyToRoleNext.png","type":"image/png","lastModified":1685119415589.13,"size":652205},{"id":"a441a6f13972ca289ce951dcdcc3cc9090ef8ae19b89b4d7e9b8202492b1c1e59c93acd25d88090c423d124aeb6b2d41a7ec90cfc974eeedd2773cd8f2ef2fd3","href":"https://static.observableusercontent.com/files/a441a6f13972ca289ce951dcdcc3cc9090ef8ae19b89b4d7e9b8202492b1c1e59c93acd25d88090c423d124aeb6b2d41a7ec90cfc974eeedd2773cd8f2ef2fd3","name":"privateFileStorageObsUISelect.png","type":"image/png","lastModified":1685120186214.149,"size":246839},{"id":"d9009e447db657f97c7ae02acff9af7f2120f35cc0c4c4df5a4b059a1d39ccaea0ed00d45a41e6c9098bce2348dc55590c1e49e033bb98e5ca55cf528ae597c4","href":"https://static.observableusercontent.com/files/d9009e447db657f97c7ae02acff9af7f2120f35cc0c4c4df5a4b059a1d39ccaea0ed00d45a41e6c9098bce2348dc55590c1e49e033bb98e5ca55cf528ae597c4","name":"privateFileStorageObsUI.png","type":"image/png","lastModified":1685120420563.816,"size":78924},{"id":"9910ad2bbb76d5ddf74162e6eef26c4107864927deea4dcffe14b5e0d0667ec7540cd433d99bdd6b379cc2183320f397e0e70df875346b1e582d6e698ee3d1a1","href":"https://static.observableusercontent.com/files/9910ad2bbb76d5ddf74162e6eef26c4107864927deea4dcffe14b5e0d0667ec7540cd433d99bdd6b379cc2183320f397e0e70df875346b1e582d6e698ee3d1a1","name":"privateFileStorageInputRoleArn.png","type":"image/png","lastModified":1685121665966.307,"size":237080},{"id":"e4fbfcf2d6c6e63c526e32027dc0cdd6d1c22d604671ff355bc8817773e012354bc9eccd6d09234535e9ba8d05a2bcb40b8edc41d91d0902a40463cd81980377","href":"https://static.observableusercontent.com/files/e4fbfcf2d6c6e63c526e32027dc0cdd6d1c22d604671ff355bc8817773e012354bc9eccd6d09234535e9ba8d05a2bcb40b8edc41d91d0902a40463cd81980377","name":"privateFileStorageInputBucketNameFilePath.png","type":"image/png","lastModified":1685122114333.084,"size":222828},{"id":"f13e972dfd34f79571409b7fe862330a819548895bbf842178725bdecd23270fd18a32d35ff272bdfb29dbc6d637fe7e2ac0487ac524f7698cecace142aac6b9","href":"https://static.observableusercontent.com/files/f13e972dfd34f79571409b7fe862330a819548895bbf842178725bdecd23270fd18a32d35ff272bdfb29dbc6d637fe7e2ac0487ac524f7698cecace142aac6b9","name":"privateFileStorageObsId.png","type":"image/png","lastModified":1685457379914.484,"size":219150},{"id":"61640f43a4302a5cd79095a44f013643bd837b8a5ea60e5a52a7356c466c8c06a8371b33d88ce23cd5150420ee43ecf626a1ca594d6ce4eb473f7ba887fbd423","href":"https://static.observableusercontent.com/files/61640f43a4302a5cd79095a44f013643bd837b8a5ea60e5a52a7356c466c8c06a8371b33d88ce23cd5150420ee43ecf626a1ca594d6ce4eb473f7ba887fbd423","name":"privateFileStorageExternalId.png","type":"image/png","lastModified":1685457543786.293,"size":219527},{"id":"b9dd3679faa96d69e50c8024776448a29e64186fcb41b444db4925333efa1d71cbbcb3f80fbfb773fe19170d2ccc53ed59ad451c5fbd6245f0113e12c0a30897","href":"https://static.observableusercontent.com/files/b9dd3679faa96d69e50c8024776448a29e64186fcb41b444db4925333efa1d71cbbcb3f80fbfb773fe19170d2ccc53ed59ad451c5fbd6245f0113e12c0a30897","name":"privateFileStorageObsUserArn@1.png","type":"image/png","lastModified":1685457708391.945,"size":221249},{"id":"898fce9a162782721848bf85bf7d021cc27a08863e4131a0342e2cced9a6dc6dc296831ebf1e27d2f9343b67ccd5c547e19d14f774b92ce03b585035ed75bc36","href":"https://static.observableusercontent.com/files/898fce9a162782721848bf85bf7d021cc27a08863e4131a0342e2cced9a6dc6dc296831ebf1e27d2f9343b67ccd5c547e19d14f774b92ce03b585035ed75bc36","name":"privateFileStorageRoleArn.png","type":"image/png","lastModified":1685458083612.915,"size":226592},{"id":"2d6d484650dd2fa95cd8e66bc9bd32e33d501cdd2b84aea3d5a7db706df97b0755dfd12a9879ad09a34881db4aa38ed0e0d85114eebb32db0cb1b0b11dc15cdb","href":"https://static.observableusercontent.com/files/2d6d484650dd2fa95cd8e66bc9bd32e33d501cdd2b84aea3d5a7db706df97b0755dfd12a9879ad09a34881db4aa38ed0e0d85114eebb32db0cb1b0b11dc15cdb","name":"privateFileStorageExtIdObsArn.png","type":"image/png","lastModified":1685458934039.563,"size":230716}] 2f:{"title":"Private file storage setup","cells":[{"id":0,"value":"# Private file storage setup\n${enterprise()}","pinned":false,"hidden":false,"mode":"md"},{"id":705,"value":"## Getting Started","pinned":false,"hidden":false,"mode":"md"},{"id":707,"value":"- [Getting Started](https://observablehq.com/d/e37482aebe866133#cell-705)\n- [Option 1: AWS Management Console instructions](https://observablehq.com/d/e37482aebe866133#cell-7)\n- [Option 2: AWS CLI instructions](https://observablehq.com/d/e37482aebe866133#cell-495)\n","pinned":false,"hidden":false,"mode":"md"},{"id":513,"value":"To begin setting up Private file storage for storing your file attachments to be use with Observable notebooks, first in your Enterprise team's Settings on Observable, choose the Permissions tab on the right navigation bar:","pinned":false,"hidden":false,"mode":"md"},{"id":185,"value":"

\n \n

Select the Permissions tab on the right.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":21,"value":"Next, under the **File storage** section, select the **Store file attachments in a private S3 bucket** option:","pinned":false,"hidden":false,"mode":"md"},{"id":624,"value":"

\n \n

Select the Store file attachments in a private S3 bucket option.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":626,"value":"This opens up the configuration options for the private S3 bucket:","pinned":false,"hidden":false,"mode":"md"},{"id":195,"value":"

\n \n

Configuration options for connecting to your private S3 bucket.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":521,"value":"Most of the rest of the instructions for setup require using either using [specific instructions for the AWS CLI](https://observablehq.com/d/e37482aebe866133#cell-495) or [specific instructions for the AWS Management Console](https://observablehq.com/d/e37482aebe866133#cell-7). Depending upon which way you are comfortable working with AWS, will determine which set of instructions you should use.","pinned":false,"hidden":false,"mode":"md"},{"id":7,"value":"## Option 1: AWS Management Console instructions","pinned":false,"hidden":false,"mode":"md"},{"id":5,"value":"The following instructions will guide you through enabling **Private file storage** using the AWS console. This will enable you to save file attachments in your notebooks to your organization's privately-controlled S3 bucket.","pinned":false,"hidden":false,"mode":"md"},{"id":30,"value":"In AWS Management Console, create a new S3 bucket or choose one you would like to use for storing your team's Observable notebook file attachments:","pinned":false,"hidden":false,"mode":"md"},{"id":207,"value":"

\n \n

Select the Create bucket button.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":229,"value":"Name your bucket by entering a name into the **Bucket name** text box:","pinned":false,"hidden":false,"mode":"md"},{"id":231,"value":"

\n \n

Name your new bucket.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":235,"value":"Then, after scrolling to the bottom of the page, finish creating the bucket by selecting the **Create bucket** button:","pinned":false,"hidden":false,"mode":"md"},{"id":241,"value":"

\n \n

Select the Create bucket button.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":249,"value":"You should now see your bucket listed in the **S3>Buckets** page:","pinned":false,"hidden":false,"mode":"md"},{"id":252,"value":"

\n \n

Your bucket in the S3>Buckets page.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":33,"value":"Next, navigate to Identity and Access Management (IAM) in the console:","pinned":false,"hidden":false,"mode":"md"},{"id":262,"value":"

\n \n

Navigate to IAM.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":273,"value":"Select **Policies** from the left-side navigation bar and then select the **Create Policy** button:","pinned":false,"hidden":false,"mode":"md"},{"id":267,"value":"

\n \n

Select the Policies tab, followed by selecting the Create Policy button.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":36,"value":"Select the **JSON** tab:","pinned":false,"hidden":false,"mode":"md"},{"id":275,"value":"

\n \n

Choose the JSON tab.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":38,"value":"Next, copy the following policy text into the **Policy editor** text box:","pinned":false,"hidden":false,"mode":"md"},{"id":49,"value":"viewof policyText = snippet(\"Copy policy text to clipboard\", `{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"VisualEditor0\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"s3:PutObject\",\n \"s3:GetObject\",\n \"s3:DeleteObject\",\n \"s3:PutObjectTagging\",\n \"s3:GetObjectTagging\"\n ],\n \"Resource\": \"arn:aws:s3::://*\"\n },\n {\n \"Sid\": \"VisualEditor1\",\n \"Effect\": \"Allow\",\n \"Action\": \"s3:GetBucketLocation\",\n \"Resource\": \"arn:aws:s3:::\"\n }\n ]\n}`)","pinned":false,"hidden":false,"mode":"ojs"},{"id":69,"value":"Replace `` with the name of the bucket you have selected in both places where it come up in the policy. Similarly, replace `` with the folder wherein you'd like to have your files stored. Note the bucket name and file path for use [later in these instructions](https://observablehq.com/d/e37482aebe866133#cell-451).","pinned":false,"hidden":false,"mode":"md"},{"id":283,"value":"

\n \n

Replace <bucket_name> and <file_path> with your information.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":71,"value":"Select the **Next** button at the bottom right-hand part of the page:","pinned":false,"hidden":false,"mode":"md"},{"id":297,"value":"

\n \n

Select the Next button.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":76,"value":"Enter a name for the policy in the **Name** text box and then select the **Create policy** button:","pinned":false,"hidden":false,"mode":"md"},{"id":302,"value":"

\n \n

Enter a name for your policy and then select the Create policy button.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":310,"value":"You should see your new policy in the **Policies** list:","pinned":false,"hidden":false,"mode":"md"},{"id":305,"value":"

\n \n

Your new policy in the Policies list.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":320,"value":"note(htl.html`Note: To review the policy, you can always click the + button next to the policy name in the list.`)","pinned":false,"hidden":false,"mode":"ojs"},{"id":81,"value":"Now, let's navigate to the **Roles** tab in the left-hand navigation menu:","pinned":false,"hidden":false,"mode":"md"},{"id":329,"value":"

\n \n

Navigate to **Roles** in the left-hand side navigation bar.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":83,"value":"Select the **Create Role** button there in the upper right-hand corner:","pinned":false,"hidden":false,"mode":"md"},{"id":346,"value":"

\n \n

Select the Create role button in the upper right-hand corner.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":85,"value":"Select **AWS Account** under the **Trusted Entity Type** and choose **Another AWS account** under the **An AWS account** section:","pinned":false,"hidden":false,"mode":"md"},{"id":352,"value":"

\n \n

Select AWS account under Trusted entity type and Another AWS account under An AWS account.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":89,"value":"Next, enter the Observable account ID in the **Account ID** text box under **Another AWS account**. The Observable account ID is shown in instructions for setting up your private bucket, which were revealed when you selected the **Use a private bucket** option in your team's **Settings>Permissions** in Observable.","pinned":false,"hidden":false,"mode":"md"},{"id":359,"value":"

\n \n

Get the Observable account ID from your team's Settings>Permissions in Observable.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":91,"value":"Select **Require external ID** under **Options**:","pinned":false,"hidden":false,"mode":"md"},{"id":371,"value":"

\n \n

Select the Require external ID option from the Options section.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":94,"value":"Now enter the external ID in the **External ID** text box. Again, you will find this in the instructions for setting up your private bucket, which were revealed when you selected the **Use a private bucket** option in your team's **Settings>Permissions** in Observable:","pinned":false,"hidden":false,"mode":"md"},{"id":373,"value":"

\n \n

Get the External ID from your team's Settings>Permissions in Observable.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":100,"value":"With the Observable account ID and External ID entered in their respective text boxes, select the **Next** button:","pinned":false,"hidden":false,"mode":"md"},{"id":388,"value":"

\n \n

After entering Account ID and External ID, select the Next button.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":611,"value":"Next, select the policy you just made to attach to the role:","pinned":false,"hidden":false,"mode":"md"},{"id":603,"value":"

\n \n

Get the External ID from your team's Settings>Permissions in Observable.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":394,"value":"\nThen, scroll down to the bottom of the **Permissions policies** page and select the **Next** button.","pinned":false,"hidden":false,"mode":"md"},{"id":614,"value":"

\n \n

Get the External ID from your team's Settings>Permissions in Observable.

\n","pinned":false,"hidden":false,"mode":"md"},{"id":102,"value":"Enter a name for the role in the **Name** text box, then select the **Create Role** button:","pinned":false,"hidden":false,"mode":"md"},{"id":398,"value":"

\n \n

Enter a name for the role, then select the Create role button in the bottom right-hand corner of the page.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":104,"value":"Next, select the role you just created by clicking the name of that role:","pinned":false,"hidden":false,"mode":"md"},{"id":403,"value":"

\n \n

Click the name of the role you just made.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":109,"value":"Select the **Trust Relationships** tab:","pinned":false,"hidden":false,"mode":"md"},{"id":406,"value":"

\n \n

Select the Trust Relationships tab.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":111,"value":"Select the **Edit trust policy** button:","pinned":false,"hidden":false,"mode":"md"},{"id":411,"value":"

\n \n

Select the Edit trust policy button.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":113,"value":"Now, replace the root ARN with the full Observable user ARN from the instructions for setting up your private bucket, which were revealed when you selected the **Use private bucket** option in your team's **Settings>Permissions** in Observable:","pinned":false,"hidden":false,"mode":"md"},{"id":426,"value":"

\n \n

Copy the Observable user ARN from your team's Settings>Permissions in Observable.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":420,"value":"

\n \n

Replace default the AWS root ARN with the Observable user ARN.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":117,"value":"Select the **Update policy** button in the lower right-hand corner of the page.","pinned":false,"hidden":false,"mode":"md"},{"id":122,"value":"Next, copy the role's ARN from the AWS Management Console:","pinned":false,"hidden":false,"mode":"md"},{"id":437,"value":"

\n \n

Copy the role ARN from the AWS Management Console.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":127,"value":"In Observable, paste in the role's ARN you just copied from AWS Management console into the **Role ARN** text box in the instructions on how to set up your private bucket, which were revealed when you selected the **Use a private bucket** option in your team's **Settings>Permissions**:","pinned":false,"hidden":false,"mode":"md"},{"id":442,"value":"

\n \n

Paste the role ARN from the AWS Management Console in the Role ARN textbox.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":451,"value":"Finally, enter in the name of your S3 bucket into the **Bucket Name** text box. Then enter the file path into the **File Path** text box. These were to be noted in an [earlier step above](https://observablehq.com/d/e37482aebe866133#cell-69).","pinned":false,"hidden":false,"mode":"md"},{"id":456,"value":"Now, before we can successfully use Private file storage, we need to do some allowlisting so that Observable can reach the S3 bucket.","pinned":false,"hidden":false,"mode":"md"},{"id":131,"value":"In your AWS Management Console, go to **S3>Buckets** and then select the bucket you are using for Private file storage:","pinned":false,"hidden":false,"mode":"md"},{"id":461,"value":"

\n \n

Navigate to S3>Buckets and click the name of the bucket you are using for Private file storage.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":136,"value":"Select the **Permissions** tab:","pinned":false,"hidden":false,"mode":"md"},{"id":468,"value":"

\n \n

Select the Permissions tab.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":139,"value":"Scroll down to the **Cross-origin resource sharing** section of the tab at the bottom of the page and then select the **Edit** button:","pinned":false,"hidden":false,"mode":"md"},{"id":471,"value":"

\n \n

Scroll to the bottom of the page to the Cross-origin resource sharing (CORS) section and select the Edit button.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":154,"value":"If you are okay with any origin being allowed to access the S3 bucket, copy the following CORS policy text or use the **Copy simple CORS policy text to clipboard** button below:","pinned":false,"hidden":false,"mode":"md"},{"id":147,"value":"viewof simpleCorsPolicyText = snippet(\"Copy simple CORS policy text to clipboard\", `[\n {\n \"AllowedHeaders\": [],\n \"AllowedMethods\": [\n \"GET\"\n ],\n \"AllowedOrigins\": [\n \"*\"\n ],\n \"ExposeHeaders\": []\n }\n]`)","pinned":false,"hidden":false,"mode":"ojs"},{"id":161,"value":"As stated, this policy allows any origin to access the S3 bucket, using the `*` wildcard. To specify only the Observable account you want to use with Private file storage, use the following policy text instead.","pinned":false,"hidden":false,"mode":"md"},{"id":152,"value":"viewof specificCorsPolicyText = snippet(\"Copy specific CORS policy text to clipboard\", `[\n {\n \"AllowedHeaders\": [],\n \"AllowedMethods\": [\n \"GET\"\n ],\n \"AllowedOrigins\": [\n \"https://.static.observableusercontent.com\"\n ],\n \"ExposeHeaders\": []\n }\n]`)","pinned":false,"hidden":false,"mode":"ojs"},{"id":173,"value":"Now, paste the CORS policy text you selected into the text box in AWS. If you chose to use the specific CORS policy, you will want to replace `` with your team's Observable _workspace_ name (as opposed to your personal Observable username). Then, select the **Save changes** button and your attachments will now be properly served from your private S3 bucket:","pinned":false,"hidden":false,"mode":"md"},{"id":485,"value":"

\n \n

Select the Save changes button.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":703,"value":"You should now be able to save file attachments to your private S3 bucket.","pinned":false,"hidden":false,"mode":"md"},{"id":449,"value":"---","pinned":false,"hidden":false,"mode":"md"},{"id":495,"value":"## Option 2: AWS CLI instructions","pinned":false,"hidden":false,"mode":"md"},{"id":500,"value":"The following instructions will guide you through enabling **Private file storage** using AWS CLI so that you can save file attachments in your notebooks to your organizations privately-controlled S3 bucket.","pinned":false,"hidden":false,"mode":"md"},{"id":502,"value":"Create a new private S3 bucket if you don't already have one you want to use:\n\n`$ aws s3api create-bucket --bucket --region us-west-2 --create-bucket-configuration LocationConstraint=us-west-2 --acl private`","pinned":false,"hidden":false,"mode":"md"},{"id":713,"value":"Be sure to replace `` with a name for your S3 bucket.","pinned":false,"hidden":false,"mode":"md"},{"id":507,"value":"Next, create a JSON file by copying and pasting the following policy document to be used in creating the policy, but remove the backticks (`) at the beginning and end of the document if copying manually. You can also use this button to copy the policy without the backticks:","pinned":false,"hidden":false,"mode":"md"},{"id":3381,"value":"snippet(\"Copy policy text to clipboard\", policyText)","pinned":false,"hidden":false,"mode":"ojs"},{"id":534,"value":"You then need to replace both instances of `` with the name of the bucket you intend to use for Private file storage. You also need to replace `` with the folder name you intend to use for the Observable file attachments. Finally, save the document to a path you can reference in the next step.","pinned":false,"hidden":false,"mode":"md"},{"id":539,"value":"Next, create the policy using the policy document from the previous step. One way to do this would be as follows:","pinned":false,"hidden":false,"mode":"md"},{"id":544,"value":"`$ aws iam create-policy --policy-name --policy-document file://`","pinned":false,"hidden":false,"mode":"md"},{"id":550,"value":"Just be sure to replace `` with the policy name you would like to use and replace `` with the path to the JSON file you created above.","pinned":false,"hidden":false,"mode":"md"},{"id":553,"value":"Now create a new trust policy document with the following snippet and save it as a JSON file to a path you can reference: ","pinned":false,"hidden":false,"mode":"md"},{"id":563,"value":"viewof trustText = snippet(\"Copy policy text to clipboard\", `{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \n },\n \"Action\": \"sts:AssumeRole\",\n \"Condition\": {\n \"StringEquals\": {\n \"sts:ExternalId\": \n }\n }\n }\n ]\n}`)","pinned":false,"hidden":false,"mode":"ojs"},{"id":568,"value":"Be sure to replace `` and `` with the Observable ARN and external ID shown in your teams **Settings>Permissions** in Observable (be sure to wrap both the Observable ARN and External ID in quotes for proper JSON format), that were revealed when you chose the **Use a private bucket** option:","pinned":false,"hidden":false,"mode":"md"},{"id":558,"value":"

\n \n

Copy the Observable user ARN from your team's Settings>Permissions in Observable.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":552,"value":"Next, create the IAM role using the name of your role instead of `` and the path to the JSON file you just created instead of ``.","pinned":false,"hidden":false,"mode":"md"},{"id":574,"value":"`$ aws iam create-role --role-name --assume-role-policy-document file://`\n","pinned":false,"hidden":false,"mode":"md"},{"id":591,"value":"The CLI output from a successful role creation will include the role ARN. Use that role ARN and put it in the **Role ARN** text box in your team's **Settings>Permissions** in Observable.","pinned":false,"hidden":false,"mode":"md"},{"id":644,"value":"

\n \n

Enter the role ARN in the Role ARN textbox in your team's Settings>Permissions.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":635,"value":"Attach the policy you created above to the new role you just created. Be sure to replace `` with your role's name and `` with the policy you created earlier.","pinned":false,"hidden":false,"mode":"md"},{"id":640,"value":"`$ aws iam attach-role-policy --role-name --policy-arn `","pinned":false,"hidden":false,"mode":"md"},{"id":593,"value":"Finally, add your bucket name and file path to the **Bucket Name** and **File Path** text boxes, respectively.","pinned":false,"hidden":false,"mode":"md"},{"id":648,"value":"

\n \n

Copy the Observable user ARN from your team's Settings>Permissions in Observable.

\n","pinned":false,"hidden":false,"mode":"html"},{"id":664,"value":"Now, if you are okay with any origin being allowed to access the S3 bucket, copy the following Cross-Origin Resource Sharing (CORS) policy text as a JSON file, or copy and paste the **Copy simple CORS policy text to clipboard** button below:","pinned":false,"hidden":false,"mode":"md"},{"id":3331,"value":"viewof simpleCorsPolicyTextCli = snippet(\"Copy simple CORS policy text to clipboard\", `{\n \"CORSRules\": [\n {\n \"AllowedHeaders\": [],\n \"AllowedMethods\": [\n \"GET\"\n ],\n \"AllowedOrigins\": [\n \"*\"\n ],\n \"ExposeHeaders\": []\n }\n ]\n}`)","pinned":false,"hidden":false,"mode":"ojs"},{"id":674,"value":"As stated, this policy allows any origin to access the S3 bucket, using the `*` wildcard. To specify only the Observable account you want to use with Private file storage, use the following policy text instead and save it as a JSON file.","pinned":false,"hidden":false,"mode":"md"},{"id":3330,"value":"viewof specificCorsPolicyTextCli = snippet(\"Copy specific CORS policy text to clipboard\", `{\n \"CORSRules\": [\n {\"AllowedHeaders\": [],\n \"AllowedMethods\": [\n \"GET\"\n ],\n \"AllowedOrigins\": [\n \"https://.static.observableusercontent.com\"\n ],\n \"ExposeHeaders\": []\n }\n ]\n}`)","pinned":false,"hidden":false,"mode":"ojs"},{"id":684,"value":"Be sure to save it after you have replaced `` with your team's workspace name. Then run the following command to attach the CORS configuration to the S3 bucket, replacing `` with the name of the S3 bucket you made earlier and replacing `` with the path to the CORS configuration file you just made:","pinned":false,"hidden":false,"mode":"md"},{"id":657,"value":"`$ aws s3api put-bucket-cors --bucket --cors-configuration `","pinned":false,"hidden":false,"mode":"md"},{"id":701,"value":"You should now be able to save file attachments in Observable to your private S3 bucket.","pinned":false,"hidden":false,"mode":"md"},{"id":47,"value":"## Appendix","pinned":false,"hidden":false,"mode":"md"},{"id":3351,"value":"snippet = (label, text) => {\n const onclick = e => {\n e.stopPropagation();\n navigator.clipboard.writeText(text);\n };\n const view = htl.html`

${text}

\n `;\n return Object.defineProperty(view, \"value\", {get: () => text});\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":318,"value":"import {note} from \"@observablehq/callout-boxes\"\n","pinned":true,"hidden":false,"mode":"ojs"},{"id":723,"value":"import {free, pro, enterprise} from \"@observablehq/pro-tag\"\n","pinned":true,"hidden":false,"mode":"ojs"}],"files":"$W31","stdlib":"1","titling":"auto"}