|
1 | | -## en garde(ning) |
| 1 | +## [[LangChain/Ecosystem]] |
| 2 | + - It kind of seems like [[LangSmith/Deployment]] should have asset storage. |
| 3 | + - Discovered [[LangSmith/Storage/Blob/S3]] |
| 4 | + - [LangChain Support Portal - How do I resolve S3 PutObject access denied errors when enabling LangSmith blob storage with KMS encryption requirements?](https://support.langchain.com/articles/6337418324-how-do-i-resolve-s3-putobject-access-denied-errors-when-enabling-langsmith-blob-storage-with-kms-encryption-requirements) |
| 5 | + collapsed:: true |
| 6 | + - How do I resolve S3 PutObject access denied errors when enabling LangSmith blob storage with KMS encryption requirements? |
| 7 | + |
| 8 | + Context |
| 9 | + |
| 10 | + When enabling LangSmith blob storage with S3, you may encounter access denied errors if your S3 bucket has a resource-based policy that requires KMS encryption headers. The error typically appears as: |
| 11 | + |
| 12 | + AccessDenied: User: arn:aws:sts::account:assumed-role/langsmith-platform-backend-blob-storage-v2-environment/session is not authorized to perform: s3:PutObject on resource with an explicit deny in a resource-based policy |
| 13 | + |
| 14 | + This occurs when your bucket policy includes aDenyIncorrectEncryptionHeaderstatement that blocks PutObject requests without proper KMS encryption headers. |
| 15 | + |
| 16 | + Answer |
| 17 | + |
| 18 | + LangSmith now supports KMS encryption for S3 blob storage. To resolve this issue, configure KMS encryption in your LangSmith deployment: |
| 19 | + - Add the KMS encryption configuration to your LangSmith config: |
| 20 | + ``` |
| 21 | + config: |
| 22 | + blobStorage: |
| 23 | + enabled: true |
| 24 | + engine: "S3" |
| 25 | + chSearchEnabled: false |
| 26 | + bucketName: "your-bucket-name" |
| 27 | + apiURL: "https://s3.your-region.amazonaws.com" |
| 28 | + kmsEncryptionEnabled: true |
| 29 | + kmsKeyArn: "arn:aws:kms:your-region:account-id:key/your-kms-key-id" |
| 30 | + ``` |
| 31 | + - Ensure your IAM roles have the necessary KMS permissions in addition to S3 permissions: |
| 32 | + - kms:Encrypt |
| 33 | + - kms:GenerateDataKey |
| 34 | + - kms:Decrypt |
| 35 | + - Update your service account annotations with the appropriate IAM role ARNs for backend, platformBackend, and queue components. |
| 36 | + - Deploy the updated configuration and verify that objects are being created in your S3 bucket with KMS encryption. |
| 37 | + |
| 38 | + With KMS encryption enabled, LangSmith will include the required encryption headers in S3 requests, satisfying bucket policies that enforce encryption requirements. You should see objects appearing in your S3 bucket once the configuration is properly applied. |
| 39 | + - Actually, it looks like this is not for that - it's for OLAP over traces, runs, etc |
| 40 | +- ## [[PL]] stuff |
| 41 | + - thinking about trying a [[Commitment]] to primarily or only writing in [[Rust]] for a year, as a way to [[Concentrate]] the [[Attention]] |
| 42 | + - of course, this wouldn't be strictly possible, but perhaps there's a version of this challenge which could be articulated and followed |
| 43 | +- ## sec |
| 44 | + - [[Frustrations]] with [[1Password]] |
| 45 | + - learned that [[1Password/Dev/ssh/agent]] has a setting where one can extend the timeout. I was getting fingerprinted every single time my computer unlocked, which was getting super annoying, especially considering that every time I unlocked the computer, 1Password ended up not detecting that the [[Mac/TouchID]] was available for ~1min. the result was that I had a foreground dialog on top of the focused application that I had to move out of the way until touchid was considered available by 1Password |
| 46 | +- ## en garde(ning) |
| 47 | + - ### [[rulesync/Skill]] for proxying pages from other logseq gardens |
| 48 | + - [[Logseq/Idea/Proxy]] |
| 49 | + - I could have sworn that I had some context in this garden related to [[Person/codekiln/GitHub/logseq-gardener]] |
2 | 50 | - ### getting carded |
3 | 51 | - Did some flashcards this morning. The [[Logseq/Flashcard/Review]] UI (the one in the side-panel) is a bit confusing. It has a drop down menu to select different categories of flashcards, which in theory is convenient. Currently, in this garden, though, many items appear more than once, and some of the items that appear in the menu don't have any flashcards. In addition, right now I'm not prioritizing VSCode flashcards anymore (though I do still need a few; for example, being able to see the log after rebuilding devcontainers is a good one). |
4 | 52 | - I should probably have a better precedent for how to log [[Logseq/Flashcard]]s that are not [[Keyshort]]s; I don't want to stuff [[CLI commands]] and [[GUI/Menu/Command]]s into keyshorts if it isn't actually a [[Keyboard Shortcut]]. It might make sense to somehow tie this to my nascent [[Logseq/Entity]] system. |
|
12 | 60 | - A key aspect of how I use logseq is that I create a page so that I can refer to something by name. |
13 | 61 | - Usually I do this with a logseq `tags:: [[Term]]` frontmatter entry. Usually I place the term at a logical location in the namespaces for where I want it to be sorted on disk, lexicographically, so that when I look at the files in the [[Logseq/Page]] pages directory, it works a bit like [[Library/Science/Classification/Dewey]] or [[Library/Science/Classification/Library of Congress]] |
14 | 62 | - Is it a type of [[Digital Twin]] |
15 | | -- ## garddiff |
| 63 | +- ## gard(en)diff |
16 | 64 | - ### [[Filed]] |
| 65 | + - [[LangSmith/Storage/Blob]] |
| 66 | + - [[LangSmith/Storage/Blob/S3]] |
| 67 | + - [[Logseq/Idea/Proxy]] |
| 68 | + - [[Logseq/Garden]] |
| 69 | + - [[Obsidian/Q/Is there a VS Code extension that helps obsidian users have an obsidian-compatible view of obsidian markdown files and navigate between wiki links?]] |
17 | 70 | - [[Programming/Language/Concept/Interface]] |
18 | 71 | - [[Programming/Language/Concept/Type/Nominal]] |
19 | 72 | - [[Programming/Language/Concept/Type/Structural]] |
20 | 73 | - [[Library/Science/Classification]] |
21 | 74 | - [[Library/Science/Classification/Dewey]] |
22 | 75 | - [[Library/Science/Classification/Library of Congress]] |
23 | 76 | - [[tmux/Q/Why doesn't prefix Alt-Left or Alt-Right resize the inner horizontal split in a nested tmux layout (outer top-bottom split and lower left-right split), while Alt-Up or Alt-Down still move the outer boundary?]] |
| 77 | + - [[nx]] |
24 | 78 | - ### [[Updated]] |
25 | 79 | - [[Knowledge/Garden/ing/AI]] |
26 | 80 | - ### [[Review]] |
|
0 commit comments