S3 with IAM roles

Label Studio Enterprise integrates with Amazon S3 using IAM Roles to give teams a secure way to move data in and out of projects without managing static access keys. The integration uses AWS STS AssumeRole with an ExternalId so you can keep permissions and security controls in IAM.

With this connection, you can:

• Import raw data from S3 into Label Studio for annotation
• Export annotations back to S3 in your preferred formats
• Keep credentials temporary and in memory, aligned with security and compliance needs

This IAM Role–based S3 integration is available in Label Studio Enterprise.

How Label Studio Connects with Amazon S3 (IAM Roles)

Label Studio Enterprise connects to S3 through a trusted IAM Role in your AWS account. When storage is configured, Label Studio:

• Uses STS AssumeRole with an ExternalId to get temporary credentials
• Lists and reads S3 objects to create and serve tasks
• Writes annotation results back to S3 on export
• Can generate pre-signed URLs so browsers load objects directly from S3, or proxy traffic through the backend

Brief setup steps

1. Create an IAM Role in AWS that trusts Label Studio using the ExternalId shown in the Label Studio Enterprise UI, and grant scoped S3 permissions for your bucket and prefix.
2. In Label Studio Enterprise, go to Project → Settings → Cloud Storage and choose Amazon S3 with IAM Role as Source or Target Storage.
3. Enter your Bucket, optional Prefix, Region, and Role ARN, validate the connection, then sync for imports or save for exports.