Skip to content

Face SDK Storage Configuration

Configure Face SDK storage to save the following data: processing result logs for Face Detection and Face Comparison; liveness assessment data, if you use the Liveness module; identification binary data, if you use the Identification module.

For a detailed storage setup guide, see Storage Configuration.

For the config.yaml example, see Configuration File Example.

For more information about cloud storage types, see the official documentation: Azure Blob Storage, Google Cloud Storage, AWS S3.

Access Management with Workload Identity Federation

For access management with Workload Identity Federation, see the configuration instructions:

Storage Configuration instructions
Azure Blob Storage Azure AD Workload Identity Documentation

Support Azure Workload Identities
Google Cloud Storage Authenticate to Google Cloud APIs from GKE workloads
AWS S3 EKS Pod Identities

IAM roles for service accounts

Setting Up Storage

To set up storage, configure the storage type in service.storage. Then configure the storage location in the corresponding feature section:

  • For Face Detection and Face Comparison, use service.detectMatch.results.location.
  • For Liveness, use service.liveness.sessions.location.
  • For Identification, use service.search.persons.location.
config.yaml
service:
  storage:
    type: fs
config.yaml
service:
  storage:
    type: az
    az:
      storageAccount: "<azure_storage_account>"
      connectionString: "<azure_connection_string>"
config.yaml
service:
  storage:
    type: gcs
    gcs:
      gcsKeyJson: "/etc/credentials/gcs_key.json"
config.yaml
service:
  storage:
    type: s3
    s3:
      accessKey: "<access_key>"
      accessSecret: "<access_secret>"
      region: "eu-central-1"
      secure: true
      endpointUrl: "https://s3.eu-central-1.amazonaws.com"

For the full list of storage parameters, see Configuration.

File System (FS)

If you use network file storage, mount it as a local drive.

Azure Blob Storage

To authenticate and access Azure Storage in your application, use one of the following methods:

  • Standard authentication via environment variables: Refer to the official Azure documentation for instructions.
  • When running in an Azure environment and assigned the appropriate role with Azure Storage access rights, authentication is enabled.

Note

Both methods described above require the storage account to be specified in the service.storage.az.storageAccount field.

  • Alternatively, you can authenticate to Azure Storage using a connection string that should be set in service.storage.az.connectionString. The connection string contains the necessary information to establish a connection to the storage account.

Note

For security reasons, Azure Storage connection strings use a separate order of precedence. For details, see Order of Precedence.

Here is a connection string example:

storage:
  type: az
  az:
    storageAccount: <azure_storage_account>
    connectionString: "<DefaultEndpointsProtocol=http;
      AccountName=<azure_storage_account>;
      AccountKey=<azure_account_key>;
      BlobEndpoint=http://<azure_storage_host>:10000/<azure_storage_account>;>"

Replace <azure_storage_host> with the hostname or IP address of your Azure Storage account.

You can find the connection string in the Access keys section of your Azure Storage account:

Google Cloud Storage

To enable Google Cloud Storage, follow the official Google documentation.

For the required Google Cloud Platform permissions, see the table below.

Bucket permission name Description
storage.buckets.get Read bucket metadata, excluding IAM policies, and list or read the Pub/Sub notification configurations on a bucket.
storage.objects.create Add new objects to a bucket.
storage.objects.delete Delete objects.
storage.objects.get Read object data and metadata, excluding ACLs.
storage.objects.list List objects in a bucket. Also read object metadata, excluding ACLs, when listing.
storage.objects.update Update object metadata, excluding ACLs. Also read object metadata, excluding ACLs, when updating.

For details about Google Cloud Storage IAM permissions, see the IAM permissions for Cloud Storage article.

AWS S3

To authenticate and access AWS S3 storage in your application, you can configure it using one of the following methods:

Note that MinIO storage is utilized for on-premises installations within our containers. It is compatible with AWS S3 and is configured in the same way.

The following permissions are required:

  • s3:PutObject
  • s3:PutObjectAcl
  • s3:GetObject
  • s3:GetObjectAcl
  • s3:DeleteObject
  • s3:ListObjects

Here is an S3 policy example:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": [
                    "s3:ListBucket",
                    "s3:GetBucketLocation"
                ],
                "Effect": "Allow",
                "Resource": [
                    "arn:aws:s3:::regula-test-permissions-bucket"
                ]
            },
            {
                "Action": [
                    "s3:PutObject",
                    "s3:PutObjectAcl",
                    "s3:GetObject",
                    "s3:GetObjectAcl",
                    "s3:DeleteObject"
                ],
                "Effect": "Allow",
                "Resource": [
                    "arn:aws:s3:::regula-test-permissions-bucket/*"
                ]
            }
        ]
    }