Connecting a Storage Account

When a storage account is connected, Workbench indexes the directories and identifies the samples and files. The following sections detail how to set up storage accounts for different providers.

1. AWS

2. Azure Storage Account

3. Google Cloud Storage

---

AWS S3

The following guide outlines the key concepts and minimal configuration needed to establish a secure connection between Instruments and your AWS S3 resources.

Connect AWS S3

1. Select Amazon AWS as the provider.

2. Enter your Access Key ID and Secret Access Key.

3. Specify the Bucket URI and Region.

4. Click Save to connect the storage account.

Required Permissions

To use AWS S3 with Workbench, the following are required:

• s3:ListBucket: To list objects within the bucket.

• s3:GetObject: To read object contents.

Generating an Access Key

1. Log in to the AWS Management Console.

2. Navigate to IAM (Identity and Access Management).

3. Select Users and choose the user for whom you want to create an access key.

4. Go to the Security Credentials tab and click Create Access Key.

5. Copy the Access Key ID and Secret Access Key to use in Workbench.

For more details, refer to the AWS Documentation.

The service account is now ready to list and read objects from the specified bucket.

---

Azure Storage Account

The following guide outlines the key concepts and minimal configuration needed to establish a secure connection between Instruments and your Azure resources.

Using OAuth2

1. Select Microsoft Azure as the provider.

2. Choose OAuth 2.0 as the authentication method.

3. Enter your Tenant ID, Client ID, and Client Secret.

4. Provide the Storage Account Name and Container Name.

5. Click Save.

Required Permissions

To use Azure Storage with Workbench, the following permissions are required:

• Storage Blob Data Reader: To list and read blob data within the storage account.

Creating a Service Principal

1. Log in to the Azure Portal.

2. Navigate to Azure Active Directory > App Registrations > New Registration.

3. Provide a name for the application and click Register.

4. Go to the Manage > Certificates & Secrets tab and create a Client Secret.

5. Navigate to your Storage Account and open the Access Control (IAM) tab.

6. Click Add Role Assignment, select Storage Blob Data Reader, and assign it to the newly created service principal.

For detailed steps, refer to the Azure Documentation.

Using SAS Token

1. Select Microsoft Azure as the provider.

2. Choose Shared Access Signature as the authentication method.

3. Enter the SAS URL.

4. Specify the Storage Account Name and Storage Container Name.

5. Click Save.

Generating a SAS Token for a Container

1. Log in to the Azure Portal.

2. Navigate to your Storage Account > Storage Browser and go to Blob Containers section.

3. Locate the desired blob container in the table.

4. In the last column of the table, click on the ellipsis "..." to open the context menu.

5. Click on the Shared Access Signature option.

6. Specify the permissions required (e.g., Read and List).

7. Set the Start and Expiry time for the token.

8. Click Generate SAS Token and URL.

9. Copy the generated SAS Token URL.

Note: SAS tokens can expire. Ensure the token's validity matches the intended usage period

Using Access Key

1. Select Microsoft Azure as the provider.

2. Choose Access Key as the authentication method.

3. Enter the Access Key.

4. Specify the Storage Account Name and Storage Container Name.

5. Click Save.

Retrieving the Storage Account Access Key

Follow these steps to retrieve the access key for your Azure Storage Account:

1. Log in to the Azure Portal.

2. Navigate to your Storage Account.

3. Under Security + Networking, select Access keys.

4. Copy the Key1 or Key2 under the Key section.

5. Use the copied key as the Access Key in Workbench.

For additional details, visit the Azure Storage Account Key Documentation.

The service account is now ready to list and read objects from the specified bucket.

---

Google Cloud Storage

Steps to Connect GCP

1. Select Google Cloud as the provider.

2. Upload your Service Account JSON.

3. Enter the Project ID and Bucket URI.

4. Click Save to connect the storage account.

Creating a Service Account, Key, and Assigning Permissions

1. Log in to the Google Cloud Console.

2. Navigate to IAM & Admin > Service Accounts.

3. Click Create Service Account.

4. Enter a name and description for the service account, then click Create and Continue.

5. Assign the Storage Object Viewer role to the service account to grant permissions for listing and reading objects.

6. Click Done to finish creating the service account.

7. Select the newly created service account from the list and navigate to the Keys tab.

8. Click Add Key > Create New Key.

9. Choose the JSON format and click Create.

10. Save the downloaded JSON key securely for use in Workbench.

Assigning Permissions to Buckets

1. Navigate to the Cloud Storage section in the Google Cloud Console.

2. Select the bucket you want the service account to access.

3. Go to the Permissions tab and click Grant Access.

4. Enter the service account email in the New Principals field.

5. Assign the Storage Object Viewer role to the service account.

6. Save the changes.

The service account is now ready to list and read objects from the specified bucket.