Pull repository from different s3 accounts (multiple credentials)

[aras7]

Description Hey! I'm trying to pull models from different buckets but each of them requires to provide a different set of access keys, however, Triton is only being able to access the buckets whose credentials are set in the default profile

I'm trying something like this: /opt/tritonserver/bin/tritonserver --model-repository=s3://bucket_a/repo_a --model-repository=s3://bucket_b/repo_b ....

My .aws/credentials are:

[default]
aws_access_key_id=secret_key_id__a
aws_secret_access_key=secret_access_key_a

[<profile for repo b>]
aws_access_key_id=secret_key_id_b
aws_secret_access_key=secret_access_key_b

I also defined .aws/config with region

Triton Information What version of Triton are you using? I'm using nvcr.io/nvidia/tritonserver:20.08-py3

Are you using the Triton container or did you build it yourself? I pulled the image

To Reproduce Steps to reproduce the behavior. Pretty much what the description says, you need two isolated buckets and then try to pull them using two --model-repository. Include aws credentials/config

Describe the models (framework, inputs, outputs), ideally include the model configuration file (if using an ensemble include the model configuration file for that as well). Not relevant for this issue

Expected behavior I would expect Triton to be able to use all profile under credentials to authenticate and pull the models.

Is there a way to specify the profile? maybe something similar to specifying the host/port for the local s3? Is Triton meant to work with default profile only?

[CoderHam]

@aras7 Here is a proposal on how we intend to support multiple profiles. Please share your feedback on the same: Use the following format to specify the profile argument.  s3//[email protected]:80/bucket-name/path/to/model and s3//profile@bucket-name/path/to/model User would need to run aws configure to create the ~/.aws/credentials file with multiple profiles that will look something like this:

[default] 
aws_access_key_id = YOUR_AWS_ACCESS_KEY_ID
aws_secret_access_key = YOUR_AWS_SECRET_ACCESS_KEY

[profile]
aws_access_key_id = ANOTHER_AWS_ACCESS_KEY_ID
aws_secret_access_key = ANOTHER_AWS_SECRET_ACCESS_KEY

We can then use the credentials corresponding to the 'profile' in the s3 bucket path or default to 'default' if no profile is specified.

[aras7]

It looks good to me, it should definitely solve the problem 👍🏻