AWS AssumeRole authentication

Baseten can now assume an IAM role in your AWS account to pull private base images from Amazon ECR and mirror model weights from Amazon S3 during builds.

AssumeRole uses short-lived AWS STS credentials and a unique external ID for your Baseten organization. You can grant access through a native IAM trust policy without registering an OIDC provider or storing long-lived AWS credentials in Baseten.

For example, you can set auth_method: AWS_ASSUME_ROLE in your Truss configuration:

weights:
  - source: "s3://my-bucket/models/custom-weights"
    mount_location: "/models/custom"
    auth:
      auth_method: AWS_ASSUME_ROLE
      aws_assume_role_arn: arn:aws:iam::<account-id>:role/baseten-access
      aws_assume_role_region: us-west-2

For more information, see our docs.