OIDC and AWS AssumeRole for training jobs

Training jobs can now use OIDC or AWS AssumeRole during setup to pull private container images and download model weights or training data without storing long-lived cloud credentials in Baseten.

OIDC supports Amazon ECR and S3, Google Artifact Registry and Container Registry, and Google Cloud Storage. Training OIDC tokens let you scope access to your Baseten organization, team, training project, or individual job.

For AWS resources, you can use AWS AssumeRole without registering an OIDC provider. Baseten assumes an IAM role in your account using your organization's unique external ID. AWS AssumeRole supports private images in Amazon ECR and weights or data in Amazon S3.

For setup instructions, see OIDC authentication, AWS AssumeRole, private training images, and weights and data authentication.