# Registry with Encrypted AWS S3 bucket **URL:** \ **Category:** Help\ **Created:** [October 29, 2022, 7:51pm UTC](https://community.okteto.com/t/registry-with-encrypted-aws-s3-bucket/317 "2022-10-29T19:51:20Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![cheer.b95](https://avatars.discourse-cdn.com/v4/letter/c/b5e925/32.png) [@cheer.b95](https://community.okteto.com/u/cheer.b95)\ **Post date:** [October 29, 2022, 7:51pm UTC](https://community.okteto.com/t/registry-with-encrypted-aws-s3-bucket/317/1 "2022-10-29T19:51:20Z")
I am currently following the guide published [here](https://community.okteto.com/t/support-for-gke-workload-identities-for-okteto-self-hosted/39/4) on how to connect okteto to S3 using an IAM Role. I’ve hooked up several service accounts to IAM roles in other projects, but this one seems to be failing. I’m getting a continual restart with no clear error message, and the [troubleshooting docs](https://www.okteto.com/docs/self-hosted/install/troubleshooting/#registry-opods-keep-restarting) suggest this is because it cannot connect to s3. We cannot use IAM Users in our org, so IAM roles are our only option. Whilst the policy I have created is identical to the recomended one, it differs in one respect, which is I’ve included an extra statement to allow for the decryption using our KMS key. All our S3 buckets are required to have Server Side KMS encryption as per another organisation security policy. I suspect this is why okteto is unable to connect to it. The IAM policy should be correct and I’ve done similar with other apps, so I’d appreciate if someone could confirm that this is supported and help me to debug what might be going wrong with our setup. The extra statement in the IAM policy looks like the following. The rest of it is identical to the recomended. ```auto { "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Effect": "Allow", "Resource": "*" } ``` ---
**Author:** ![ramiro](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/ramiro/32/6_2.png) [@ramiro](https://community.okteto.com/u/ramiro)\ **Post date:** [October 30, 2022, 8:54pm UTC](https://community.okteto.com/t/registry-with-encrypted-aws-s3-bucket/317/2 "2022-10-30T20:54:03Z")
@cheer.b95 could you share the entire definition of your IAM Role? Also, could you share the logs of the okteto-registry pods? ---
**Author:** ![cheer.b95](https://avatars.discourse-cdn.com/v4/letter/c/b5e925/32.png) [@cheer.b95](https://community.okteto.com/u/cheer.b95)\ **Post date:** [October 31, 2022, 5:29pm UTC](https://community.okteto.com/t/registry-with-encrypted-aws-s3-bucket/317/3 "2022-10-31T17:29:21Z")
```auto cloud: provider: aws: iam: enabled: false registry: serviceAccount: create: true annotations: eks.amazonaws.com/role-arn: 'arn:aws:iam::${AWS_ACCOUNT_ID}:role/${ROLE_NAME}' ``` The above is my config, and I can confirm the service account has the correct annotation and the pod has the correct AWS env variables, namely the `AWS_WEB_IDENTITY_TOKEN_FILE`. the IAM Role’s policy is as follows. It’s overly permissive for testing: ```auto { "Action":"s3:*", "Effect":"Allow", "Resource":"*", "Sid":"" }, { "Action":"kms:*", "Effect":"Allow", "Resource":"*", "Sid":"" } ``` as far as logs go, we see this on loop before the pod just disappears. ```auto { "go.version":"go1.16.15", "instance.id":, "level":"debug", "msg":"s3aws.Stat(\"/\")", "service":"registry", "time": , "trace.duration": 901800, "trace.file":"/go/src/github.com/docker/distributions/registry/storage/driver/base/base.go", "trace.func":"github.com/docker/distribution/registry/storage/driver/base.(*Base).Stat", "trace.id":, "trace.line":155, "version":"v2.8.1+unkown" } ``` The only thing I can think is that okteto is not able to handle server side encryption, or its not reading the `AWS_WEB_IDENTITY_TOKEN_FILE` environment variable. ---
**Author:** ![ramiro](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/ramiro/32/6_2.png) [@ramiro](https://community.okteto.com/u/ramiro)\ **Post date:** [October 31, 2022, 5:57pm UTC](https://community.okteto.com/t/registry-with-encrypted-aws-s3-bucket/317/4 "2022-10-31T17:57:52Z")
Would it be possible to test your setup without server-side encryption (on a different bucket) just to discard that? We’ll also do some testing around this internally. ---
**Author:** ![cheer.b95](https://avatars.discourse-cdn.com/v4/letter/c/b5e925/32.png) [@cheer.b95](https://community.okteto.com/u/cheer.b95)\ **Post date:** [October 31, 2022, 6:10pm UTC](https://community.okteto.com/t/registry-with-encrypted-aws-s3-bucket/317/5 "2022-10-31T18:10:18Z")
Sadly not. Server side encryption is automatically applied to all our s3 buckets. We cannot disable it. ---
**Author:** ![pchico83](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/pchico83/32/25_2.png) [@pchico83](https://community.okteto.com/u/pchico83)\ **Post date:** [November 2, 2022, 10:08am UTC](https://community.okteto.com/t/registry-with-encrypted-aws-s3-bucket/317/6 "2022-11-02T10:08:39Z")
@cheer.b95 IAM Roles are not supported yet by the docker registry, they had a regression there and there is an open PR to fix it. In the meantime, you might use IAM users, or use a single registry replica and file system storage for now. ---
**Author:** ![cheer.b95](https://avatars.discourse-cdn.com/v4/letter/c/b5e925/32.png) [@cheer.b95](https://community.okteto.com/u/cheer.b95)\ **Post date:** [November 2, 2022, 12:24pm UTC](https://community.okteto.com/t/registry-with-encrypted-aws-s3-bucket/317/7 "2022-11-02T12:24:37Z")
Another security policy prevents us from creating IAM users. We have to use roles. Hopefully this can be fixed quickly. We’ll look into alternative storage for now but We would obviously prefer s3 if possible. ---
**Author:** ![cheer.b95](https://avatars.discourse-cdn.com/v4/letter/c/b5e925/32.png) [@cheer.b95](https://community.okteto.com/u/cheer.b95)\ **Post date:** [November 2, 2022, 3:31pm UTC](https://community.okteto.com/t/registry-with-encrypted-aws-s3-bucket/317/8 "2022-11-02T15:31:14Z")
Is it possible to have a link to the helm chart code? I’ve not been able to find it in Github. ---
**Author:** ![cheer.b95](https://avatars.discourse-cdn.com/v4/letter/c/b5e925/32.png) [@cheer.b95](https://community.okteto.com/u/cheer.b95)\ **Post date:** [November 2, 2022, 10:18pm UTC](https://community.okteto.com/t/registry-with-encrypted-aws-s3-bucket/317/9 "2022-11-02T22:18:28Z")
I can confirm switching to ‘byo’ and away from s3 temporarily fixed the issue. We’d like to switch to s3 and IAM roles at some point when this issue is resolved. ---
**Author:** ![Jacob](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/jacob/32/372_2.png) [@Jacob](https://community.okteto.com/u/Jacob)\ **Post date:** [November 8, 2022, 2:49am UTC](https://community.okteto.com/t/registry-with-encrypted-aws-s3-bucket/317/10 "2022-11-08T02:49:13Z")
The helm chart code is not available through GitHub. However, you can inspect all helm charts by using helm pull, [Helm | Helm Pull](https://helm.sh/docs/helm/helm_pull/) ---
**Author:** ![cheer.b95](https://avatars.discourse-cdn.com/v4/letter/c/b5e925/32.png) [@cheer.b95](https://community.okteto.com/u/cheer.b95)\ **Post date:** [March 9, 2023, 8:20am UTC](https://community.okteto.com/t/registry-with-encrypted-aws-s3-bucket/317/11 "2023-03-09T08:20:27Z")
I was curious if this had been fixed yet? ---
**Author:** ![AgustinRamiroDiaz](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/agustinramirodiaz/32/34_2.png) [@AgustinRamiroDiaz](https://community.okteto.com/u/AgustinRamiroDiaz)\ **Post date:** [March 9, 2023, 12:52pm UTC](https://community.okteto.com/t/registry-with-encrypted-aws-s3-bucket/317/12 "2023-03-09T12:52:17Z")
Hi @cheer.b95! This should be fixable now by setting up an envvar for the registry. More official documentation from distribution/distribution [here](https://github.com/docker/docs/blob/main/registry/storage-drivers/s3.md#parameters) In your helm `Values.yaml` you should add the `extraEnv` to the `registry` ```yaml registry: extraEnv: - name: REGISTRY_STORAGE_S3_ENCRYPT value: true ``` This should fix the issue you have with the encryption Please let us know if you encounter another issue 😃 Hope this helps!