2026-04-12 Sun
- Logseq/Flashcard/Review
garddiff
Context
When enabling LangSmith blob storage with S3, you may encounter access denied errors if your S3 bucket has a resource-based policy that requires KMS encryption headers. The error typically appears as:
AccessDenied: User: arn:aws:sts::account:assumed-role/langsmith-platform-backend-blob-storage-v2-environment/session is not authorized to perform: s3:PutObject on resource with an explicit deny in a resource-based policy
This occurs when your bucket policy includes aDenyIncorrectEncryptionHeaderstatement that blocks PutObject requests without proper KMS encryption headers.
Answer
LangSmith now supports KMS encryption for S3 blob storage. To resolve this issue, configure KMS encryption in your LangSmith deployment:
config:
blobStorage:
enabled: true
engine: "S3"
chSearchEnabled: false
bucketName: "your-bucket-name"
apiURL: "https://s3.your-region.amazonaws.com"
kmsEncryptionEnabled: true
kmsKeyArn: "arn:aws:kms:your-region:account-id:key/your-kms-key-id"
With KMS encryption enabled, LangSmith will include the required encryption headers in S3 requests, satisfying bucket policies that enforce encryption requirements. You should see objects appearing in your S3 bucket once the configuration is properly applied.
logseq-entity, implies a singular entity in a page, when really, a page may need to document more than one entity.tags:: [[Term]] frontmatter entry. Usually I place the term at a logical location in the namespaces for where I want it to be sorted on disk, lexicographically, so that when I look at the files in the Logseq/Page pages directory, it works a bit like Library/Science/Classification/Dewey or Library/Science/Classification/Library of Congress