Hello all, I’m wondering if anyone has a solution to showing private images in Prefect artifacts?

You mean, e.g. an image from a private S3 bucket?

Yup!

will investigate. In general, I think the biggest risk in sharing a private image would be: how long would you be OK in sharing it? If it’s OK for the artifact image to be valid for, say 6 hours, then you can generate a presigned URL on S3 and this URL has an authentication token within it - looks like this:

Unfortunately, in my case, it needs to be fully private (I'm working with client compliance data) and I'm using the plots to help me debug any issues my client might have about the topic model's results. I can't foresee the time frame in this case. At the moment, I'm going directly into S3 to find the image if a client has any model interpretability problems. But would be great if I could see it directly from the Prefect UI

I see. In general: 1. When you generate a presigned URL, your image stays private and can only be viewed by people who get this URL from you. As long as you don’t share it anywhere publicly and only provide this URL to the artifacts API in your Prefect account, it should be very secure - only people who can log into your Prefect UI can see it. 2. Additionally, the URL is temporary, so to make it even more secure, you could let it be available for, say 1-2 hours to still give you enough time to see it but only temporarily?

I completely agree with your points. Yeah I completely agree that 1. is secure enough for a majority of threat models. In my case, it’s more that my non-technical cofounder is uncomfortable about having a “public url”. I think I’ll need to image to be permanent (or public for at least a month?) as it’ll be hard to anticipate when I’ll need to go in and support the end user. Would be cool to see how the Prefect team / community develops artifacts though! I’m already using it to upload regression tables. But would be great if visualisations can be supported as well

ok, then presigned URL is not the right thing to do here - it can be valid for up to one week. Does it make sense to render the image somehow differently, in a way that it perhaps only shows a reference to the ID in a database where you store more detailed information, rather than displaying all the information in the image? this way you could perhaps keep the image public

All workflow results are stored in "s3://bucket/client_username/flow_run_name/results/", so it's not too difficult to retrieve the image if needed. At the moment, I'm using these images only on the rare occasion that my client believes the topic model is incoherent. But wondering if I can upload images in general, for instance in a CV inference pipeline, so I can see unidentified images directly from the Prefect UI. These images could contain sensitive information like ID scans.

Sure, totally understand. That’s a tradeoff to make on an individual use case basis. Good luck!