---
title: Set up persistent storage
type: guide
tier: all
order: 87
order_enterprise: 87
meta_title: Set up persistent storage with Label Studio
meta_description: Configure persistent storage with Label Studio hosted in the cloud to store uploaded data such as task data, user images, and more.

section: "Install & Setup"

If you host Label Studio in the cloud, you want to set up persistent storage for uploaded task data, user images, and more in the same cloud service as your deployment.

!!! note
By default, Label Studio leaves the serving of uploaded media to nginx, so to have persistent storage work correctly, you need nginx alongside Label Studio. This is the recommended configuration as it helps offload the Label Studio server.

However, if you are using a basic setup without nginx, you can set `USE_NGINX_FOR_UPLOADS=false` and `USE_NGINX_FOR_EXPORT_DOWNLOADS=false`. In this case, all serving will be handled by Label Studio. This configuration is not recommended because it will overload the uwsgi workers and can lead to a total Label Studio outage if users attempt to work with large files.

Follow the steps relevant for your deployment. If you use Docker Compose, select the cloud service you want to use as persistent storage:
* Set up Amazon S3 for Label Studio deployments in Amazon Web Services (AWS).
* Set up Google Cloud Storage (GCS) for Label Studio deployments in Google Cloud Platform.
* Set up Microsoft Azure Storage for Label Studio deployments in Microsoft Azure.

Set up Amazon S3

Set up Amazon S3 as the persistent storage for Label Studio hosted in AWS or using Docker Compose.

Create an S3 bucket

Start by creating an S3 bucket following the Amazon Simple Storage Service User Guide steps.

!!! note
If you want to secure the data stored in the S3 bucket at rest, you can set up default server-side encryption for Amazon S3 buckets following the steps in the Amazon Simple Storage Service User Guide.

Configure CORS for the S3 bucket

!!! note
In the case if you're going to use direct file upload feature and store media files like audio, video, csv you should complete this step.

Set up Cross-Origin Resource Sharing (CORS) access to your bucket. See Configuring cross-origin resource sharing (CORS) in the Amazon S3 User Guide. Use or modify the following example:
json [ { "AllowedHeaders": [ "*" ], "AllowedMethods": [ "GET", "PUT", "POST", "DELETE", "HEAD" ], "AllowedOrigins": [ "*" ], "ExposeHeaders": [ "x-amz-server-side-encryption", "x-amz-request-id", "x-amz-id-2" ], "MaxAgeSeconds": 3600 } ]

Configure the S3 bucket

After you create an S3 bucket, set up the necessary IAM permissions to grant Label Studio access to your bucket. There are four ways that you can manage access to your S3 bucket:
- Set up an IAM role with an OIDC provider (**recommended**).
- Use access keys.
- Set up an IAM role without an OIDC provider.
- Use access keys with Docker Compose.

Select the relevant tab and follow the steps for your desired option:

Set up Google Cloud Storage

Set up Google Cloud Storage (GCS) as the persistent storage for Label Studio hosted in Google Cloud Platform (GCP) or Docker Compose.

Create a GCS bucket

1. Start by creating a bucket. See Creating storage buckets in the Google Cloud Storage guide. For example, a bucket called heartex-example-bucket-123456.
2. When choosing the access control method for the bucket, choose uniform access control.
3. Create an IAM Service Account. See Creating and managing service accounts in the Google Cloud Storage guide.
4. Select the predefined Storage Object Admin IAM role to add to the service account so that the account can create, access, and delete objects in the bucket.
5. Add a condition to the role that restricts the role to access only objects that belong to the bucket you created. You can add a condition in one of two ways:
   • Select Add Condition when setting up the service account IAM role, then use the Condition Builder to specify the following values:
   • Condition type: Name
   • Operator: Starts with
   • Value: projects/_/buckets/heartex-example-bucket-123456
   • Or, use a Common Expression Language (CEL) to specify an IAM condition. For example, set the following: resource.name.startsWith('projects/_/buckets/heartex-example-bucket-123456'). See CEL for Conditions in Overview of IAM Conditions in the Google Cloud Storage guide.

Configure CORS for the GCS bucket

!!! note
In the case if you're going to use direct file upload feature and store media files like audio, video, csv you should complete this step.

Set up CORS access to your bucket. See Configuring cross-origin resource sharing (CORS) in the Google Cloud User Guide. Use or modify the following example:
shell echo '[ { "origin": ["*"], "method": ["GET","PUT","POST","DELETE","HEAD"], "responseHeader": ["Content-Type","Access-Control-Allow-Origin"], "maxAgeSeconds": 3600 } ]' > cors-config.json

Replace YOUR_BUCKET_NAME with your actual bucket name in the following command to update CORS for your bucket:
shell gsutil cors set cors-config.json gs://YOUR_BUCKET_NAME

Configure the GCS bucket

You can connect Label Studio to your GCS bucket using Workload Identity or Access keys.

After you create a bucket and set up IAM permissions, connect Label Studio to your GCS bucket. There are three ways that you can connect to your bucket:
- Use Workload Identity to allow workloads in GKE to access your GCS bucket by impersonating the service account you created (**recommended**).
- Create a service account key to use the service account outside Google Cloud.
- Create a service account key to use with Docker Compose.

Set up Microsoft Azure Storage

Create a Microsoft Azure Storage container to use as persistent storage with Label Studio.

Create a Storage container

1. Create an Azure storage account. See Create a storage account in the Microsoft Azure product documentation.

!!! note
Make sure that you set Stock Keeping Unit (SKU) to Premium_LRS and the kind parameter to BlockBlobStorage. This configuration results in storage that uses solid state drives (SSDs) rather than standard hard disk drives (HDDs). If you set this parameter to an HDD-based storage option, your instance might be too slow and could malfunction.

1. Find the generated key in the Storage accounts > Access keys section in the Azure Portal or by running the following command:
   shell az storage account keys list --account-name=${STORAGE_ACCOUNT}

2. Create a storage container within your storage account by following the steps to Upload, download, and list blobs with the Azure portal in the Microsoft Azure product documentation, or run the following command:
   shell az storage container create --name <YOUR_CONTAINER_NAME> \ --account-name <YOUR_STORAGE_ACCOUNT> \ --account-key "<YOUR_STORAGE_KEY>"

Configure CORS for the Azure bucket

!!! note
In the case if you're going to use direct file upload feature and store media files like audio, video, csv you should complete this step.

Set up CORS access to your bucket. See Configuring cross-origin resource sharing (CORS) in the Azure User Guide. Use or modify the following example:
xml <Cors> <CorsRule> <AllowedOrigins>*</AllowedOrigins> <AllowedMethods>GET,PUT,POST,DELETE,HEAD</AllowedMethods> <AllowedHeaders>x-ms-blob-content-type</AllowedHeaders> <ExposedHeaders>x-ms-*</ExposedHeaders> <MaxAgeInSeconds>3600</MaxAgeInSeconds> </CorsRule> <Cors>

Configure the Azure container

You can connect Label Studio to your Azure container using account keys in Kubernetes or account keys in Docker Compose. Choose the option relevant to your Label Studio deployment.