Step 1: Set up your Azure Storage

• Go to your Azure portal.
• Create (or use an existing) Storage Account.
• Inside it, create a Blob Container where Sama will access and store your assets.

Step 2: Register Sama as an App in Azure

• In Azure Active Directory, go to App registrations.
• Click "New registration", and name the app something like sama-access.
• After registering, copy the following:
  • Application (client) ID
  • Directory (tenant) ID
  • You’ll need both later when configuring Sama.

Step 3: Add Federated Credentials

• In your new App, go to Certificates & secrets → Federated credentials → Add credential.
• Set Scenario to “Other issuer”.
• Use the following values:
  • Issuer: https://cognito-identity.amazonaws.com
  • Subject identifier: eu-west-1:72a28b0b-b4cc-443f-9032-a397c1ef692a
  • Audience: eu-west-1:e4639e61-9b32-4a7f-aeb9-9987f28d102d

💡 This allows Sama to authenticate securely without storing passwords, using a method called Workload Identity Federation.

Step 4: Give Sama Access to Your Storage

• Go to your Storage Account or Blob Container in Azure.
• Select Access Control (IAM).
• Click Add role assignment, then:
  • Choose Storage Blob Data Contributor (for container access).
  • Choose Storage Blob Delegator (for account-level delegation).

✅ If you prefer Sama to only read files (and not write back), you can assign the Storage Blob Data Reader role instead.

Step 5: Configure CORS (Cross-Origin Resource Sharing)

• In your Blob Storage settings, go to Resource Sharing (CORS).
• Add the following configuration:
  • Allowed origins: * and app.lola.com
  • Allowed methods: GET, PUT
  • Max age: 3000

⚠️ This ensures Sama can securely fetch and upload files from your storage.

Step 6: Connect Azure to Your Sama Account

• Log into your Sama account at https://accounts.sama.com.
• Go to your Organization Details page.
• In the Azure Integration section:
  • Paste your Azure Application client ID
  • Paste your Directory (tenant) ID
• Also fill in the Storage Account Name and Container Name.

Step 7: Test Your Connection

• Use a test asset URL from your Azure container to confirm Sama can read your file.
• If successful, your integration is complete!

Step 1: Give Sama Permission to Access Your Bucket

You’ll need to update your S3 Bucket Policy so Sama can access the files it needs. This gives read-only access to the bucket.

Configure your S3 bucket policy as follows:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "sama-s3-getobjects",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::596059236576:user/hub-prod"
            },
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET_NAME>",
                "arn:aws:s3:::<BUCKET_NAME>/*"
            ]
        }
    ]
}

Replace <BUCKET_NAME> with the name of your actual bucket.

If more granular access is needed, the arn:aws:s3:::<BUCKET resource can be replaced with a list of resources that include the paths to which Sama will be granted access, such as arn:aws:s3:::<BUCKET and arn:aws:s3:::<BUCKET_NAME>/other/path/that/sama/needs/*

"Resource": [
  "arn:aws:s3:::your-bucket-name/path/to/assets/*"
]

💡 More help: AWS documentation on bucket policies

Step 2: Configure CORS (Cross-Origin Resource Sharing)

CORS lets Sama’s platform access files in your S3 bucket from the web.

• The Origin will be https://app.sama.com
• The Access-Control-Request-Method is GET

Here is a sample AWS S3 CORS bucket configuration that will enable the Sama platform to properly serve images:

[
    {
        "AllowedHeaders": [],
        "AllowedMethods": [
            "GET"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": [],
        "MaxAgeSeconds": 3000
    }
]

💡 More help: AWS guide on configuring CORS

Step 1: Create or Choose a Service Account

• Go to the IAM & Admin > Service Accounts section in your GCP Console.
• Click “Create Service Account.”
• Name the account something like: sama-cloud-storage.
• (Optional) Add a short description like “Used for Sama integration.”
• Click “Done” to finish.

💡 If you already have a service account you'd like to use, skip to Step 2.

Step 2: Grant Permissions to Sama and Your Service Account

• Click on the service account you just created.
• Open the Permissions tab.
• Click “Grant Access.”
• Under Add principals, add:
  • sama-external@rd-prod-398911.iam.gserviceaccount.com (this is Sama’s account)
  • The email address of the service account you just created (e.g., sama-cloud-storage@your-project.iam.gserviceaccount.com)
• Under Assign roles, add:
• Service Account Token Creator

💡 This role allows Sama to impersonate the account securely using a short-term token.

• Click “Save.”
• Send Sama the full email address of the service account you created.

Step 3: Set Permissions on Your Storage Bucket

• Go to the Cloud Storage section in the GCP Console.
• Click the name of the bucket you want Sama to access.
• Open the Permissions tab.
• Click “Grant Access.”
• Under Add principals, add the same service account you created (e.g., sama-cloud-storage@...).
• Under Assign roles, choose:
  • Storage Object User (this gives Sama read/write access)
    • OR Storage Object Viewer (for read-only access — Sama won’t be able to save data back to the bucket if you choose this)
• Click “Save.”
• Send Sama the name of the bucket(s) you want to connect.

💡More Help GCP Docs – Creating and managing service accounts