I'm trying to serve an Oriented Imagery Dataset from a secured Amazon S3 cloud store (not public) using the $virtualCacheDirectory workflow documented for ArcGIS Enterprise 12.0, and I've hit a wall where the service publishes and resolves correctly but images never actually load. Before I go further, my real question for the community: has anyone gotten OID secured storage working end-to-end on AWS S3 with Enterprise 12.0? If you have, I'd love to know what your setup looked like. If you tried and couldn't, that's useful to know too.
Reference docs for the workflow I'm following:
Environment
- ArcGIS Enterprise 12.0, base install (Build 58905), no patches
- Single-machine deployment (Portal + hosting Server federated on one machine), on AWS
- Imagery in a private S3 bucket, registered as a cloud store
- OID authored for 360 corridor imagery; discrete JPEG frames
What I'm seeing
ImagePath is formatted as documented, e.g. $virtualCacheDirectory:<folder>/<filename>.jpg. Published with the native Generate Service From Oriented Imagery Dataset tool with the Virtual Cache Directory parameter set to the registered cloud store.
- In ArcGIS Pro: the image resolves to a well-formed URL (https://.../arcgis/rest/directories/dsid_<storeGUID>/<folder>/<filename>.jpg) but fails to load.
- In Portal Map Viewer: the same service resolves to https://.../arcgisnull/<folder>/<filename>.jpg — the cache directory base resolves to the literal string null.
What I've already verified / ruled out
- S3 access and objects are good: using the same access key registered for the cloud store, a separate cloud store connection in ArcGIS Pro lists and opens the exact image objects the OID references.
- The registered cloud store's GUID matches the dsid_<guid> in the resolved Pro URL, so the service is resolving to the correct store.
- Single machine, so the "cloud store must be on the same server as the OID service" requirement is satisfied by definition.
- Reproduced with the native GP tool (not just my own Python toolbox), so it's not my code.
- Tried multiple store registration variations (plain name; ags-objects- prefixed name; with "Register Cache directory" enabled + arcgiscache folder; with the credential temporarily granted write access). Identical result every time.
- Both Server and Portal WebContextURLs are set and aligned (/arcgis and /portal respectively).
- In Server logs at DEBUG, the /rest/directories/dsid_<guid>/...jpg request appears and then dead-ends silently — no CloudStore, CacheDirectory, S3, or object-store entries follow it, and no error. The FeatureServer query for the same service logs normally and returns features with their imagepath values.
Open questions
- Is OID secured storage via $virtualCacheDirectory actually functional on 12.0, and does it require any server role/capability (e.g. Image Server) that isn't mentioned in the secured-storage docs?
- The "Secured storage" section present in the 12.0 oriented imagery viewer help appears to have been removed in the 12.1 docs. Is this workflow still supported in 12.1?
I have an open Esri support case on this (#04187998) and have worked through it extensively with Enterprise support, but we haven't been able to resolve it through standard troubleshooting. I'm hoping someone here with direct experience getting OID secured storage working on AWS (or on the Imagery team) might recognize what's going on. Any pointers appreciated.
