Features
This page provides a comprehensive catalog of Visual Asset Management System (VAMS) features, organized by component. VAMS includes capabilities spanning the web interface, REST API, command line interface, backend services, processing pipelines, and infrastructure.
Web Interface Features
The VAMS web interface is a React 18 application built with Vite and the AWS Cloudscape Design System. It provides a complete browser-based experience for asset management and visualization.
Viewer Plugins
VAMS includes built-in viewer plugins across five categories (3D, Media, Document, Data, and Preview), covering 3D meshes, CAD, point clouds, Gaussian splats, USD, and IFC/BIM models. The plugin-based architecture supports lazy loading, per-plugin dependency management, automatic viewer selection based on file extension, and fullscreen mode. Two additional licensed viewers (VNTANA and VEERUM) provide commercial-grade rendering for GLB models and point clouds.
For the complete list of supported file viewers and extensions, see File Viewers.
Asset Management
- Database organization -- Create and manage multiple databases, each with their own Amazon S3 bucket, metadata configuration, and access controls
- Asset versioning -- Create, browse, compare, edit, archive, and unarchive asset versions with alias naming and comment fields
- Version selector -- Filter the file manager and metadata views to display data from a specific stored version (read-only)
- Asset preview thumbnails -- Display generated preview images in asset detail pages and search results
- Cross-database asset linking -- Create relationships between assets across different databases
- File manager -- Hierarchical file tree with folder expansion, file selection, copy, move, and rename operations
- Drag-and-drop upload -- Upload files and folders directly through the browser with progress tracking
- Metadata management -- View and edit asset-level and file-level metadata with configurable schemas
- Tag management -- Assign tags to assets using custom tag types for classification
- Comments -- Rich text comments with collaborative review workflows
- Subscriptions -- Subscribe to asset change notifications
Search
- Full-text search -- Search across asset names, descriptions, metadata fields, and file attributes
- Asset and file search -- Separate search scopes for assets and files with column-specific filters
- Preview thumbnails in results -- Visual asset identification directly in search result listings
- Result paging -- Full result counts with proper pagination
User Interface
- Dark and light themes -- Toggle between dark mode (default) and light mode from the top navigation settings
- Responsive layout -- AWS Cloudscape Design System components with consistent AWS console styling
- Split navigation -- Admin sections split into "Admin - Auth" and "Admin - Data" categories
- Share URLs -- Generate shareable URLs with toggle between URLs (Embedded Auth) for time-limited presigned access and URLs (API Stream) for long-lasting authorization token URIs
- Configurable display names -- Customize terminology for "Asset", "Database", and "Comment" through the synonyms system
- Custom banner messages -- Display organizational announcements via the
optionalBannerHtmlMessageconfiguration
Administration
- Amazon Cognito user management -- Add, update, remove, and reset passwords for Amazon Cognito users directly from the web interface (no AWS Console required)
- API key management -- Create, update, and delete API keys with user ID impersonation for application-to-application integration
- Role management -- Create and manage roles with two-tier permission constraints
- Permission constraint management -- Define, import, and manage ABAC/RBAC constraints with bulk JSON template import
- Pipeline management -- Create, edit, and delete processing pipelines with execution type selection (Lambda, SQS, EventBridge, DeadlineCloud)
- Workflow management -- Design multi-step processing workflows with pipeline chaining
- Metadata schema management -- Define and manage metadata schemas for assets, files, databases, and asset links
API Features
VAMS exposes a REST API through Amazon API Gateway, secured by a custom Lambda authorizer.
Core API Capabilities
| Domain | Endpoints | Description |
|---|---|---|
| Assets | CRUD + download + stream | Asset lifecycle management with version-aware operations |
| Asset Versions | Create, update, archive, unarchive | Version management with alias naming and metadata restoration |
| Asset Links | CRUD | Cross-database asset relationships |
| Databases | CRUD | Database lifecycle with metadata and Amazon S3 bucket management |
| Files | Upload, download, copy, move, delete | File operations with presigned URL generation |
| Metadata | CRUD | Asset-level and file-level metadata with version support |
| Metadata Schemas | CRUD | Schema definitions for structured metadata validation |
| Tags | CRUD | Tag assignment and management |
| Tag Types | CRUD | Custom tag type definitions |
| Pipelines | CRUD | Pipeline registration and configuration |
| Workflows | CRUD + execute | Workflow design and execution |
| Search | Query | Full-text and attribute-based search |
| Comments | CRUD | Asset-level comments |
| Subscriptions | CRUD | Change notification subscriptions |
| Auth | Routes, constraints, roles, user-roles | Permission and authorization management |
| Cognito Users | CRUD + reset password | User management (Amazon Cognito mode only) |
| API Keys | CRUD | API key lifecycle management |
| Config | Amplify config, secure config, version | Runtime configuration and feature flags |
API Security
- Custom Lambda authorizer with JWT token validation and optional IP range restrictions
- Two-tier authorization enforcement on every request (API-level and object-level)
- Configurable rate limiting with
globalRateLimit(default: 50 requests per second) andglobalBurstLimit(default: 100 requests per second) - Presigned URL generation for secure direct Amazon S3 access with configurable timeout
- CORS support for cross-origin browser requests
API Access Patterns
- Streaming downloads with HTTP range-request support, optionally pinned to a specific file or asset version through the
versionId,assetVersionId, andassetVersionIdAliasquery parameters -- see Files API - Presigned URL downloads for large file transfers
- Pagination using
NextToken-based continuation for list endpoints -- see API Overview - Bulk constraint import from JSON templates with server-side variable substitution -- see Import constraint template and Permission templates
CLI Features
The VamsCLI is a Python-based command line tool built on the Click framework. It supports profile-based multi-environment configuration and machine-readable JSON output.
Coverage
The CLI covers the same ground as the web interface: setup and authentication, profiles, feature queries, databases, assets, asset versions, asset links, files, directory synchronization, tags and tag types, metadata and metadata schemas, search, pipelines and their configuration templates, workflows and triggers, executions, roles and permission constraints, Amazon Cognito users, API keys, and a set of industry-specific commands for bill-of-materials assembly, PLM XML import, and spatial GLB combination.
For the full list of command groups and every command in each, see the Command Reference.
CLI Capabilities
- Profile management -- Configure and switch between multiple VAMS environments
- JSON output mode -- Use
--json-outputflag for machine-readable output in automation scripts - Chunked file upload -- Large file uploads with progress monitoring and retry logic
- Bulk operations -- Efficient batch processing of assets, files, and metadata
- Permission template import -- Import JSON constraint templates to provision a role's full constraint matrix in one step
- CI/CD integration -- Headless operation mode for build pipeline integration
Backend Features
Authorization System
- Two-tier ABAC/RBAC -- Attribute-Based and Role-Based Access Control using Casbin policy enforcement
- Tier 1 (API-level) -- Controls access to API routes and web navigation paths
- Tier 2 (Object-level) -- Controls access to specific data entities (databases, assets, pipelines, tags, tag types)
- GLOBAL keyword -- Apply constraints across all databases or resources
- Deny overlay -- Layer deny constraints on top of allow constraints for exception-based access patterns
- Pre-built templates -- Five pre-built permission profiles: database-admin, database-user, database-readonly, global-readonly, deny-tagged-assets
Metadata System
- Configurable schemas -- Define metadata schemas for assets, files, databases, and asset links
- Auto-loaded defaults -- Default schemas auto-loaded on deployment (configurable)
- Version-aware metadata -- Metadata is versioned alongside asset versions
- Metadata on copy/move -- File metadata is automatically carried forward during copy and move operations
Audit and Logging
- Amazon CloudWatch audit log groups -- Nine dedicated audit log groups for authentication, authorization, file upload, file download, file download (streamed), auth changes, auth other, actions, and errors
- AWS CloudTrail -- Optional stack-level AWS CloudTrail logging (enabled by default)
- Structured logging -- AWS Lambda Powertools for consistent log formatting and correlation
Search Indexing
- Dual-index architecture -- Separate Amazon OpenSearch indexes for assets (
vams-assets-v3) and files (vams-files-v3) - Event-driven indexing -- Amazon SNS and Amazon SQS-based automatic index synchronization on asset and file changes
- Preview file indexing --
str_previewfilekeyandstr_assetlocationkeyfields in search indexes for optimized UI rendering - Re-index on deploy -- Optional
reindexOnCdkDeployflag for full index rebuild during deployment
Pipeline Features
Execution Types
Pipelines support four execution types for integration with different processing backends:
| Execution Type | Invocation | Callback Support | Use Case |
|---|---|---|---|
| Lambda | Synchronous or asynchronous AWS Lambda invocation | Yes (native) | Lightweight processing tasks |
| SQS | Asynchronous message to an Amazon SQS queue | Optional (via AWS Step Functions Task Tokens) | External processing system integration |
| EventBridge | Asynchronous event to an Amazon EventBridge bus | Optional (via AWS Step Functions Task Tokens) | Event-driven architecture integration |
| DeadlineCloud | Asynchronous job submission to an AWS Deadline Cloud queue | Required (via AWS Step Functions Task Tokens) | Render farm and batch job submission |
Deadline Cloud availability
The Deadline Cloud execution type requires app.pipelines.deadlineCloudExecutionTypeEnabled and deploys only in the commercial AWS partition. It is unavailable in AWS GovCloud and AWS European Sovereign Cloud deployments.
Built-In Pipelines
VAMS includes twenty-four built-in processing pipelines, each deployable through configuration flags. Pipeline families that ship several model variants register each variant as its own pipeline with its own flag.
| Pipeline | Config Flag | Description | Default |
|---|---|---|---|
| 3D Basic Conversion | useConversion3dBasic | Format conversion between 3D mesh formats using Trimesh | Enabled |
| CAD/Mesh Metadata Extraction | useConversionCadMeshMetadataExtraction | File-level geometric metadata extraction using Trimesh and CADQuery | Disabled |
| Coordinate Transform | useConversionCoordinateTransform | Point cloud coordinate reference system reprojection using PDAL and pyproj | Disabled |
| Point Cloud Potree Viewer | usePreviewPcPotreeViewer | Potree octree generation for browser streaming | Disabled |
| 3D Preview Thumbnail | usePreview3dThumbnail | Animated GIF or static image preview generation | Disabled |
| 3D Gaussian Splat Toolbox | useSplatToolbox | 3D Gaussian splat generation from images and video | Disabled |
| GenAI 3D Metadata Labeling | useGenAiMetadata3dLabeling | AI-powered asset metadata labeling via Amazon Bedrock | Disabled |
| NVIDIA Cosmos Text-to-World 2B v2 | useNvidiaCosmos.modelsPredict.text2world2B_v2 | Video generation from text prompts using Cosmos-Predict2.5 2B | Disabled |
| NVIDIA Cosmos Text-to-World 14B v2 | useNvidiaCosmos.modelsPredict.text2world14B_v2 | High-quality video generation from text prompts using Cosmos-Predict2.5 14B | Disabled |
| NVIDIA Cosmos Video-to-World 2B v2 | useNvidiaCosmos.modelsPredict.video2world2B_v2 | Video generation from video and text input using Cosmos-Predict2.5 2B | Disabled |
| NVIDIA Cosmos Video-to-World 14B v2 | useNvidiaCosmos.modelsPredict.video2world14B_v2 | High-quality video generation from video and text input using Cosmos-Predict2.5 14B | Disabled |
| NVIDIA Cosmos Reason 2B | useNvidiaCosmos.modelsReason.reason2B | Vision Language Model for video analysis and captioning using Cosmos-Reason2 2B | Disabled |
| NVIDIA Cosmos Reason 8B | useNvidiaCosmos.modelsReason.reason8B | Vision Language Model for video analysis and reasoning using Cosmos-Reason2 8B | Disabled |
| NVIDIA Cosmos Transfer 2B | useNvidiaCosmos.modelsTransfer.transfer2B | Style and content transfer with control signal conditioning using Cosmos-Transfer2.5 2B | Disabled |
| NVIDIA Cosmos 3 Nano (16B) | useNvidiaCosmos3.modelsOmni.nano16B | Omnimodal world-model generation using Cosmos3-Nano 16B | Disabled |
| NVIDIA Cosmos 3 Super (64B) | useNvidiaCosmos3.modelsOmni.super64B | Omnimodal world-model generation using Cosmos3-Super 64B | Disabled |
| NVIDIA Cosmos 3 Super Text2Image (64B) | useNvidiaCosmos3.modelsOmni.superText2Image64B | Image generation from text prompts using Cosmos3-Super 64B | Disabled |
| NVIDIA Cosmos 3 Super Image2Video (64B) | useNvidiaCosmos3.modelsOmni.superImage2Video64B | Video generation from an image and text prompt using Cosmos3-Super 64B | Disabled |
| NVIDIA Gr00t N1.5 3B Fine-Tuning | useNvidiaGr00t.modelsFinetune.gr00tN1_5_3B | Fine-tuning of the GR00T-N1.5-3B embodied AI model on LeRobot robot manipulation datasets, with LoRA or full fine-tuning | Disabled |
| Isaac Lab RL Training | useIsaacLabTraining | Reinforcement learning policy training using NVIDIA Isaac Lab | Disabled |
| Isaac Lab RL Evaluation | useIsaacLabTraining | Evaluation of trained reinforcement learning policies using NVIDIA Isaac Lab | Disabled |
| RapidPipeline 3D Processor | useRapidPipeline.useEcs | Licensed 3D model optimization and conversion on Amazon ECS | Disabled |
| RapidPipeline (EKS) | useRapidPipeline.useEks | Licensed 3D model optimization and conversion on Amazon EKS | Disabled |
| VNTANA ModelOps 3D Optimization | useModelOps | Licensed 3D model optimization and conversion using the VNTANA engine | Disabled |
Model variant flags
A model variant flag takes effect only when its family flag is also enabled: useNvidiaCosmos.enabled for the Cosmos Predict, Reason, and Transfer variants, useNvidiaCosmos3.enabled for the Cosmos 3 variants, and useNvidiaGr00t.enabled for the Gr00t variant.
Pipeline Capabilities
- Auto-registration -- Pipelines can auto-register with VAMS on deployment via CDK custom resources
- Auto-trigger on upload -- Configurable automatic pipeline execution when new files are uploaded
- Workflow chaining -- Chain multiple pipelines into multi-step workflows orchestrated by AWS Step Functions
- Custom pipeline support -- Register custom pipelines using the Lambda, SQS, EventBridge, or DeadlineCloud execution types
VPC Requirement
Pipelines that use AWS Batch Fargate containers require useGlobalVpc.enabled to be set to true. VPC endpoints for AWS Batch, Amazon ECR, and Amazon ECR Docker are automatically created when pipelines are enabled.
Infrastructure Features
Deployment Options
| Feature | Configuration | Description |
|---|---|---|
| Amazon CloudFront | useCloudFront.enabled | Default web distribution with AWS-managed TLS certificate |
| CloudFront Custom Domain | useCloudFront.customDomain | Custom domain with ACM certificate and optional Amazon Route 53 hosted zone |
| Application Load Balancer | useAlb.enabled | Alternative web distribution for GovCloud, EU Sovereign Cloud, and VPC-isolated deployments |
| VPC | useGlobalVpc.enabled | Shared VPC with configurable CIDR range or external VPC import |
| VPC Endpoints | useGlobalVpc.addVpcEndpoints | Automatic VPC endpoint creation for all required AWS services |
| External VPC Import | useGlobalVpc.optionalExternalVpcId | Import existing VPC with isolated, private, and public subnets |
Security
| Feature | Configuration | Description |
|---|---|---|
| AWS KMS CMK Encryption | useKmsCmkEncryption.enabled | Customer-managed KMS key for all storage resources |
| External KMS Key | useKmsCmkEncryption.optionalExternalCmkArn | Import an existing AWS KMS CMK |
| AWS WAF | useWaf | Web Application Firewall protection for Amazon CloudFront or Application Load Balancer |
| FIPS Endpoints | useFips | Federal Information Processing Standards compliant endpoints |
| IP Range Restrictions | authorizerOptions.allowedIpRanges | Network-level access control via the custom Lambda authorizer |
| TLS Enforcement | Always on | All Amazon S3 buckets deny non-TLS connections |
| CDK Nag | Always on | AWS Solutions security compliance checks on all resources |
| AWS CloudTrail | addStackCloudTrailLogs | API-level audit logging (enabled by default) |
| Content Security Policy | Dynamic | CSP headers generated based on deployment configuration |
Authentication Providers
| Provider | Configuration | Description |
|---|---|---|
| Amazon Cognito | authProvider.useCognito.enabled | Default authentication with user pool management |
| Amazon Cognito with SAML | authProvider.useCognito.useSaml | SAML federation with Amazon Cognito |
| External OAuth2 | authProvider.useExternalOAuthIdp.enabled | External identity provider with PKCE flow |
Feature Flags
VAMS uses a feature flag system to conditionally enable capabilities at deployment time. Feature flags are persisted to Amazon DynamoDB and read by the web interface at runtime.
| Feature Flag | Description |
|---|---|
GOVCLOUD | Indicates AWS GovCloud deployment mode (also set for AWS European Sovereign Cloud deployments) |
ALLOWUNSAFEEVAL | Enables viewers requiring unsafe-eval CSP (Needle USD, SuperSplat Editor, ThatOpen IFC BIM, Three.js CAD formats) |
LOCATIONSERVICES | Enables Amazon Location Service integration for map views |
ALBDEPLOY | Indicates Application Load Balancer web distribution |
CLOUDFRONTDEPLOY | Indicates Amazon CloudFront web distribution |
NOOPENSEARCH | Indicates Amazon OpenSearch is disabled |
AUTHPROVIDER_COGNITO | Indicates Amazon Cognito authentication |
AUTHPROVIDER_COGNITO_SAML | Indicates Amazon Cognito with SAML federation |
AUTHPROVIDER_COGNITO_OIDC | Indicates Amazon Cognito with OIDC federation |
AUTHPROVIDER_EXTERNALOAUTHIDP | Indicates external OAuth2 authentication |
PHYSNA_ADDON | Enables Physna add-on frontend features (viewer plugin, future Physna-powered UI surfaces). Emitted automatically when app.addons.usePhysnaSync.enabled is true. |
DEADLINECLOUD_PIPELINES | Enables the AWS Deadline Cloud pipeline execution type in the web interface. Emitted automatically when app.pipelines.deadlineCloudExecutionTypeEnabled is true. |
Additional Configuration
- API rate limiting -- Configurable
globalRateLimitandglobalBurstLimiton Amazon API Gateway - Presigned URL timeout -- Configurable expiration for Amazon S3 presigned URLs (default: 86400 seconds)
- Token timeout -- Configurable credential token timeout for Amazon Cognito (default: 3600 seconds)
- Metadata schema auto-loading -- Control which default metadata schemas are loaded on deployment
- External asset buckets -- Register existing Amazon S3 buckets with VAMS for asset management
- Custom Amazon S3 bucket policies -- Additional bucket policy statements via
s3AdditionalBucketPolicyConfig.json - Addon framework -- Garnet Framework integration for NGSI-LD digital twin data synchronization; Physna Sync add-on for one-way synchronization of supported 3D/CAD files and metadata to a Physna for geometric and semantic 3D search