diff --git a/docs/en_us/data/source/Images/Access_AmazonS3.png b/docs/en_us/data/source/Images/Access_AmazonS3.png
new file mode 100644
index 0000000000..d8e3379ea0
Binary files /dev/null and b/docs/en_us/data/source/Images/Access_AmazonS3.png differ
diff --git a/docs/en_us/data/source/Images/Data_Czar_Initialization.png b/docs/en_us/data/source/Images/Data_Czar_Initialization.png
index d5ace3d687..3dd5574663 100644
Binary files a/docs/en_us/data/source/Images/Data_Czar_Initialization.png and b/docs/en_us/data/source/Images/Data_Czar_Initialization.png differ
diff --git a/docs/en_us/data/source/internal_data_formats/credentials.rst b/docs/en_us/data/source/internal_data_formats/credentials.rst
index 1609594303..8449d19c79 100644
--- a/docs/en_us/data/source/internal_data_formats/credentials.rst
+++ b/docs/en_us/data/source/internal_data_formats/credentials.rst
@@ -139,7 +139,11 @@ The **credentials.csv.gpg** file is likely to be the first file that you
 decrypt with your private GPG key. You use the same process to decrypt the data
 package files that you retrieve from Amazon S3.
 
-.. image
+ .. image:: ../Images/Access_AmazonS3.png
+  :alt: Flowchart of edX collecting files for the data package and then
+      encrypting, compressing, and uploading them to Amazon S3 and of data czar
+      decrypting access credentials, accessing S3 bucket, and then downloading,
+      extracting, and decrypting data package files
 
 .. _Decrypt an Encrypted File: