Create Cloud Credentials

• Select the Multi-Cloud Network Connect service.

• Navigate to Manage > Site Management > Cloud Credentials.

Figure Cloud Credentials Page

• Select Add Cloud Credentials.

• Enter a name for the credential you are creating.

• Optionally, add labels and a description to this entry.

Figure: Cloud Credentials Metadata

Select a cloud credential type from the drop-down menu:

• AWS Programmatic Access Credentials
• AWS Assume Role
• Azure Credential Client Certificate
• Azure Client Secret for Service Principal
• GCP Credentials

Figure: Cloud Credential Types

Retrieve your access key ID and secret you intend to use for accessing AWS API services from your AWS Management Console IAM Dashboard. See AWS Identity and Access Management Documentation for more information.

• From the Select Cloud Credential Type menu, select AWS Programmable Access Credentials.

• Enter the AWS Access Key ID that you retrieved from your AWS account.

Figure: Secret AWS Access Key Entry

• Click Configure.

• Secret information can be one of two types via drop-down:

  • Blindfold Secret: Used for secrets managed by Distributed Cloud Secret Management Service (recommended as this service provides a high level of security).

  • Clear Secret: Used for secrets that are not encrypted.

Figure: Configure AWS Access Key

• Policy information can be one of two types via drop-down:

  • Built-in: Provides a list of Distributed Cloud Services provided set of generic policies.

  • Custom: Provides a list of user defined policies which have been defined under Manage > Secrets.

• Enter or paste the text or blindfold value of the AWS Secret Key.

Figure: Secret Access Key Entry

• Click Apply and then click Save and Exit to exit the wizard and save your AWS credentials for use with Distributed Cloud Services.

Create an AWS assume role as described in the AWS VPC Permissions Reference guide and obtain the role_arn value.

• From the Select Cloud Credential Type menu, select AWS Assume Role.

• Enter ARN value in the IAM Role ARN field. Use the value obtained in the previous step.

• Enter a name in the Role Session Name field.

• Enable Show Advanced Fields.

• Set a session duration value in seconds in the Role Session Duration Seconds field. This will limit the role session to the set duration of time.

Note: The session duration value should be less than or equal to the maximum session duration configured in AWS Console.

• Click on the Add Label link in the Role Session Tags field and add labels per your needs.

• Click Apply.

Click Save and Exit to complete creating the cloud credentials of type AWS Assume Role.

Retrieve your Client ID, Subscription ID, Tenant ID, Certificate and Certificate Password you intend to use for accessing Azure API services from your Azure Portal. See Azure Key Vault Reference and Azure Key Vault Quick Start.

• From the Select Cloud Credential Type menu, select Azure Credential Client Certificate.

• Enter the Azure Client ID, Subscription ID, and Tenant ID that you retrieved from your Azure account.

• Enter the URL for Client Certificate in the following format: string:///<base64 encoded string of the certificate>.

Figure: Entries for Azure Client Secret

• Click the Configure link to enter the certificate password you retrieved from Azure Portal and enter in same manner as was done for the AWS Access Secret Key in the AWS Programmable Access Credentials chapter using either the Clear Secret or Blindfold Secret options.

• Click Apply and then click Save and Exit.

• Retrieve your Client ID, Subscription ID, Tenant ID, and Client Secret to use for accessing Azure API services from your Azure Portal. See Azure Key Vault Reference and Azure Key Vault Quick Start.

• From the Select Cloud Credential Type menu, select Azure Client Secret for Service Principal Credentials.

• Enter the Azure Client ID, Subscription ID, and Tenant ID that you retrieved from your Azure account.

Figure: Entries for Azure Client Secret

• Click the Configure link to enter the Secret Key you retrieved from the Azure Portal and enter in same manner as was done for the AWS Secret Key in the AWS Programmable Access Credentials chapter using either the Clear Secret or Blindfold Secret options.

• Click Apply and then click Save and Exit to complete creating Azure credentials.

• Retrieve the service account key for your project from GCP. For information on how to generate a service account key, see the Create and delete service account keys guide.

• From the Select Cloud Credential Type menu, select GCP Credentials.

• Click Configure.

Figure: GCP Credentials

• Enter the service account key you retrieved from the GCP and enter in same manner as was done for the AWS Secret Key in the AWS Programmable Access Credentials chapter using either the Clear Secret or Blindfold Secret options.

• Click Apply and then click Save and Exit to complete creating GCP cloud credentials.