Skip to main content

Cloud Accounts

Cloud Accounts in Klarity ImageFactory represent the target environments where your golden images are stored and shared. These accounts act as the destination for the build process. Once an image is successfully created and tested, ImageFactory distributes it to the configured cloud accounts, making it available for use within those specific environments.

Managing these accounts correctly is vital for ensuring that your images reach the right teams and projects across your organization.

Account Properties​

Each cloud account entry in ImageFactory contains several important fields.

  • Provider: The cloud platform (e.g., AWS, Azure, GCP).
  • Cloud Provider ID: The native identifier for the account, such as an AWS Account ID or an Azure Subscription ID.
  • Alias: A user-friendly name to help identify the account within the ImageFactory UI.
  • Description: Optional text providing more context about the account's purpose.
  • Scope: Defines the environment type, either PUBLIC for standard regions or CHINA for specialized regions in mainland China.
  • Credentials: The sensitive information required to access the cloud provider's API.
  • Properties: Additional metadata or configuration specific to the provider.

Account States and Validation​

ImageFactory continuously monitors the health and accessibility of your cloud accounts. Each account is assigned a state based on the latest access check.

  • ACCESS_SUCCESS: The platform can successfully connect to the account using the provided credentials.
  • ACCESS_MISSING: Credentials haven't been provided or are incomplete.
  • ACCESS_ERROR: The platform encountered an error while attempting to connect. This could be due to expired credentials, insufficient permissions, or network issues.

Recheck Account Feature​

You can manually trigger a credential validation at any time using the "Recheck" feature. This is particularly useful after updating credentials or modifying IAM policies in the target cloud environment.

Provider-Specific Credentials​

The information required to connect varies significantly between cloud providers.

AWS​

For AWS, ImageFactory supports two primary authentication methods.

  1. IAM Role ARN: The preferred method. You provide a Role ARN and an External ID. ImageFactory assumes this role to perform distribution tasks.
  2. Access Keys: You provide an Access Key ID and a Secret Access Key.

Azure​

Azure accounts require a set of service principal details and storage configuration.

  • App ID and Password: The credentials for the Azure Service Principal.
  • Tenant ID: The ID of the Azure Active Directory tenant.
  • Storage Account: Used for temporary data during the image creation process.
  • Shared Image Gallery: The destination gallery where images will be published.
  • Resource Group: The group containing the gallery and other related resources.

GCP​

Google Cloud Platform uses service account keys.

  • Service Account JSON: The complete JSON key file generated for the GCP service account.

Exoscale​

  • API Key and Secret: The credentials used to access the Exoscale API.

IBM Cloud​

  • API Key: The key used for authentication.
  • Region: The target IBM Cloud region.
  • COS Bucket: The Cloud Object Storage bucket used for image artifacts.
  • Resource Group: The target resource group.

Advanced AWS Sharing Features​

AWS accounts support advanced sharing mechanisms that allow you to distribute images to multiple targets efficiently.

  • awsShareAccounts: A list of specific AWS Account IDs that should have access to the image.
  • awsShareOrganizations: A list of AWS Organization IDs. Any account within these organizations will be able to use the image.
  • awsShareOus: A list of Organizational Unit (OU) IDs. This allows for more granular sharing within an AWS Organization.

These features use the native AMI sharing capabilities of AWS, ensuring that images are available where they're needed without the overhead of copying them to every individual account.

China Scope Support​

ImageFactory provides dedicated support for AWS and Azure regions in China. Because these environments are physically and logically separated from the global cloud regions, they require specific configuration.

When you set the scope of a cloud account to CHINA, ImageFactory uses the appropriate endpoints and authentication protocols for those regions. This allows organizations with a presence in China to maintain the same golden image standards as they do in their global operations.

Security Best Practices​

When onboarding cloud accounts, it's important to follow the principle of least privilege.

  1. Dedicated Service Principals: Create a dedicated IAM role or Service Principal for ImageFactory.
  2. Minimal Permissions: Grant only the permissions necessary for image distribution and management. For example, in AWS, the role needs permissions to describe images, modify image attributes, and interact with the specified EBS volumes.
  3. Regular Rotation: Rotate your credentials regularly according to your organization's security policy.
  4. Use Role-Based Access: Prefer IAM roles with External IDs over long-lived access keys whenever possible.

By carefully managing your cloud accounts and their credentials, you can build a secure and reliable distribution network for your organization's golden images.