Skip to main content

Managing Cloud Credentials

The Cloud Credentials page is where you manage the connection between ImageFactory and your cloud environments. To build and distribute images, ImageFactory requires specific permissions within your cloud accounts or subscriptions.

Credentials Overview​

The page displays a list of all onboarded cloud accounts, grouped by their respective cloud provider (AWS, Azure, GCP, Exoscale, or VMware).

Status Indicators​

Each credential entry includes a status indicator that reflects the health of the connection:

  • ACCESS_SUCCESS (Green Checkmark): ImageFactory has successfully validated access to the account with the provided credentials.
  • ACCESS_MISSING (Yellow Warning): Some required permissions are missing, which may limit certain functionalities like image distribution or cleanup.
  • ACCESS_ERROR (Red X): ImageFactory cannot access the account. This could be due to invalid credentials, expired secrets, or deleted IAM roles.

Adding a New Account​

To onboard a new cloud environment, click the Add Credential button and select your provider. You will need to provide the following information based on the platform:

AWS​

  • Account ID and Alias: The unique AWS account identifier and a friendly name.
  • IAM Role ARN: The Amazon Resource Name of the role ImageFactory should assume.
  • External ID: The unique string used when assuming the IAM role for cross-account access.
  • Scope: The target environment (e.g., PUBLIC or CHINA).
  • Sharing Options: Configure whether to share images with specific accounts, entire organizations, or organizational units (OUs).

Azure​

  • Subscription ID and Tenant ID: Your Azure subscription and directory identifiers.
  • App ID and Client Secret: The credentials for the Service Principal that ImageFactory will use.
  • Resource Group and Storage Account: The targets for temporary build artifacts.
  • Shared Image Gallery: The destination for finished images.

GCP​

  • Project ID: The unique identifier for your Google Cloud project.
  • Service Account JSON: The full JSON key file for the service account with the necessary permissions.

Exoscale​

  • API Key and API Secret: The credentials used to access the Exoscale API.

Managing Existing Credentials​

Once an account is onboarded, you can perform several management actions:

  1. Edit: Update the credentials or configuration settings if they change in your cloud environment.
  2. Recheck: After fixing permission issues in your cloud console, use the Recheck button to trigger an immediate validation of the connection.
  3. Delete: Remove the account from ImageFactory. Note that this will prevent any templates from building images for this account.
Via API

You can automate the onboarding of cloud accounts using the GraphQL API. This is particularly useful for organizations with a large number of accounts that need to be managed programmatically.

mutation AddCloudAccount($input: CreateAccountInput!) {
  createAccount(input: $input) {
    account {
      id
      name
      status
    }
  }
}

mutation ValidateAccount($id: ID!) {
  recheckAccount(id: $id) {
    status
    errors
  }
}

Maintaining healthy cloud credentials is essential for the continuous operation of your image factory. Regularly monitoring the status indicators ensures that your image builds and distribution tasks proceed without interruption.