Keyless AWS and Google Cloud sync¶
Keyless sync lets CertifyClouds copy Azure Key Vault secrets and certificates to AWS or Google Cloud without storing an AWS access key or Google Cloud service account key. You grant this deployment access in the destination cloud. Stored keys remain supported.
You need a PRO or ENTERPRISE licence and a CertifyClouds deployment running with an Azure managed identity. Keyless sign-in is unavailable when CertifyClouds runs with a person's Azure CLI sign-in.
1. Prepare the Azure identity¶
Run the access setup script with the managed identity's object ID. The --sync-federation option creates a single-tenant App Registration with a Sync.Federate role and assigns that role to the managed identity. It creates no client secret or certificate. Preview first, then apply:
./setup-certifyclouds-access.sh --principal-id <MANAGED_IDENTITY_OBJECT_ID> --sync-federation
./setup-certifyclouds-access.sh --principal-id <MANAGED_IDENTITY_OBJECT_ID> --sync-federation --apply
CertifyClouds finds the new App Registration by itself, with no restart. Allow up to ten minutes, or reload Settings to check. To pin a specific App Registration instead, set SYNC_FEDERATION_APP_ID_URI on the deployment to the App ID URI the script prints, such as api://<APP_ID>. The script is safe to run again. The Azure operator needs permission to create App Registrations, service principals and role assignments.
In Settings → Cloud Providers, choose Keyless (recommended). The card shows this deployment's issuer, audience and subject. Use those exact values in the destination cloud, including the issuer's final slash. They identify the Microsoft Entra tenant, the intended recipient and this managed identity.
2. Let AWS trust CertifyClouds¶
In the AWS account, create an OIDC identity provider with the card's Issuer as its URL and Audience as its client ID. Create an IAM role whose trust policy allows sts:AssumeRoleWithWebIdentity only for that provider, audience and subject. The card generates the trust policy and AWS CLI commands for your deployment. Replace only your AWS account ID and role name.
Grant the role only the Secrets Manager and Certificate Manager permissions needed for the copies you choose to sync. Scope the resources to those copies where possible. See the AWS permissions example. Paste the role ARN into the AWS card and select the region.
3. Let Google Cloud trust CertifyClouds¶
In your Google Cloud project, create a workload identity pool and an OIDC provider. Set the issuer URI to the card's Issuer, the allowed audience to its Audience, and map google.subject to assertion.sub. Bind roles/iam.workloadIdentityUser on the sync service account to the pool principal for the card's Subject. The card provides gcloud commands. Replace your project ID, project number, pool and provider names, and service account address.
Grant that service account only the Secret Manager or Certificate Manager permissions needed for the copies you choose to sync. See the Google Cloud permissions example. Paste the provider resource name and the service account address into the Google Cloud card. The provider name must be projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>; do not add //iam.googleapis.com/. The card uses its project number, pool and provider in the generated gcloud commands.
4. Check and save¶
Select Keyless (recommended) on each card you use. Choose Check to confirm that the destination accepts this deployment's sign-in. Then choose Save Configuration. Save runs the destination sign-in check again and removes stored keys only if that check succeeds. If it fails, the saved keys and sign-in mode stay in place. A new Google Cloud service account permission can take a few minutes to apply, so retry Check if it is refused just after setup.
When sync runs, the selected Azure Key Vault secret or certificate value and its relevant metadata are sent to the destination cloud you chose. The destination also receives an Azure identity assertion containing the issuer, audience and subject shown on the card. CertifyClouds does not send an AWS access key or Google Cloud key file in Keyless mode.