Cloud Providers

VeraID integrates natively with major cloud providers to discover, import, and govern non-human identities across your infrastructure. Each integration supports automated synchronization, credential rotation, and continuous monitoring.

Amazon Web Services (AWS)

Capabilities

• IAM User Sync — Automatically discover and import IAM users, access keys, and service-linked roles into VeraID.
• Access Key Rotation — Schedule automatic rotation of long-lived access keys with zero-downtime grace periods.
• Role Assumption — Monitor and govern cross-account role assumption chains, including trust policy analysis.
• CloudTrail Integration — Ingest CloudTrail events for real-time activity monitoring and anomaly detection on all IAM entities.

Setup

1. Create an IAM Role for VeraID

Create a dedicated IAM role in your AWS account that VeraID will assume to perform sync and management operations.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VeraIDIdentityRead",
      "Effect": "Allow",
      "Action": [
        "iam:ListUsers",
        "iam:ListRoles",
        "iam:ListServiceAccounts",
        "iam:ListAccessKeys",
        "iam:GetUser",
        "iam:GetRole",
        "iam:GetAccessKeyLastUsed",
        "iam:ListUserTags",
        "iam:ListRoleTags",
        "iam:ListAttachedUserPolicies",
        "iam:ListAttachedRolePolicies",
        "iam:GetLoginProfile"
      ],
      "Resource": "*"
    },
    {
      "Sid": "VeraIDKeyRotation",
      "Effect": "Allow",
      "Action": [
        "iam:CreateAccessKey",
        "iam:UpdateAccessKey",
        "iam:DeleteAccessKey"
      ],
      "Resource": "arn:aws:iam::*:user/*"
    },
    {
      "Sid": "VeraIDCloudTrailRead",
      "Effect": "Allow",
      "Action": [
        "cloudtrail:LookupEvents",
        "cloudtrail:GetTrailStatus"
      ],
      "Resource": "*"
    }
  ]
}

2. Configure the Trust Policy

Add the VeraID external ID to the role’s trust policy to enable secure cross-account access.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "veraid-org-YOUR_ORG_ID"
        }
      }
    }
  ]
}

Note

Your organization’s external ID is available in the VeraID dashboard under Settings > Integrations > AWS. This value is unique to your organization and prevents confused deputy attacks.

3. Add the Integration in VeraID

Navigate to Settings > Integrations > Cloud Providers and select AWS. Provide:

• Role ARN — The ARN of the IAM role you created (e.g., arn:aws:iam::123456789012:role/VeraIDIntegration).
• External ID — Automatically populated from your organization settings.
• Regions — Select which AWS regions to scan for identities.
• Sync Interval — How often VeraID should synchronize (minimum 5 minutes).

---

Google Cloud Platform (GCP)

Capabilities

• Service Account Sync — Discover and import all service accounts, including their keys, IAM bindings, and associated projects.
• Key Rotation — Automatically rotate service account keys on a configurable schedule, with grace periods for key propagation.
• Workload Identity — Monitor workload identity federation configurations and ensure identity mappings follow least-privilege principles.
• Audit Logging — Ingest Cloud Audit Logs for real-time tracking of service account activity, including data access and admin activity logs.

Setup

1. Create a dedicated service account in your GCP project with the following roles:
   • roles/iam.serviceAccountViewer
   • roles/iam.serviceAccountKeyAdmin (for key rotation)
   • roles/logging.viewer (for audit log ingestion)
2. Generate a JSON key file for the service account.
3. In VeraID, navigate to Settings > Integrations > Cloud Providers > GCP and upload the key file.
4. Select the projects to include in synchronization.

Caution

Store the GCP service account key securely. VeraID encrypts the key at rest using envelope encryption, but the initial upload should be done over a secure connection. Consider using workload identity federation instead of long-lived keys where possible.

---

Microsoft Azure

Capabilities

• App Registration Sync — Discover and import all Azure AD app registrations, including their client secrets, certificates, and API permissions.
• Client Secret Rotation — Schedule automatic rotation of client secrets with configurable overlap periods to prevent service disruption.
• Managed Identity — Track system-assigned and user-assigned managed identities across your Azure subscriptions.
• Key Vault Integration — Sync secrets stored in Azure Key Vault, monitor access patterns, and enforce rotation policies.

Setup

1. Register a VeraID application in Azure AD with the following API permissions:
   • Application.Read.All
   • Directory.Read.All
   • AuditLog.Read.All
2. Grant admin consent for the permissions.
3. Create a client secret for the VeraID application.
4. In VeraID, navigate to Settings > Integrations > Cloud Providers > Azure and provide:
   • Tenant ID
   • Client ID (Application ID)
   • Client Secret
   • Subscriptions to include in sync

Tip

For enhanced security, use a certificate-based credential instead of a client secret for the VeraID Azure integration. Upload the certificate in the Azure portal and provide the PFX file in VeraID settings.

---

Kubernetes

Capabilities

• Service Account Sync — Discover and import all Kubernetes service accounts across namespaces, including their bound tokens and secrets.
• Token Rotation — Automate rotation of long-lived service account tokens and migrate workloads to projected volume tokens.
• Secret Management — Monitor Kubernetes secrets containing credentials, certificates, and API keys, with drift detection.
• RBAC Integration — Analyze ClusterRoleBindings and RoleBindings to map effective permissions for each service account.

Setup

1. Create a dedicated service account in your cluster with read access to the resources VeraID needs to monitor:

kubectl create serviceaccount veraid-sync -n veraid-system
kubectl create clusterrolebinding veraid-sync \
  --clusterrole=view \
  --serviceaccount=veraid-system:veraid-sync

2. Generate a long-lived token or configure OIDC federation.
3. In VeraID, provide the cluster API endpoint and authentication credentials.

Note

VeraID supports both in-cluster and external cluster configurations. For multi-cluster environments, add each cluster as a separate integration and use labels to organize them.

---

Sync Configuration

All cloud provider integrations share a common configuration structure. You can manage sync settings via the API or the dashboard.

{
  "provider": "AWS",
  "enabled": true,
  "syncInterval": "15m",
  "autoImport": true,
  "filters": {
    "includeTags": {
      "environment": ["production", "staging"]
    },
    "excludeTags": {
      "veraid-ignore": ["true"]
    },
    "includePatterns": ["svc-*", "app-*"],
    "excludePatterns": ["temp-*", "test-*"]
  },
  "rotation": {
    "enabled": true,
    "intervalDays": 90,
    "gracePeriodHours": 24,
    "notifyBeforeDays": 14
  }
}

Field	Type	Description
provider	string	Cloud provider identifier: AWS, GCP, AZURE, KUBERNETES
enabled	boolean	Whether automatic sync is active
syncInterval	string	How often to run sync (e.g., 5m, 15m, 1h, 6h)
autoImport	boolean	Automatically import newly discovered identities into VeraID
filters	object	Tag-based and pattern-based filters to include or exclude identities
rotation	object	Credential rotation settings including schedule and notification

Tip

Start with autoImport: false when connecting a new cloud provider. Review discovered identities in the VeraID dashboard before enabling automatic import to avoid ingesting test or deprecated service accounts.

Multi-Cloud Correlation

When the same logical identity exists across multiple cloud providers (e.g., a deployment pipeline with AWS and GCP credentials), VeraID automatically correlates them using naming conventions, tags, and metadata. Correlated identities appear as a single entity in the dashboard with a unified risk score and activity timeline.

To improve correlation accuracy, apply consistent tags across providers:

{
  "veraid-identity": "deploy-pipeline-prod",
  "veraid-owner": "platform-team",
  "veraid-environment": "production"
}