Connecting Cloud Providers
VaultPulse connects to each cloud provider using either long-lived access keys (fastest to set up) or short-lived, OIDC / federated role-based credentials (recommended for production — no long-lived secrets stored). Pick a provider tab below to see setup steps for both methods.
Access Key & Secret
Fastest way to connect. Best for evaluation, sandbox accounts, or environments without an OIDC setup yet.
Create an IAM user for VaultPulse
In the AWS Console, go to IAM → Users → Create user. Name it e.g. vaultpulse-backup-reader.
Attach a scoped permissions policy
Attach an inline policy granting only what VaultPulse needs to read and manage backups:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"backup:List*",
"backup:Get*",
"backup:Describe*",
"backup:CreateBackupPlan",
"backup:CreateBackupSelection",
"backup:StartBackupJob",
"backup:TagResource",
"tag:GetResources"
],
"Resource": "*"
}
]
}Generate an access key
On the user's Security credentials tab, choose Create access key → Third-party service. Copy the Access Key ID and Secret Access Key immediately — the secret is shown only once.
Add the account in VaultPulse
In the dashboard, click Connect Cloud, select AWS Backup, choose AWS Access Key & Secret as the auth type, and paste in your Key ID / Secret and the AWS region.
OIDC / Cross-Account Role (Recommended)
No long-lived secrets are stored. VaultPulse assumes an IAM role in your account using sts:AssumeRole, scoped by an External ID.
Generate an External ID in VaultPulse
Open Connect Cloud in the dashboard, choose IAM Role ARN (OIDC / Cross-Account), and click Generate next to the External ID field. This creates a random, unique value on your device — VaultPulse doesn't assign one automatically, so generate it here first and keep the tab open, you'll paste it into AWS in the next step.
Create an IAM role using that External ID
Go to IAM → Roles → Create role → Custom trust policy. Use a trust policy that only allows VaultPulse's account to assume it, and requires the External ID you just generated:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": { "AWS": "arn:aws:iam::<VAULTPULSE_ACCOUNT_ID>:root" },
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": { "sts:ExternalId": "<PASTE_YOUR_GENERATED_EXTERNAL_ID>" }
}
}
]
}Replace <VAULTPULSE_ACCOUNT_ID> with the AWS account ID VaultPulse shows you in the Connect Cloud modal, and <PASTE_YOUR_GENERATED_EXTERNAL_ID> with the value from Step 1.
Attach the same backup permissions policy
Attach the identical permissions policy shown in the Access Key tab (List/Get/Describe/Create backup plan, selection, job, tagging).
Copy the Role ARN
Copy the role's ARN, e.g. arn:aws:iam::123456789012:role/VaultPulseBackupRole.
Finish connecting in VaultPulse
Back in the Connect Cloud modal, paste the Role ARN — the External ID field should already have the value you generated in Step 1. VaultPulse will assume this role for every API call; nothing is stored except the ARN and External ID.
Because credentials are never stored, this is the preferred method for production and multi-account organizations.
Need a hand connecting an account?
Reach out and we'll walk through your org's IAM setup with you.