truefalsestderr
plaintextpubkey:///pubkeyfullpath/file.pem
csvjson
stdoutfilenonetcp\://host:portsocket:///fullpath/syslog://host:port
| Cover image | ||
|---|---|---|
| Amazon Web Services (AWS) | /files/v4mrUCXHHMMPWyoaauYL | /pages/UUPIKAfYVmUBeMET9SCN |
| Google Cloud Provider (GCP) | /files/N3dwdTfx6yrCCxGcyEYE | /pages/DsHGXx583UBuXcKuwaJ5 |
| Microsoft Azure + Entra ID | /files/TLZbV5KLI2sraWMBUBYX | /pages/RT5cL7YdLQOFlgcFOfbO |
| Okta | /files/qful5wdtC78gHxgfRxWZ |
```yml inputs: - kind: AutomaticTaskInput propertyName: database shouldPromptUser: false inputSettings: defaultValue: =Blank() ``` 4. Click **Save**. The agent is now able to pass an optional database name when executing SQL commands. {% hint style="info" %} Alternatively, instead of using the code view, you can use the graphical tool input editor to add a `database` input field, configure it not to re-prompt the user, and set it to an empty value (no value) if not found. {% endhint %} ## End User Authentication When an end user first interacts with a StrongDM tool through a Copilot agent, the agent prompts them to connect to the StrongDM control plane. After clicking the **Connection Manager** link, they are taken to a page where they can select or create a connection for the custom connector created previously. Clicking **Sign in** takes the user to the StrongDM OAuth endpoint. If they are not already authenticated, they are prompted to log in to their StrongDM account and are then prompted to connect. Clicking **Connect** associates this specific agent instance with the displayed StrongDM user account. The user can then return to the agent and click **Retry** to continue. This connection flow grants the agent a token that can be used to issue requests for up to three days, as long as the associated authentication remains valid. If the user explicitly logs out of StrongDM or the organization's session timeout is reached, the token is no longer valid. If a user needs to change or delete the connection, they can do so in the **Connections** section of the Microsoft Power Apps page. {% hint style="info" %} Access is enforced strictly based on the user's existing StrongDM entitlements. If a user does not have access to a resource in StrongDM, they cannot access it through Copilot. Although resources that the user is able to request access to (but does not currently have) are not visible through Copilot, the user can request access to such resources through the StrongDM UI. Once access is approved, those resources will become accessible through Copilot. {% endhint %} ## Auditing and Logging All commands executed through the Copilot connector are logged in StrongDM's existing audit surfaces, just as any other user interaction with a resource would be. When viewed in the StrongDM Admin UI, log entries created through the Copilot integration also indicate the integration associated with the entry. {% hint style="info" %} The CLI, SDKs, and Log Stream interfaces do not currently include Copilot integration activity. Copilot-related access is visible in the Admin UI activity logs only. This is intentional during the tech preview. Additionally, a "User authorized integration" activity is logged to the activity logs whenever an end user authorizes a Microsoft Copilot Studio agent. {% endhint %} ## Troubleshooting ### User cannot authenticate through the Copilot agent Verify that the user has an active StrongDM account and is able to log in to StrongDM directly. The OAuth flow requires a valid StrongDM user identity. Also verify that the integration settings in StrongDM match those in the custom connector, particularly the Client ID. ### User cannot see or access a resource Confirm that the user is entitled to the resource in StrongDM. Go to **Access** > **Roles** in the Admin UI and verify that the resource is attached to a role the user is a member of. The connector enforces the same entitlements as any other StrongDM access method. If the user is unable to access a specific database on a resource (rather than the default database), verify that the optional database parameter is enabled as described in [Optional: Enable Database Targeting](#optional-enable-database-targeting-for-execute-sql-command). Also check that the resource configuration in StrongDM does not have **Restrict Database** (for PostgreSQL resources) or **Override Default Database** (for Microsoft SQL Server) set in a way that conflicts. ### Commands fail or time out * Check that the StrongDM node (gateway, relay, or proxy cluster) that has access to the target resource is online and healthy. You can verify node status in the Admin UI under **Networking**. * In Tech Preview, check to verify that the command Copilot ran is using the StrongDM resource ID rather than the resource name. Sometimes during testing, Copilot mistakenly used the resource name. This is a known issue that will be corrected for in the future. * For SSH resources, check whether the resource requires a lock and verify that the user account associated with the agent is currently holding that lock. * Ensure that the request will not generate a response exceeding 512 KiB or require more than 25 seconds to execute. Try requesting data in smaller batches. * Ensure that the request and response do not contain non-UTF-8 characters. * If a request fails with a `429` error mentioning resource exhaustion, this likely indicates that too many Copilot agents in the organization are concurrently executing commands against StrongDM. ### Commands that were working have started failing Check that the user is still authenticated to StrongDM and still has access to the desired resource. The SDM authentication token may have expired independently of Copilot (for example, due to a session timeout or explicit logout). Try disconnecting and reconnecting to StrongDM in the agent's Connection Manager to refresh the authentication. ### Error code reference The following table shows common error codes and their meanings. | Error | Meaning | | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `400 Command execution failed: invalid operation: commands can only be executed against the default database on this resource` | The optional database parameter is not configured, or the resource does not allow targeting a non-default database. | | `401 permission denied` | The user's authentication is invalid (expired, logged out, or the account has been deleted). | | `403 Command execution failed: permission denied` | The user is authenticated but no longer has access to the target resource. | | `429 resource exhausted: Sorry! You've made too many requests…` | Too many Copilot agents in the organization are executing commands simultaneously. | | `500 failed to execute command: permission denied: access denied` | The SSH resource requires a lock that the user has not acquired. | | `500 Deadline exceeded - execution time limit exceeded` | The command exceeded the 25-second execution time limit. | | `500 Invalid byte sequence for encoding "UTF8"` | The command or its response contains non-UTF-8 characters. | | `500 Response size exceeds maximum allowed size of 524,288 bytes` | The response exceeded the 512 KiB size limit. Try requesting data in smaller batches. | | `ConnectorTimeoutError` (The connector has timed out after 240000 seconds) | Copilot's 30-second timeout was hit before StrongDM responded. Despite the message text, this usually indicates a connectivity issue (for example, no egress node is available to reach the target resource). | ### Still encountering issues? Contact your StrongDM Tech Preview team. When reaching out, please provide the following information: * Integration name * Resource name or resource ID * Error message and code displayed in the Copilot agent * StrongDM account of the affected user # PagerDuty Integration StrongDM integration with PagerDuty that allows on-call members of PagerDuty schedules to receive access to specified resources within StrongDM while on call. Many organizations manage incident response software that contains groups of users that are on call at any given time. The PagerDuty integration allows your StrongDM organization to connect directly to PagerDuty using an OAuth app and sync selected on-call schedules. Each time the integration syncs (every 15 minutes, or when triggered manually), it checks which PagerDuty users are on call on the selected schedules, and if it matches those users to StrongDM users, it adds them to a group in StrongDM. Once those groups exist within StrongDM, admins can then grant them standing access to resources using roles. This would ensure that people who are on call from that schedule always have access to those resources through StrongDM. Admins can also define access workflows to allow those users who are on call to request access to resources for a limited time. Those requests can be configured to be approved either manually by selected approvers or automatically. Either way, the requests are logged and interactions audited. Access can be made even more granular through the use of [access policies](/admin/access/policies). ## Prerequisites * Administrator permission level for your StrongDM user in order to create and configure the integration and grant access to the resulting groups. * A PagerDuty user with appropriate privileges to create and manage OAuth App integrations. ## PagerDuty Setup 1. Log in to PagerDuty as an admin. 2. Go to **Integrations** > **App Registration** > **My Apps** and then select **New App**. 3. Fill in a **Name** and **Description** with values that are useful to your PagerDuty administrators. 4. Select **OAuth 2.0**. In the app configuration screen, choose scoped OAuth if prompted, and then select the scopes you want to grant to the integration. For the StrongDM integration to function effectively, the following scopes are required (adjusting the scopes later may require reauthorizing the app): 1. `oncalls.read` 2. `schedules.read` 3. `users.read` 5. Save the app. After saving, PagerDuty shows you the Client ID and Client Secret. {% hint style="warning" %} You need both values for StrongDM integration setup. The client secret is only shown at creation time, so store it securely. {% endhint %} ## StrongDM Setup in the Admin UI 1. In the StrongDM Admin UI, navigate to the **Integrations** page. 2. Under **Incident Management**, click **Connect** on the PagerDuty item. 3. Fill in the required fields in the pop-out window.
| Field | Requirement | Description |
|---|---|---|
| Name | Required | Name for the OAuth app, such as "StrongDM Integration" |
| Instance URL | Required | Your organization's PagerDuty URL; this must be a full URL, including https://, and is parsed for your organization's PagerDuty subdomain and region, if any (for example, https://your-subdomain.pagerduty.com or https://your-subdomain.eu.pagerduty.com) |
| Client ID | Required | Client ID of the OAuth app used for the StrongDM integration |
| Client Secret | Required | Client Secret of the OAuth app used for the StrongDM integration; shown only once at creation |
| User Lookup Attribute | Required | Email or Identity Alias depending on whether you are using StrongDM user emails to correlate with PagerDuty users, or using StrongDM Identity Aliases to correlate to PagerDuty users |
| Field | Requirement | Description |
|---|---|---|
| Name | Required | Name for the integration, such as "StrongDM Integration" |
| API Key | Required | API key for Incident.io |
| User Lookup Attribute | Required | Email or Identity Alias depending on whether you are using StrongDM user emails to correlate with Incident.io users, or using StrongDM Identity Aliases to correlate to Incident.io users |
Gateway 1
Gateway 2
Resource); A-->|traffic|B; ``` The peering group functions in an ingress capacity, meaning that clients can connect directly to its gateways. This group must contain at least one gateway, and it must contain at least one resource because as the only peering group in this topology, it also functions in an egress capacity (that is, it facilitates the connection to the resources). #### Topology 2 Topology 2 includes two peering groups that are peered together using a link. A link is an established connection between one specified peering group and another target peering group. Links are created manually. In the CLI, for example, a link is created by using a command and specifying the peering groups to connect: `sdm admin network link ingress-group egress-group`. Once a link is created, the peering actually works in reverse; the peering group that is providing the egress functionality (that is, the access to resources) peers with, or connects to, the peering group that is providing ingress functionality (that is, the group that is connected to by the client). When groups are linked and peering occurs, traffic can then flow from the client to the resource unimpeded. ```mermaid graph LR; A((Client)); B(Ingress Peering Group
Gateway 1
Gateway 2); C(Egress Peering Group
Relay 1
Relay 2
Resource); A-->|traffic|B; B-->|traffic|C; C-. link .-> B; ``` There are several reasons why one might wish to separate ingress and egress into two separate groups. It can help with the isolation of resources to further protect them, and it can also allow segmented geographic networks to access a shared set of resources while using different network resources. For example, let's say you have a peering group with resources in it, but there are two different links set up from geographically disparate peering groups that allow incoming traffic. In this example situation, traffic can be more local to the user until it needs to be routed to the resources. #### Topology 3 Topology 3 incorporates three peering groups that are peered together with links, as described in Topology 2. This arrangement, however, adds a third function to the link relationship: the bridge. The peering group that functions as a bridge sits between the ingress and egress peering groups, allowing for even further isolation and segmentation. As with any other arrangement, links connect the peering groups together, and links are created manually. In the CLI, for example, links are created by using a command and specifying all three peering groups to connect: `sdm admin network link ingress-group bridge-group egress-group`. The egress group peers with the bridge group, which then peers with the ingress group. Traffic is then allowed to flow in the reverse direction, from the client to the ingress group to the bridge group to the egress group, where the resources are attached. ```mermaid graph LR; A((Client)); B(Ingress Peering Group
Gateway 1
Gateway 2); C(Bridge Peering Group
Gateway 3
Gateway 4); D(Egress Peering Group
Relay 1
Relay 2
Resource); A-->|traffic|B; B-->|traffic|C; C-->|traffic|D; C-. link .-> B; D-. link .-> C; ``` {% hint style="warning" %} A peering group that provides user ingress cannot function in a bridge or egress capacity anywhere in the network. If a peering group initiates any peering itself, it is no longer eligible to accept client connections as an ingress peering group. {% endhint %} #### Possible linking errors The links between peering groups must create a route for client traffic that doesn't loop around the network endlessly. Client traffic must be able to flow from the entry point of the network (a peering group that has attached gateways) to an exit (a peering group that has attached nodes and resources). **Error message** Any attempt to create a loop results in an error, as in the following example from the CLI: ```sh $ sdm admin network create group-a g-344cb0d865131f01 $ sdm admin network create group-b g-0cbf0d9065131f05 $ sdm admin network create group-c g-6cf058f865131f26 $ sdm admin network link group-a group-b $ sdm admin network link group-b group-c $ sdm admin network link group-a group-c time="2023-09-26T11:13:29-07:00" level=error msg=[cli.Error] error="cannot link peering groups: aborted: loop detector blocked peering groups link: invalid operation: detected loop between g-6cf058f865131f26 and g-344cb0d865131f01" cannot link peering groups: aborted: loop detector blocked peering groups link: invalid operation: detected loop between g-6cf058f865131f26 and g-344cb0d865131f01 ``` #### Network segmentation example use cases **Regions are completely segmented** In this example, the network contains separate gateways, relays, resources, and peering groups for three distinct geographic regions. This topology is ideal because users are connected to resources within their region. ```mermaid graph LR; A((Client)); B(US-W Ingress Peering Group
Gateway 1); C(US-W Egress Peering Group
Relay 1
US-W Resource); A-->|US-W traffic|B; B-->|traffic|C; C-. link .-> B; D(US-E Ingress Peering Group
Gateway 2); E(US-E Egress Peering Group
Relay 2
US-E Resource); A-->|US-E traffic|D; D-->|traffic|E; E-. link .-> D; F(EU-Central Ingress Peering Group
Gateway 3); G(EU-Central Egress Peering Group
Relay 3
EU-Central Resource); A-->|EU-Central traffic|F; F-->|traffic|G; G-. link .-> F; ``` **All regions are served by one gateway** In this example, the network contains an ingress peering group with an attached gateway, and three regional peering groups that have a matching regional resource attached. In this topology, the network is not completely segmented, but only one gateway is needed and client traffic can be routed to region-specific resources as intended. ```mermaid graph RL; A(Ingress Peering Group
Gateway); B(US-W Egress Peering Group
Relay 1
US-W Resource); C(US-E Egress Peering Group
Relay 2
US-E Resource); D(EU-Central Egress Peering Group
Relay 3
EU-Central Resource); E((Client)); B-. link .-> A; C-. link .-> A; D-. link .-> A; A---|all traffic|E ``` **All regions use the same gateway and resource** In this example, the network contains an ingress peering group with an attached gateway, and three regional peering groups that all have the same resource attached. The network is not segmented, and the route system may choose an inefficient path for the client traffic. ### ```mermaid graph RL; A(Ingress Peering Group
Gateway); B(US-W Egress Peering Group
Relay 1
Resource 1); C(US-E Egress Peering Group
Relay 2
Resource 1); D(EU-Central Egress Peering Group
Relay 3
Resource 1); E((Client)); B-. link .-> A; C-. link .-> A; D-. link .-> A; A---E ``` ### Enforcement Modes The network can operate with or without peering groups enabled at all. When peering groups are not enabled, new peering groups and links cannot be created. Nodes will attempt to communicate with all available gateways and resources. Peering groups can be enabled with one of three enforcement modes: permissive, exclusive, or strict. #### Permissive mode Permissive mode allows the network to operate with optional peering groups, for routing purposes only. In permissive mode, the link between nodes behaves as in off mode, where every node attempts to connect to every other node. Resources in a peering group are only routable from nodes in peering groups. Resources not in a peering group are routable from any reachable path, whether through nodes in peering groups or not. The client receives and tries to connect to all gateways, regardless of their location or network availability. If the user attempts to connect to a resource in a peering group, the user's client traffic is routed accordingly using the peering group(s) to which the resource is attached. Furthermore, when permissive mode is enforced, any resources not in a peering group can be used as if peering groups are off. That means that if the user attempts to connect to a resource that is not in a peering group, the user's client traffic is routed using default route calculation logic. The flow of client traffic moves as if the network is working in off mode, where gateways listen for client connections, and they peer with every other available node in the network. #### Exclusive mode Exclusive mode is similar to permissive mode, in that it allows the network to operate with or without peering groups, but exclusive mode is more restrictive. In exclusive mode, the network operates with mutually exclusive peering group and non-peering group nodes and resources. Resources in a peering group are only routable from nodes in the same peering group or in a linked peering group. Likewise, resources not in a peering group are only routable from nodes not in a peering group. Nodes in a peering group do not communicate with nodes not in a peering group. #### Strict mode Strict mode forces the network to use explicit routing. Nodes only communicate with nodes in linked peering groups and resources in the same peering group. {% hint style="warning" %} In strict mode, nodes and resources not in a peering group are unreachable. {% endhint %} When strict mode is enforced, peering group nodes only connect to nodes in a linked peering group. For example, if group A is linked to group B, peering group nodes in group A only connect to peering group nodes in group B. Nodes that are not in a peering group don't connect to any peers. Moreover, the client receives only the subset of gateways that can accept incoming client connections. If the user attempts to connect to a resource in a peering group, the user's client traffic is routed accordingly using the peering group(s) to which the resource is attached. If the user attempts to connect to a resource that is not in a peering group, the user is unable to connect. ### Recommendations If explicit routing is used, we generally recommend the following order of operations: 1. Learn whether the network has peering groups on or off. 2. If you wish to use peering groups, set the network to operate in permissive mode. 3. Create peering groups. 4. Attach nodes and resources to peering groups. 5. Create links between peering groups. 6. View your network topology to understand how you have set it up. 7. Manage peering groups and make changes as needed. ### Manage the Network with the CLI You can manage and define your StrongDM network in the CLI with [sdm admin network](/references/cli/admin/network) and its subcommands: * `sdm admin network enforce` sets the enforcement level (mode) for peering groups. * `sdm admin network create` creates a new network peering group. * `sdm admin network delete` deletes a network peering group and all its dependencies. * `sdm admin network list` lists all network peering groups. * `sdm admin network show` shows details of a network peering group. * `sdm admin network attach` attaches a resource or a node to a peering group. * `sdm admin network detach` detaches a resource or a node from a peering group. * `sdm admin network link` creates a link between two peering groups by ensuring that the target group can receive connections from the specified group. * `sdm admin network unlink` removes the link between two peering groups. * `sdm admin network topology` draws the current network topology. * `sdm admin network route` returns information about a route for a given resource. #### View the network's enforcement level When setting up your network, the first action to take is to find out if the network has peering groups on or off. If peering groups are on, you also need to know which mode is enforced. Use the following command to view the current enforcement level: ```sh sdm admin network enforce ``` In response, the current mode is shown. Possible responses and their meanings are as follows: * `off`: Peering groups are disabled. * `permissive`: Peering groups are enabled and the network is working in permissive mode. * `exclusive`: Peering groups are enabled and the network is working in exclusive mode. * `strict`: Peering groups are enabled and the network is working in strict mode. #### Set enforcement level for peering groups In the CLI, modes are set using the command `sdm admin network enforce` and the arguments `off`, `permissive`, `exclusive`, or `strict`. In response, the value set is shown. Turn on peering groups and set permissive mode: ```sh sdm admin network enforce permissive ``` Turn on peering groups and set exclusive mode: ```sh sdm admin network enforce exclusive ``` Turn on peering groups and set strict mode: ```sh sdm admin network enforce strict ``` Turn off peering groups: ```sh sdm admin network enforce off ``` {% hint style="info" %} If peering groups are configured and you wish to change the mode to "off," you must first delete the peering groups. {% endhint %} See the CLI Reference for a copy of the help text available for [sdm admin network](/references/cli/admin/network#enforce). #### Create a new network peering group To create a new peering group, use the following command and enter a name for the peering group: ```sh sdm admin network create
type=\ (example: type=postgres),source=store
type=\ (example: type=postgres),successful=true
peer\_id=\,peer\_addr=\
| Cover image | ||
|---|---|---|
| Amazon Web Services (AWS) | /files/v4mrUCXHHMMPWyoaauYL | /pages/UUPIKAfYVmUBeMET9SCN |
| Google Cloud Provider (GCP) | /files/N3dwdTfx6yrCCxGcyEYE | /pages/DsHGXx583UBuXcKuwaJ5 |
| Microsoft Azure + Entra ID | /files/TLZbV5KLI2sraWMBUBYX | /pages/RT5cL7YdLQOFlgcFOfbO |
| Okta | /files/qful5wdtC78gHxgfRxWZ |
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Cloud Type | Required | Select AWS Management Console (Static key pair) if you are using an AWS static key pair for authentication |
| Proxy Cluster | Required | Defaults to "None (use gateways)"; if using proxy clusters, select the appropriate cluster to proxy traffic to this resource |
| Connectivity Mode | Required | Select either Virtual Networking Mode, which lets users connect to the resource with a software-defined, IP-based network; or Loopback Mode, which allows users to connect to the resource using the local loopback adapter in their operating system; this field is shown if Virtual Networking Mode enabled for your organization |
| IP Address | Optional | If Virtual Networking Mode is the selected connectivity mode, an IP address value in the configured Virtual Networking Mode subnet in the organization network settings; if Loopback Mode is the selected connectivity mode, an IP address value in the configured Loopback IP range in the organization network settings (by default, 127.0.0.1); if not specified, an available IP address in the configured IP address space for the selected connectivity mode will be automatically assigned; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization |
| Port Override | Optional | If Virtual Networking Mode is the selected connectivity mode, a port value between 1 and 65535 that is not already in use by another resource with the same IP address; if Loopback Mode is the selected connectivity mode, a port value between 1024 to 64999 that is not already in use by another resource with the same IP address; when left empty with Virtual Networking Mode, the system assigns the default port to this resource; when left empty for Loopback Mode, an available port that is not already in use by another resource is assigned; preferred port also can be modified later from the Port Overrides settings |
| DNS | Optional | If Virtual Networking Mode is the selected connectivity mode, a unique hostname alias for this resource; when set, causes the desktop app to display this resource's human-readable DNS name (for example, k8s.my-organization-name) instead of the bind address that includes IP address and port (for example, 100.64.100.100:5432) |
| HTTP Subdomain | Required | What is used as your local DNS address (for example, app-prod1 turns into http://app-prod1.<your-org-name>.sdm.network/) |
| Secret Store | Optional | Credential store location; defaults to none (credentials are stored in StrongDM resource configuration) |
| Access Key ID | Required | String generated by AWS that comprises half of an access key (for example, AKIAIOSFODNN7EXAMPLE) |
| Secret Access Key | Required | String generated by AWS that comprises the other half of an access key (for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY) |
| Region | Required | AWS region to connect to (for example, us-west-2) |
| Assume Role ARN | Required | Amazon Resource Name (ARN) role to assume after login (for example, arn:aws:iam::000000000000:role/RoleName); required in order to ensure that multiple relays or gateways do not authenticate using different credentials into the AWS Management Console |
| Assume Role External ID | Optional | External ID role to assume after login (for example 12345) |
| Session Expiry Seconds | Optional | Length of time, in seconds, the AWS Management Console sessions live before needing to reauthenticate (for example, 3600); must be greater than 900 and less than 43200 |
| Authentication | Required | Select Leased Credential, which uses Leased Credentials to access the cloud, or Identity Aliases, which uses the Identity Aliases of StrongDM users to access the cloud |
| Identity Set | Required | Displays if Authentication is set to Identity Aliases; select an Identity Set name from the list |
| Healthcheck Username | Required | If Authentication is set to Identity Aliases, enter the username that should be used to verify StrongDM's connection to it; note that the username must already exist in your AWS Management Console |
| Use HTTPS | Optional | Enabled by default; when enabled, StrongDM uses HTTPS for the connection |
| Resource Tags | Optional | Enter datasource /spaces/4XOJmXFslCMVCzIG2rKp/pages/anUqbOAAmDPD3e0fF6GO consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Cloud Type | Required | AWS (Instance Profile) |
| Proxy Cluster | Required | Defaults to "None (use gateways)"; if using proxy clusters, select the appropriate cluster to proxy traffic to this resource |
| Connectivity Mode | Required | Select either Virtual Networking Mode, which lets users connect to the resource with a software-defined, IP-based network; or Loopback Mode, which allows users to connect to the resource using the local loopback adapter in their operating system; this field is shown if Virtual Networking Mode enabled for your organization |
| IP Address | Optional | If Virtual Networking Mode is the selected connectivity mode, an IP address value in the configured Virtual Networking Mode subnet in the organization network settings; if Loopback Mode is the selected connectivity mode, an IP address value in the configured Loopback IP range in the organization network settings (by default, 127.0.0.1); if not specified, an available IP address in the configured IP address space for the selected connectivity mode will be automatically assigned; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization |
| Port Override | Optional | If Virtual Networking Mode is the selected connectivity mode, a port value between 1 and 65535 that is not already in use by another resource with the same IP address; if Loopback Mode is the selected connectivity mode, a port value between 1024 to 64999 that is not already in use by another resource with the same IP address; when left empty with Virtual Networking Mode, the system assigns the default port to this resource; when left empty for Loopback Mode, an available port that is not already in use by another resource is assigned; preferred port also can be modified later from the Port Overrides settings |
| DNS | Optional | If Virtual Networking Mode is the selected connectivity mode, a unique hostname alias for this resource; when set, causes the desktop app to display this resource's human-readable DNS name (for example, k8s.my-organization-name) instead of the bind address that includes IP address and port (for example, 100.64.100.100:5432) |
| Secret Store | Optional | Credential store location; defaults to none (credentials are stored in StrongDM resource configuration) |
| Enable Environment Variables | Optional | When selected, lets you use environment variables to authenticate connection even if EC2 roles are configured |
| Assume Role ARN | Optional | Amazon Resource Name (ARN) role to assume after login (for example, arn:aws:iam::000000000000:role/RoleName) |
| Region | Required | AWS region to connect to (for example, us-west-2) |
| Assume Role External ID | Optional | External ID role to assume after login (for example 12345) |
| Resource Tags | Optional | Enter /spaces/4XOJmXFslCMVCzIG2rKp/pages/anUqbOAAmDPD3e0fF6GO consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Cloud Type | Required | AWS |
| Proxy Cluster | Required | Defaults to "None (use gateways)"; if using proxy clusters, select the appropriate cluster to proxy traffic to this resource |
| Connectivity Mode | Required | Select either Virtual Networking Mode, which lets users connect to the resource with a software-defined, IP-based network; or Loopback Mode, which allows users to connect to the resource using the local loopback adapter in their operating system; this field is shown if Virtual Networking Mode enabled for your organization |
| IP Address | Optional | If Virtual Networking Mode is the selected connectivity mode, an IP address value in the configured Virtual Networking Mode subnet in the organization network settings; if Loopback Mode is the selected connectivity mode, an IP address value in the configured Loopback IP range in the organization network settings (by default, 127.0.0.1); if not specified, an available IP address in the configured IP address space for the selected connectivity mode will be automatically assigned; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization |
| Port Override | Optional | If Virtual Networking Mode is the selected connectivity mode, a port value between 1 and 65535 that is not already in use by another resource with the same IP address; if Loopback Mode is the selected connectivity mode, a port value between 1024 to 64999 that is not already in use by another resource with the same IP address; when left empty with Virtual Networking Mode, the system assigns the default port to this resource; when left empty for Loopback Mode, an available port that is not already in use by another resource is assigned; preferred port also can be modified later from the Port Overrides settings |
| DNS | Optional | If Virtual Networking Mode is the selected connectivity mode, a unique hostname alias for this resource; when set, causes the desktop app to display this resource's human-readable DNS name (for example, k8s.my-organization-name) instead of the bind address that includes IP address and port (for example, 100.64.100.100:5432) |
| Secret Store | Optional | Credential store location; defaults to none (credentials are stored in StrongDM resource configuration) |
| Access Key ID | Required | Access key ID, such as AKIAIOSFODNN7EXAMPLE, from your AWS key pair |
| Secret Access Key | Required | Secret access key, such as wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY, from your AWS key pair |
| Assume Role ARN | Optional | Amazon Resource Name (ARN) role to assume after login (for example, arn:aws:iam::000000000000:role/RoleName) |
| Healthcheck Region | Required | AWS region that healthchecks should attempt to connect to (for example, us-west-2) |
| Assume Role External ID | Optional | External ID role to assume after login (for example 12345) |
| Resource Tags | Optional | Enter /spaces/4XOJmXFslCMVCzIG2rKp/pages/anUqbOAAmDPD3e0fF6GO consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Cloud Type | Required | GCP Web Console (Workforce Identity Federation) |
| Proxy Cluster | Required | Defaults to "None (use gateways)"; if using proxy clusters, select the appropriate cluster to proxy traffic to this resource |
| Connectivity Mode | Required | Select either Virtual Networking Mode, which lets users connect to the resource with a software-defined, IP-based network; or Loopback Mode, which allows users to connect to the resource using the local loopback adapter in their operating system; this field is shown if Virtual Networking Mode enabled for your organization |
| IP Address | Optional | If Virtual Networking Mode is the selected connectivity mode, an IP address value in the configured Virtual Networking Mode subnet in the organization network settings; if Loopback Mode is the selected connectivity mode, an IP address value in the configured Loopback IP range in the organization network settings (by default, 127.0.0.1); if not specified, an available IP address in the configured IP address space for the selected connectivity mode will be automatically assigned; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization |
| Port Override | Optional | If Virtual Networking Mode is the selected connectivity mode, a port value between 1 and 65535 that is not already in use by another resource with the same IP address; if Loopback Mode is the selected connectivity mode, a port value between 1024 to 64999 that is not already in use by another resource with the same IP address; when left empty with Virtual Networking Mode, the system assigns the default port to this resource; when left empty for Loopback Mode, an available port that is not already in use by another resource is assigned; preferred port also can be modified later from the Port Overrides settings |
| DNS | Optional | If Virtual Networking Mode is the selected connectivity mode, a unique hostname alias for this resource; when set, causes the desktop app to display this resource's human-readable DNS name (for example, k8s.my-organization-name) instead of the bind address that includes IP address and port (for example, 100.64.100.100:5432) |
| HTTP Subdomain | Required | What is used as your local DNS address (for example, app-prod1 turns into https://app-prod1.<your-org-name>.sdm.network/) |
| Scopes | Required | For the "GCP (Workforce Identity Federation)" resource type only; space-separated scopes that this login should assume into when authenticating (for example, https://www.googleapis.com/auth/cloud-platform) |
| Workforce Identity Pool ID | Required | ID of the Workforce Identity Pool for GCP to use for federated SAML authentication (such as exampleco-test-pool) |
| Workforce Identity Provider ID | Required | ID of the Workforce Identity Provider for GCP to use for federated SAML authentication (such as sdm-test-provider) |
| Session Expiry Seconds | Optional | Length of time, in seconds, of GCP sessions before needing to reauthenticate (for example, 3600); must be greater than 900 and less than 43200 |
| Project ID | Optional | For the "GCP CLI/SDK (Workforce Identity Federation)" resource type only; the ID of the project that should be forced |
| Authentication | Required | Select Leased Credentials to use the user's email when logging their actions within GCP, or Identity Aliases, to use Identity Aliases of StrongDM users for log events within GCP |
| Identity Set | Required | Displays if Authentication is set to Identity Aliases; select an Identity Set name from the list |
| Healthcheck Username | Required | If Authentication is set to Identity Aliases, enter the username that should be used to verify StrongDM's connection to it |
| Resource Tags | Optional | Enter /spaces/4XOJmXFslCMVCzIG2rKp/pages/anUqbOAAmDPD3e0fF6GO consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
$ sdm admin clouds add gcp "gcp-cli-sdk-prod"
--svc-keyfile "/etc/strongdm/keys/gcp-service-account.json"
--scopes "https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/userinfo.email"
--bind-interface "default"
--port-override -1
--egress-filter 'field:name tag:env=prod tag:region=us-central'
--proxy-cluster-id "plc_0123456789abcdef"
--secret-store-id "ss_abcdef0123456789"
--subdomain "gcp-cli-prod01"
--tags "env=prod,cloud=gcp,auth=service-account,team=platform"
--timeout 30
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Enter a meaningful name for this resource; this name displays throughout StrongDM; do not include special characters like quotes (") or angle brackets (< or >) |
| Cloud Type | Required | GCP CLI/SDK (Service Account) |
| Proxy Cluster | Required | Defaults to "None (use gateways)"; if using proxy clusters, select the appropriate cluster to proxy traffic to this resource |
| Connectivity Mode | Required | Select either Virtual Networking Mode, which lets users connect to the resource with a software-defined, IP-based network; or Loopback Mode, which allows users to connect to the resource using the local loopback adapter in their operating system; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization; this field is shown if Virtual Networking Mode enabled for your organization |
| IP Address | Optional | If Virtual Networking Mode is the selected connectivity mode, an IP address value in the configured Virtual Networking Mode subnet in the organization network settings; if Loopback Mode is the selected connectivity mode, an IP address value in the configured Loopback IP range in the organization network settings (by default, 127.0.0.1); if not specified, an available IP address in the configured IP address space for the selected connectivity mode will be automatically assigned; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization |
| Port Override | Optional | If Virtual Networking Mode is the selected connectivity mode, a port value between 1 and 65535 that is not already in use by another resource with the same IP address; if Loopback Mode is the selected connectivity mode, a port value between 1024 to 64999 that is not already in use by another resource with the same IP address; when left empty with Virtual Networking Mode, the system assigns the default port to this resource; when left empty for Loopback Mode, an available port that is not already in use by another resource is assigned; preferred port also can be modified later from the Port Overrides settings |
| DNS | Optional | If Virtual Networking Mode is the selected connectivity mode, a unique hostname alias for this resource; when set, causes the desktop app to display this resource's human-readable DNS name (for example, k8s.my-organization-name) instead of the bind address that includes IP address and port (for example, 100.64.100.100:5432) |
| Secret Store | Optional | Credential store location; defaults to none (credentials are stored in StrongDM resource configuration) |
| Service Account Keyfile (JSON) | Required | Either paste the contents of the service account key file (JSON) that you saved when you created the Google Cloud service account, or import the key file |
| Scopes | Required | Enter the access scope(s) (for example, https://www.googleapis.com/auth/cloud-platform) to allow authentication to Google cloud APIs. If setting multiple scopes, separate them with a space |
| Resource Tags | Optional | Enter /spaces/4XOJmXFslCMVCzIG2rKp/pages/anUqbOAAmDPD3e0fF6GO consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | A meaningful name for this resource; displays throughout StrongDM; no special characters like quotes (") or angle brackets (< or >) |
| Cloud Type | Required | Microsoft Entra ID |
| Proxy Cluster | Required | Defaults to “None (use gateways)”; if using proxy clusters, select the appropriate cluster to be used for Entra ID group manipulation |
| Discovery Enabled | Optional | Enable discovery for this resource |
| Tenant ID | Required | Azure Tenant ID |
| Subscription ID | Optional | Subscription ID restricts available discovered groups to those within a subscription; appears when discovery is enabled |
| Management Group ID | Optional | Management Group ID restricts available discovered groups to those within a management group; appears when discovery is enabled |
| Resource Group ID | Optional | Resource Group ID restricts available discovered groups to those within a resource group; appears when discovery is enabled |
| Group Names | Optional | Filter string(s) that restrict available discovered groups, comma separated; supports wildcards such as "M365 Admin*"; appears when discovery is enabled |
| Privilege Levels | Required | Exact names of the Entra ID groups that you want to provision access to, comma separated, such as sdm_group1,sdm_group2; appears when discovery is not enabled |
| Identity Set | Required | Identity Set to map to use to map StrongDM users to Entra ID users |
| Resource Tags | Optional | Enter tags consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | A meaningful name for this resource; displays throughout StrongDM; no special characters like quotes (") or angle brackets (< or >) |
| Resource Type | Required | Okta Groups |
| Proxy Cluster | Required | Defaults to “None (use gateways)”; if using proxy clusters, select the appropriate cluster to be used for group manipulation |
| Okta Domain Name | Required | The organization domain URL saved previously |
| Discovery Enabled | Optional | Enable discovery for this resource; Discovered data displayed in the **Discovery** tab |
| Group Names | Optional | Names of the discovered Okta groups that you want to appear as privilege level options in StrongDM; Supports wildcard characters such as `*` and are matched case-insensitively; should be comma separated, such as: sdm_group1,sdm_group2; this field appears when discovery is enabled |
| Privilege Levels | Required | Exact names of the Okta groups that you want to provision access to, comma separated, such as sdm_group1,sdm_group2; this field appears when discovery is not enabled |
| Identity Set | Required | Identity Set to map to use to map StrongDM users to Okta users |
| Resource Tags | Optional | Enter tags consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Datasource Type | Required | Snowsight (Snowflake Web Console) |
| Proxy Cluster | Required | Defaults to "None (use gateways)"; if using proxy clusters, select the appropriate cluster to proxy traffic to this resource |
| Connectivity Mode | Required | Select either Virtual Networking Mode, which lets users connect to the resource with a software-defined, IP-based network; or Loopback Mode, which allows users to connect to the resource using the local loopback adapter in their operating system; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization; this field is shown if Virtual Networking Mode enabled for your organization |
| IP Address | Optional | If Virtual Networking Mode is the selected connectivity mode, an IP address value in the configured Virtual Networking Mode subnet in the organization network settings; if Loopback Mode is the selected connectivity mode, an IP address value in the configured Loopback IP range in the organization network settings (by default, 127.0.0.1); if not specified, an available IP address in the configured IP address space for the selected connectivity mode will be automatically assigned; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization |
| Port Override | Optional | If Virtual Networking Mode is the selected connectivity mode, a port value between 1 and 65535 that is not already in use by another resource with the same IP address; if Loopback Mode is the selected connectivity mode, a port value between 1024 to 64999 that is not already in use by another resource with the same IP address; when left empty with Virtual Networking Mode, the system assigns the default port to this resource; when left empty for Loopback Mode, an available port that is not already in use by another resource is assigned; preferred port also can be modified later from the Port Overrides settings |
| DNS | Optional | If Virtual Networking Mode is the selected connectivity mode, a unique hostname alias for this resource; when set, causes the desktop app to display this resource's human-readable DNS name (for example, k8s.my-organization-name) instead of the bind address that includes IP address and port (for example, 100.64.100.100:5432) |
| Subdomain | Required | What is used as your local DNS address (for example, app-prod1 turns into http://app-prod1.<your-org-name>.sdm.network/) |
| Secret Store | Optional | Credential store location; defaults to none (credentials are stored in StrongDM resource configuration) |
| SAML Metadata | Required | Metadata XML blob from your Snowflake IdP integration |
| Connect to the Default ACS | Optional | For orgs that have multiple ACSs in their SAML metadata, StrongDM default behavior is to connect to the first one; check this to indicate in the metadata which should be the default |
| Healthcheck Username | Required | In order for healthchecks to be successful, must be the email of a StrongDM user who has access to this resource, and must also match your Snowflake Login Name (that is, not Username or Email) |
| Use HTTPS | Optional | Enabled by default; when enabled, StrongDM uses HTTPS for the connection |
| Resource Tags | Optional | Datasource /spaces/4XOJmXFslCMVCzIG2rKp/pages/anUqbOAAmDPD3e0fF6GO consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
Admin wants to configure a new privilege level called Engineering, which allows users to get pod A in a particular cluster.] style id1 fill:#ffffff style A fill:#ffffff style B fill:#ffffff, text-align:left style E fill:#eaeded, text-align:left style F fill:#ffffff, text-align:left style G fill:#eaeded, text-align:left style H fill:#ffffff, text-align:left style I text-align:left style J text-align:left style K text-align:left style L text-align:left style M fill:#eaeded, text-align:left A((StrongDM
User)) --> M(whoami: none
kubectl get pod A) --> B@{ shape: subproc, label: "StrongDM
Assign Identity Alice
Assign Privilege Engineering" }; B --- E subgraph C[Kubernetes Cluster] direction LR E(whoami: StrongDM
kubectl get pod A
--as Alice
--as-group Engineering)--> F F[kube-apiserver] --> G G(whoami: Alice, Engineering
kubectl get pod A)--> H H[pod A] end subgraph C I@{ shape: doc, label: "kind: RoleBinding
name: strongdm-binding
subject: user StrongDM
roleRef: impersonate-role" } ~~~ J J@{ shape: doc, label: "kind: Role
name: impersonate-role
action: impersonate
resource: user Alice
resource: group Engineering" } ~~~ K K@{ shape: doc, label: "kind: RoleBinding
name: engineering-binding
subject: group Engineering
roleRef: pod-get-role" } ~~~ L L@{ shape: doc, label: "kind: Role
name: pod-get-role
action: get
resource: pod A" } end ``` ## Configure Clusters to Use Privilege Levels In order to correctly leverage privilege levels, you must set up RBAC resources on your cluster to map your Leased Credentials or Identity Aliases to Kubernetes Roles or ClusterRoles. Go through the following steps, creating the appropriate Kubernetes objects as you see fit, or confirming that you have objects to fulfill the intended purpose. 1. Define the permissions for the privilege level: To define what exactly granting a privilege level `engineering` enables a user to do in your cluster, create a Role/ClusterRole. In the following example, we wish to let users watch, get, or list pods when they are granted the privilege level `engineering`: ```yaml # engineering role apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: default name: engineering rules: - apiGroups: [""] # "" indicates the core API group resources: ["pods"] verbs: ["watch","get","list"] ``` 2. Associate the Role with the Kubernetes group matching your privilege level: Create a RoleBinding or ClusterRoleBinding, associating the Role or ClusterRole to the group `engineering`: ```yaml # engineering role binding apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: engineering namespace: default subjects: # You can specify more than one "subject" - kind: Group name: engineering # "name" is case sensitive apiGroup: rbac.authorization.k8s.io roleRef: kind: Role apiGroup: rbac.authorization.k8s.io name: engineering namespace: default ``` 3. Allow StrongDM to impersonate the group `engineering`: Create another ClusterRole, granting permission to impersonate the group `engineering`. If you are using privilege levels alongside [Identity Aliases](/admin/resources/clusters/kubernetes-identity-alias), you likely need to grant permission to impersonate all users. The following example grants permission to impersonate all users, groups, and service accounts: ```yaml # impersonator minimal permissions # needed to elevate privileges. apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: sdm-impersonator rules: # impersonate all users, groups, and service accounts # needed for Identity Aliases to work. - apiGroups: [""] # "" indicates the core API group resources: ["users", "groups", "serviceaccounts"] verbs: ["impersonate"] ``` 4. Associate the `impersonator` ClusterRole with the Kubernetes User or Service Account whose credentials you intend to use to add the cluster resource to StrongDM: ```yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: sdm-impersonator-binding subjects: # Specify the Kubernetes User or ServiceAccount whose credentials you are using in StrongDM - kind: User name:
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Cluster Type | Required | AKS |
| Proxy Cluster | Required | Defaults to "None (use gateways)"; if using proxy clusters, select the appropriate cluster to proxy traffic to this resource |
| Hostname | Required | Hostname or IP address of the API server, such as api.aks.example.com; relay server should be able to connect to your target server or hostname |
| Port | Required | Port to connect to the API server; default port value 443 |
| Connectivity Mode | Required | Select either Virtual Networking Mode, which lets users connect to the resource with a software-defined, IP-based network; or Loopback Mode, which allows users to connect to the resource using the local loopback adapter in their operating system; this field is shown if Virtual Networking Mode enabled for your organization |
| IP Address | Optional | If Virtual Networking Mode is the selected connectivity mode, an IP address value in the configured Virtual Networking Mode subnet in the organization network settings; if Loopback Mode is the selected connectivity mode, an IP address value in the configured Loopback IP range in the organization network settings (by default, 127.0.0.1); if not specified, an available IP address in the configured IP address space for the selected connectivity mode will be automatically assigned; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization |
| Port Override | Optional | If Virtual Networking Mode is the selected connectivity mode, a port value between 1 and 65535 that is not already in use by another resource with the same IP address; if Loopback Mode is the selected connectivity mode, a port value between 1024 to 64999 that is not already in use by another resource with the same IP address; when left empty with Virtual Networking Mode, the system assigns the default port to this resource; when left empty for Loopback Mode, an available port that is not already in use by another resource is assigned; preferred port also can be modified later from the Port Overrides settings |
| DNS | Optional | If Virtual Networking Mode is the selected connectivity mode, a unique hostname alias for this resource; when set, causes the desktop app to display this resource's human-readable DNS name (for example, k8s.my-organization-name) instead of the bind address that includes IP address and port (for example, 100.64.100.100:5432) |
| Secret Store | Optional | Credential store location; defaults to none (credentials are stored in StrongDM resource configuration); to learn more, see Secret Store options |
| Server CA | Optional | Pasted server certificate (plaintext or Base64-encoded), or imported PEM file; you can either generate the server certificate on the API server or get it in Base64 format from your existing Kubernetes configuration (kubeconfig) file |
| Client Certificate | Optional | Pasted client certificate (plaintext or Base64-encoded), or imported PEM file; you can either generate the client certificate on the API server or get it in Base64 format from your existing Kubernetes configuration (kubeconfig) file |
| Client Key | Optional | Pasted client key (plaintext or Base64-encoded) or imported PEM file; you can either generate the client key on the API server or get it in Base64 format from your existing Kubernetes configuration (kubeconfig) file |
| Healthcheck Namespace | Optional | If enabled for your organization, the namespace used for the resource healthcheck; defaults to default if empty; supplied credentials must have the rights to perform one of the following kubectl commands in the specified namespace: get pods, get deployments, or describe namespace |
| Enable Resource Discovery | Optional | Enables automatic discovery within this cluster |
| Authentication | Required | Authentication method to access the cluster; select either Leased Credential (default) or Identity Aliases (to use the Identity Aliases of StrongDM users to access the cluster) |
| Identity Set | Required | Displays if Authentication is set to Identity Aliases; select an Identity Set name from the list |
| Healthcheck Username | Required | If Authentication is set to Identity Aliases, the username that should be used to verify StrongDM's connection to it; username must already exist on the target cluster |
| Resource Tags | Optional | Resource /spaces/4XOJmXFslCMVCzIG2rKp/pages/anUqbOAAmDPD3e0fF6GO consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Cluster Type | Required | Elastic Kubernetes Service |
| Proxy Cluster | Required | Defaults to "None (use gateways)"; if using proxy clusters, select the appropriate cluster to proxy traffic to this resource |
| Endpoint | Required | API server endpoint of the EKS cluster in the format <ID>.<REGION>.eks.amazonaws.com, such as A95FBC180B680B58A6468EF360D16E96.yl4.us-west-2.eks.amazonaws.com; relay server should be able to connect to your EKS endpoint |
| Connectivity Mode | Required | Select either Virtual Networking Mode, which lets users connect to the resource with a software-defined, IP-based network; or Loopback Mode, which allows users to connect to the resource using the local loopback adapter in their operating system; this field is shown if Virtual Networking Mode enabled for your organization |
| IP Address | Optional | If Virtual Networking Mode is the selected connectivity mode, an IP address value in the configured Virtual Networking Mode subnet in the organization network settings; if Loopback Mode is the selected connectivity mode, an IP address value in the configured Loopback IP range in the organization network settings (by default, 127.0.0.1); if not specified, an available IP address in the configured IP address space for the selected connectivity mode will be automatically assigned; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization |
| Port Override | Optional | If Virtual Networking Mode is the selected connectivity mode, a port value between 1 and 65535 that is not already in use by another resource with the same IP address; if Loopback Mode is the selected connectivity mode, a port value between 1024 to 64999 that is not already in use by another resource with the same IP address; when left empty with Virtual Networking Mode, the system assigns the default port to this resource; when left empty for Loopback Mode, an available port that is not already in use by another resource is assigned; preferred port also can be modified later from the Port Overrides settings |
| DNS | Optional | If Virtual Networking Mode is the selected connectivity mode, a unique hostname alias for this resource; when set, causes the desktop app to display this resource's human-readable DNS name (for example, k8s.my-organization-name) instead of the bind address that includes IP address and port (for example, 100.64.100.100:5432) |
| Secret Store | Optional | Credential store location; defaults to none (credentials are stored in StrongDM resource configuration) |
| Access Key ID | Required | Access key ID, such as AKIAIOSFODNN7EXAMPLE, from the AWS key pair that you created in Step 1 |
| Secret Access Key | Required | Secret access key, such as wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY, from the AWS key pair that you created in Step 1 |
| Server CA | Optional | Pasted server certificate (plaintext or Base64-encoded), or imported PEM file; you can either generate the server certificate on the API server or get it in Base64 format from your existing Kubernetes configuration (kubeconfig) file |
| Cluster Name | Required | Name of the EKS cluster |
| Region | Required | Region of the EKS cluster, such as us-west-1 |
| Healthcheck Namespace | Optional | If enabled for your organization, the namespace used for the resource healthcheck; defaults to default if empty; supplied credentials must have the rights to perform one of the following kubectl commands in the specified namespace: get pods, get deployments, or describe namespace |
| Enable Resource Discovery | Optional | Enables automatic discovery within this cluster |
| Authentication | Required | Authentication method to access the cluster; select either Leased Credential (default) or Identity Aliases (to use the Identity Aliases of StrongDM users to access the cluster) |
| Identity Set | Required | Displays if Authentication is set to Identity Aliases; select an Identity Set name from the list |
| Healthcheck Username | Required | If Authentication is set to Identity Aliases, the username that should be used to verify StrongDM's connection to it; username must already exist on the target cluster |
| Assume Role ARN | Optional | Role ARN, such as arn:aws:iam::000000000000:role/RoleName, that allows users accessing this resource to assume a role using AWS AssumeRole functionality |
| Assume Role External ID | Optional | External ID if leveraging an external ID to users assuming a role from another account; if used, it must be used in conjunction with Assume Role ARN; see the AWS documentation on using external IDs for more information |
| Resource Tags | Optional | Resource /spaces/4XOJmXFslCMVCzIG2rKp/pages/anUqbOAAmDPD3e0fF6GO consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
NAME:
sdm admin clusters add amazon-eks-instance-profile - create Elastic Kubernetes Service (instance profile) cluster
USAGE:
sdm admin clusters add amazon-eks-instance-profile [command options] <name>
OPTIONS:
--allow-resource-role-bypass (For legacy orgs) allows users to fallback to the existing authentication mode (Leased Credential or Identity Set) when a resource role is not provided.
--bind-interface value IP address on which to listen for connections to this resource on clients. Specify "default", "loopback", or "vnm" to automatically allocate an available address from the corresponding IP range configured in the organization. (default: "default")
--certificate-authority value (secret)
--cluster-name value (required)
--discovery-enabled Enable discovery for the cluster.
--discovery-username value The user to impersonate in the cluster when running discovery. Required if the cluster is configured for identity aliases. (conditional)
--egress-filter value apply filter to select egress nodes e.g. 'field:name tag:key=value ...'
--endpoint value (required)
--healthcheck-namespace default This path will be used to check the health of your connection. Defaults to default.
--identity-alias-healthcheck-username value (conditional)
--identity-set-id value
--identity-set-name value set the identity set by name
--port-override value Port on which to listen for connections to this resource on clients. Specify "-1" to automatically allocate an available port. (default: -1)
--proxy-cluster-id value proxy cluster id
--region value (required)
--role-arn value (secret)
--role-external-id value (secret)
--secret-store-id value secret store id
--subdomain value, --bind-subdomain value DNS subdomain through which this resource may be accessed on clients (e.g. "app-prod" allows the resource to be accessed as "app-prod.<your-org-name>.<sdm-proxy-domain>"). Only applicable to HTTP-based resources or resources using virtual networking mode.
--tags value tags e.g. 'key=value,...'
--template, -t display a JSON template
--timeout value set time limit for command
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Cluster Type | Required | Elastic Kubernetes Service (instance profile) |
| Proxy Cluster | Required | Defaults to "None (use gateways)"; if using proxy clusters, select the appropriate cluster to proxy traffic to this resource |
| Endpoint | Required | API server endpoint of the EKS cluster in the format <ID>.<REGION>.eks.amazonaws.com, such as A95FBC180B680B58A6468EF360D16E96.yl4.us-west-2.eks.amazonaws.com; relay server should be able to connect to your EKS endpoint |
| Connectivity Mode | Required | Select either Virtual Networking Mode, which lets users connect to the resource with a software-defined, IP-based network; or Loopback Mode, which allows users to connect to the resource using the local loopback adapter in their operating system; this field is shown if Virtual Networking Mode enabled for your organization |
| IP Address | Optional | If Virtual Networking Mode is the selected connectivity mode, an IP address value in the configured Virtual Networking Mode subnet in the organization network settings; if Loopback Mode is the selected connectivity mode, an IP address value in the configured Loopback IP range in the organization network settings (by default, 127.0.0.1); if not specified, an available IP address in the configured IP address space for the selected connectivity mode will be automatically assigned; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization |
| Port Override | Optional | If Virtual Networking Mode is the selected connectivity mode, a port value between 1 and 65535 that is not already in use by another resource with the same IP address; if Loopback Mode is the selected connectivity mode, a port value between 1024 to 64999 that is not already in use by another resource with the same IP address; when left empty with Virtual Networking Mode, the system assigns the default port to this resource; when left empty for Loopback Mode, an available port that is not already in use by another resource is assigned; preferred port also can be modified later from the Port Overrides settings |
| DNS | Optional | If Virtual Networking Mode is the selected connectivity mode, a unique hostname alias for this resource; when set, causes the desktop app to display this resource's human-readable DNS name (for example, k8s.my-organization-name) instead of the bind address that includes IP address and port (for example, 100.64.100.100:5432) |
| Secret Store | Optional | Credential store location; defaults to none (credentials are stored in StrongDM resource configuration); to learn more, see Secret Store options |
| Server CA | Optional | Pasted server certificate (plaintext or Base64-encoded), or imported PEM file; you can either generate the server certificate on the API server or get it in Base64 format from your existing Kubernetes configuration (kubeconfig) file |
| Cluster Name | Required | Name of the EKS cluster |
| Region | Required | Region of the EKS cluster, such as us-west-1 |
| Healthcheck Namespace | Optional | If enabled for your organization, the namespace used for the resource healthcheck; defaults to default if empty; supplied credentials must have the rights to perform one of the following kubectl commands in the specified namespace: get pods, get deployments, or describe namespace |
| Enable Resource Discovery | Optional | Enables automatic discovery within this cluster |
| Authentication | Required | Authentication method to access the cluster; select either Leased Credential (default) or Identity Aliases (to use the Identity Aliases of StrongDM users to access the cluster) |
| Identity Set | Required | Displays if Authentication is set to Identity Aliases; select an Identity Set name from the list |
| Healthcheck Username | Required | If Authentication is set to Identity Aliases, the username that should be used to verify StrongDM's connection to it; username must already exist on the target cluster |
| Assume Role ARN | Optional | Role ARN, such as arn:aws:iam::000000000000:role/RoleName, that allows users accessing this resource to assume a role using AWS AssumeRole functionality |
| Assume Role External ID | Optional | External ID if leveraging an external ID to users assuming a role from another account; if used, it must be used in conjunction with Assume Role ARN; see the AWS documentation on using external IDs for more information |
| Resource Tags | Optional | Resource /spaces/4XOJmXFslCMVCzIG2rKp/pages/anUqbOAAmDPD3e0fF6GO consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Cluster Type | Required | Google Kubernetes Engine |
| Proxy Cluster | Required | Defaults to "None (use gateways)"; if using proxy clusters, select the appropriate cluster to proxy traffic to this resource |
| Endpoint | Required | Endpoint of the GKE cluster, such as 35.232.191.126; relay server should be able to connect to your GKE endpoint |
| Connectivity Mode | Required | Select either Virtual Networking Mode, which lets users connect to the resource with a software-defined, IP-based network; or Loopback Mode, which allows users to connect to the resource using the local loopback adapter in their operating system; this field is shown if Virtual Networking Mode enabled for your organization |
| IP Address | Optional | If Virtual Networking Mode is the selected connectivity mode, an IP address value in the configured Virtual Networking Mode subnet in the organization network settings; if Loopback Mode is the selected connectivity mode, an IP address value in the configured Loopback IP range in the organization network settings (by default, 127.0.0.1); if not specified, an available IP address in the configured IP address space for the selected connectivity mode will be automatically assigned; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization |
| Port Override | Optional | If Virtual Networking Mode is the selected connectivity mode, a port value between 1 and 65535 that is not already in use by another resource with the same IP address; if Loopback Mode is the selected connectivity mode, a port value between 1024 to 64999 that is not already in use by another resource with the same IP address; when left empty with Virtual Networking Mode, the system assigns the default port to this resource; when left empty for Loopback Mode, an available port that is not already in use by another resource is assigned; preferred port also can be modified later from the Port Overrides settings |
| DNS | Optional | If Virtual Networking Mode is the selected connectivity mode, a unique hostname alias for this resource; when set, causes the desktop app to display this resource's human-readable DNS name (for example, k8s.my-organization-name) instead of the bind address that includes IP address and port (for example, 100.64.100.100:5432) |
| Secret Store | Optional | Credential store location; defaults to none (credentials are stored in StrongDM resource configuration); to learn more, see Secret Store options |
| Server CA | Optional | Server CA, which is available under the Show Credentials link just to the right of the endpoint in the Google Cloud Platform console |
| Service Account Key | Required | Service account key in JSON format; you can generate this key in the Google Developers Console; ensure it is associated with a user having the appropriate level of access to the cluster for your use case; once generated, upload the key using the button below the Service Account Key box |
| Healthcheck Namespace | Optional | If enabled for your organization, the namespace used for the resource healthcheck; defaults to default if empty; supplied credentials must have the rights to perform one of the following kubectl commands in the specified namespace: get pods, get deployments, or describe namespace |
| Enable Resource Discovery | Optional | Enables automatic discovery within this cluster |
| Authentication | Required | Authentication method to access the cluster; select either Leased Credential (default) or Identity Aliases (to use the Identity Aliases of StrongDM users to access the cluster) |
| Identity Set | Required | Displays if Authentication is set to Identity Aliases; select an Identity Set name from the list |
| Healthcheck Username | Required | If Authentication is set to Identity Aliases, the username that should be used to verify StrongDM's connection to it; username must already exist on the target cluster |
| Resource Tags | Optional | Resource /spaces/4XOJmXFslCMVCzIG2rKp/pages/anUqbOAAmDPD3e0fF6GO consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |