---
title: Prerequisites
slug: kronpam-reference-guide-3-9-0/prerequisites
docTags: 
createdAt: 2026-10-09T10:34:52.341Z
---

Before configuring a Cloud Secrets sync, make sure the following are in place:

·         The relevant AWS, Azure, or GCP account must already be registered under Administration > Cloud Integration, with the Vault module enabled for that account.

·         AWS permissions: 

·         secretsmanager\:GetSecretValue 

·         secretsmanager\:DescribeSecret

·         kms\:Decrypt (if the secrets are encrypted with a Customer Managed Key). 

·         GCP permissions:

·         roles/secretmanager.viewer

·         roles/secretmanager.secretAccessor

·         Azure permissions: 

·         read access granted to the application (App Registration) alone is not sufficient. The human accounts configuring the integration must also be assigned the Secrets Officer role (or at least a read role) on the Key Vault via RBAC, otherwise the sync fails.