Registering Cloud Provider Accounts

Before a Cloud Secrets sync can be created, the AWS, Azure, or GCP account must be registered in Kron PAM under Administration > Cloud Integration, with the Vault switch enabled under Credential Usage. Only accounts with Vault enabled appear in the Account dropdown when adding a Cloud Secrets sync.

·         Account Name (required).

·         Region (required).

·         API Key (required).

·         Secret Key.

·         Active: toggle to activate or deactivate the account.

·         Credential Usage: Enable for CIEM / Enable for Vault / Enable for Device Discovery switches. Enable for Vault must be turned on for this account to be usable in a Cloud Secrets sync.

·         Account Name (required).

·         Client ID (required).

·         Tenant ID (required).

·         Secret Key.

·         Resource Groups (required).

·         Subscription ID (filled in automatically).

·         Active.

·         Credential Usage: Enable for CIEM / Enable for Vault / Enable for Device Discovery switches. Enable for Vault must be turned on for this account to be usable in a Cloud Secrets sync.

·         Account Name (required).

·         Client Secrets (required).

·         Zone (required).

·         Project IDs (optional; if left empty, the service account's own project is used).

·         Active.

·         Credential Usage: Enable for CIEM / Enable for Vault / Enable for Device Discovery switches. Enable for Vault must be turned on for this account to be usable in a Cloud Secrets sync.

The Cloud Integration list screen shows all registered accounts with their Account Name, Account Type, Status (Active/Passive), and separate indicators for whether the account is enabled for CIEM, Device Discovery, and Vault.