OpenStack API Access
Application credentials for Terraform, the openstack CLI, and Kubernetes.
Learn moreIdentity & Access Management
Grant least-privilege access with built-in and custom roles, enforce MFA for every member, and require step-up verification before OpenStack credential and API access changes.
ICT Cloud console · illustrative data
Users, roles, and MFA, with a policy simulator that shows which statement decides.
Least privilege, by default
Grant the narrowest role at the narrowest scope a member needs.
Test a policy before you attach it
The policy simulator evaluates a principal’s attached policies for an action on a resource and shows the deciding statement.
Two-factor, enforced
Require an authenticator app for every member, and step-up verification before OpenStack credential and API access changes.
In the console
Members and roles
Invite members, assign roles at a subscription or project scope, and see every assignment in one place.
- Built-in and custom roles
- Managed and custom policies
- Invitations by email, with an optional message
Features
Users and invitations
Invite members by email; they set their own password from the invitation link.
Roles
Built-in roles and custom roles you can clone and edit.
Policies
Managed and custom policy documents, written with a statement builder.
Policy simulator
Evaluate a principal’s attached policies for an action and a resource, and see the deciding statement.
Multi-factor authentication
Time-based codes from Google Authenticator, 1Password, or Authy, with recovery codes.
Step-up verification
OpenStack credential and API access changes ask for a recent two-factor verification.
Service accounts and API tokens
Machine identities and scoped tokens; secrets are shown once.
Sessions
See active sessions and sign out any of them immediately.
How it works
Turn on MFA
Require two-factor authentication for every member.
Define roles
Use built-in roles or build custom ones.
Simulate
Check decisions and the policy behind them.
Invite your team
Assign roles at the right scope.
Specifications
| Sign-in | Email and password, with two-factor authentication |
|---|---|
| MFA | TOTP with recovery codes; can be enforced for members |
| Step-up verification | Before OpenStack credential and API access changes |
| Passwords | At least 12 characters |
| Roles | Built-in and custom, assignable at subscription or project scope |
| Policies | Managed and custom, e.g. compute:StartInstance |
| Machine identities | Service accounts, scoped API tokens |
| Audit | Organization-wide activity log |
Use cases
Onboarding teams
Invite members by email and give each the role they need, at the right scope.
Scoped access
Give a contractor a role in one project only, and remove it when the work is done.
CI/CD and automation
Service accounts and scoped tokens instead of personal credentials.
FAQ
Can I require two-factor authentication for everyone?
Yes. Once it is enforced, members without an authenticator app set one up the next time they sign in.
Which authenticator apps work?
Any app that generates time-based codes, such as Google Authenticator, 1Password, or Authy.
What if a member loses their phone?
They sign in with one of the recovery codes they saved when they set up two-factor authentication.
What happens when I revoke an API token?
Any client using it starts receiving 401 immediately.
Start building on ICT Cloud.
Creating an account is free. Resources are billed per second, with a 60-second minimum.