Cloud Accounts

Overview

Cloud Accounts is where you register the cloud provider accounts that Veltrix is allowed to provision and manage infrastructure in. It is the “bring your own cloud” (BYOC) side of apps that can deploy their own hosted infrastructure: you connect an account once, and any installed app that provisions cloud resources can offer it as a deployment target.

Four providers are supported, each with one or two authentication methods:

Registering an account does not create any infrastructure by itself. It stores the credentials (encrypted) so that an app deployment you start later can use them.

Where to Find It

Open Settings in the sidebar and choose Cloud Accounts from the submenu, or use the Cloud Accounts card on the Settings hub (“Connect your AWS, Azure, GCP, or Hetzner accounts so Veltrix can provision infrastructure”). The page lives at /settings/cloud-accounts.

Only organization administrators can use this page. A user without administrator access will see an error when the list loads.

Add a Cloud Account

1. Go to Settings → Cloud Accounts.
2. Click Add cloud account (top right), or click Configure on the provider's card to start with that provider selected.
3. Choose the Cloud Provider and, where there is a choice, the Authentication Method. A short description and a setup hint appear under the selection.
4. Enter a Display Name (required, up to 200 characters), for example Production Amazon Web Services.
5. Fill in the method's fields (see the reference below). Fields marked with a red asterisk are required; secret fields are tagged as such.
6. Optionally tick Set as default <provider> account.
7. Click the save button. The account is created with status Unverified.
8. Click the Test connection icon on the new row to verify it (see Verifying).

You can register several accounts per provider, for example separate production and staging accounts. Once at least one account exists, the card shows N configured and its footer button changes to Add Another.

Providers and Fields

Amazon Web Services — Assume Role

Veltrix assumes an IAM role in your account through STS, using a trust policy conditioned on an external ID. Create the role to trust the Veltrix provisioning principal, add a condition on your external ID, and attach a least-privilege policy limited to what Veltrix should manage.

Microsoft Azure

Google Cloud Platform

Hetzner Cloud — API Token

Create the cloud-side role, trust relationship or token with the narrowest permissions you can; the hint box in the dialog repeats the key steps for the selected method.

Manage Existing Accounts

Each provider card lists its accounts. A row shows a status badge, the display name, the authentication method, a Default star when applicable, and the date it was last tested. Icons on the right:

• Secrets are never shown again. Secret fields (client secret, service account key JSON, API token) are encrypted when stored and masked when read back. When you edit, those fields start blank with “Leave blank to keep existing value”; type a new value only if you want to replace it.
• Editing resets verification. Saving new configuration sets the status back to Unverified until you test again.
• The Test Connection button inside the edit dialog tests what is already saved, not unsaved changes in the form. Save first, then test.
• Refresh (top right) reloads the list. When one or more accounts are in error, the failing account's message is printed under its provider card.

Verifying a Connection and Statuses

What a test actually proves depends on the method:

Using Accounts in Deployments

Cloud accounts are cross-app: you do not attach them to a particular app here. Apps that provision infrastructure can list your registered accounts when you set up a deployment, and the deployment records which account it uses. Apps that only configure an existing tool through its own API do not use cloud accounts.

Your organization may also see Veltrix-managed accounts offered as a hosted deployment target. Those are managed by Veltrix administrators; you can only see that they exist, never their configuration, and they are not listed on this page.

Permissions, Plans and Limits

• Permission: organization administrators only (the same level used for Connectivity). Nobody else can list, create, edit, test or remove accounts, including through the API.
• Plans: Cloud Accounts is not gated by plan tier in the product; there is no per-plan cap on the number of accounts. Whether your organization can deploy infrastructure also depends on the app you use and your subscription state.
• Isolation: accounts are scoped to your organization. Another tenant cannot see or use them.
• Credentials at rest: secret fields are encrypted before they are stored and are decrypted only by the provisioning worker when a deployment needs them.

Good to Know

• Prefer federation or role assumption over stored keys: AWS Assume Role, Azure brokered, GCP Workload Identity Federation store no long-lived secret in Veltrix.
• A removed account cannot be recovered; deleting one that a pending deployment relies on will make that deployment fail. Register a replacement first.
• If a test fails right after you created the cloud-side role, wait a minute for provider-side propagation and test again.
• For local connectivity to servers (SSH, VPN, tunnels), see Connectivity & Remote Access; cloud accounts are about the cloud provider API, not network reach.