OVHcloud
Connect OVHcloud accounts in Europe, Canada or the US so Safeguard can check sign-in restrictions, audit logs, Public Cloud storage, backups and firewalls.
Connect OVHcloud
Safeguard reads your OVHcloud account with GET calls only: the account's sign-in IP restriction and audit-log forwarding, the account's users and their MFA, Public Cloud instance backups and Object Storage, and the Edge Network Firewall on your IP blocks.
Pick the right region first
An OVHcloud application key exists on one OVHcloud API only. Create the keys on the API that holds your account, and choose the matching Region in Safeguard:
| Region | Create the keys at |
|---|---|
eu | https://eu.api.ovh.com/createToken/ |
ca | https://ca.api.ovh.com/createToken/ |
us | https://api.us.ovhcloud.com/createToken/ |
Keys made at ovh.com outside Europe and Canada usually belong to ca. If you choose the wrong region, the connection reports which region the keys belong to, for example: "These OVHcloud keys were created on the ca API, but this connection's Region is us. Reconnect and choose Region ca."
1. Create the keys in OVHcloud
- Open the createToken page for your region and sign in to your OVHcloud account.
- Fill in an application name and description, for example "Safeguard compliance" and "Read-only access for compliance evidence".
- Set Validity. Unlimited keeps the connection working; a shorter validity means you reconnect when it expires.
- Add these Rights, all with method GET:
/me/me/*/cloud/project/cloud/project/*/ip/ip/*
- Create the keys and copy the Application key, Application secret and Consumer key.
Optional: S3 keys for bucket access checks
OVHcloud's API does not report S3 bucket ACLs or bucket policies. To check them, create a Public Cloud S3 user with a read-only policy that allows s3:GetBucketAcl and s3:GetBucketPolicy, and add its access key and secret key below. Without them, each S3 bucket's public-access result is an error naming this optional grant, never a pass.
2. Connect it in Safeguard
- Open Compliance › Connectors, search for OVHcloud and click Connect.
- Choose API token:
| Field | What to enter |
|---|---|
| Application key | From step 1 |
| Application secret | From step 1 |
| Consumer key | From step 1 |
| Region | eu, ca or us, matching the createToken page you used |
| Access key (optional) | The S3 user's access key |
| Secret key (optional) | The S3 user's secret key |
- Click Connect with token. The card shows Verified and the account's identifier once OVHcloud accepts the keys.
Accounts in more than one region
If you run OVHcloud accounts in more than one region, for example the US and Europe, connect each one. When multiple accounts are switched on for your workspace, open the first account's card and choose Add another account. Give it a label such as "OVHcloud EU", choose its region and paste that account's keys. Each account gets its own card, and every check runs against both.
What Safeguard checks
- The account's sign-in is restricted by IP address
- The account audit log is forwarded to a Logs Data Platform stream
- The account's users, and whether they use MFA
- Public Cloud instances have backups
- Object Storage containers are not public, are encrypted and have versioning
- The Edge Network Firewall does not leave admin or database ports open to the internet
Public Cloud security groups are not in OVHcloud's API, so they are covered by attestation instead.
Troubleshooting
- "These OVHcloud keys were created on the … API": the region does not match where the keys were created. Use Reconnect and choose the region the message names.
- "OVHcloud does not recognise this application key": no region knows the keys. Create them again on the createToken page for your account's region.
- "This call has not been granted": a GET right is missing. Create new keys with all six rights.
- Not working after the keys expire: create new keys and use Reconnect.