Cloud provider catalog
How the Cloud tab's provider catalog works: which clouds have their own connector, which connect through a generic connector, and how to ask for the rest.
What it does
The Cloud tab of Integrations has a Cloud provider catalog under the deployment cards. It lists cloud providers from every region: the large public clouds, regional and sovereign clouds, developer clouds, edge and PaaS platforms, GPU clouds, telco clouds, object storage and private cloud platforms.
Every card says how Safeguard connects to that provider today. There are three kinds:
| Card says | What it means | What the button does |
|---|---|---|
| Full connector | Safeguard has a connector for this provider's own API, and runs its compliance tests on it | Connect opens the Connectors tab on that provider's connector |
| Standard connector | There is no connector for this provider's API, but one of the generic connectors below works with the services it offers | One button per generic connector that fits, each opening that connector |
| Request access | No connector fits yet | Request files a request with the provider's name filled in; it shows in your request history with a reference |
The catalog is switched on per workspace, so yours may not show it yet. Ask your Safeguard contact to switch it on.
The generic connectors
These work with any provider that offers the matching service. A card lists only the ones that fit what that provider offers.
| Generic connector | Works with | What you give Safeguard |
|---|---|---|
| Kubernetes (kubeconfig) | Any Kubernetes cluster you run on that provider, managed or self-installed | A kubeconfig that signs in with a token (service account token). Exec plugins and client certificates are not used |
| S3-compatible storage | Object storage that speaks the S3 API | The MinIO connector, pointed at the provider's own https:// endpoint, with an access key and secret key. It lists buckets and reads each bucket's policy, versioning and encryption |
| OpenStack APIs | Public and private clouds built on OpenStack | The OpenStack connector with a Keystone v3 application credential. It reads users and roles, security groups (Neutron), object containers (Swift) and volumes (Cinder) |
| Container registry (OCI) | Any registry that speaks the Docker Registry v2 / OCI distribution API | The OCI Registry card on Integrations, with the registry URL and a pull credential |
Infrastructure as code: Terraform, CloudFormation, Helm and Kubernetes files can be scanned with the Safeguard CLI's IaC scan, whichever cloud they target. That is not shown as a connection on the cards. Safeguard does not read Terraform state files.
Public vs private
This does not apply to the catalog itself. Each connector it opens has its own page with its public and private options.
Supported auth methods
The catalog asks for no credential. The connector a card opens asks for its own; see the table above and each connector's page.
Permissions required
The catalog needs none. For the generic connectors:
| Connector | Permission | Required? | Why |
|---|---|---|---|
| Kubernetes | A service account that can get and list the resources the tests read (for example a read-only ClusterRole) | Required | The tests only read the cluster |
| S3-compatible storage | List buckets, and get each bucket's location, policy, versioning and encryption | Required | Those are the only calls it makes |
| OpenStack | An application credential for a role that can read identity, network, object storage and block storage | Required | The tests only read the project |
| OCI registry | Pull (read) access to the repositories you want scanned | Required | Images are pulled to scan them |
What we never need: an owner, root or admin credential, or write access to your cloud.
Token types
| Credential | Works? | Notes |
|---|---|---|
| Kubernetes service account token in a kubeconfig | Yes | Read-only role recommended |
| Kubernetes kubeconfig with an exec plugin or client certificate | No | Use a service account token instead |
| S3 access key and secret key | Yes | Scoped to list and read bucket settings |
| OpenStack application credential (Keystone v3) | Yes | Restrict it to a read-only role |
| OpenStack user name and password | No | Create an application credential instead |
| Registry pull token or robot account | Yes | Pull access only |
Expiry: set by your provider; replace a credential in its connector before it expires.
Step-by-step setup
In Safeguard
- Open Integrations and choose the Cloud tab.
- In Cloud provider catalog, search for the provider, or filter by Region, Category or Connection. The chips above the filters count every provider of each kind; select one to filter by it.
- On the provider's card:
- Full connector: select Connect. The Connectors tab opens on that connector; follow its form.
- Standard connector: select the generic connector you want (for example S3-compatible storage). Enter the provider's endpoint and a read-only credential.
- Request access: select Request, say why you need it if you like, and send.
If your workspace does not have the connector a card would open, the card offers Request instead and says so.
Webhooks and triggers
The catalog has no webhooks. Each connector's page says how often it reads.
What we read and store
- Read: the catalog reads nothing from your cloud. Each connector reads what its page lists.
- Stored: a request stores the provider's name, your reason and the support ticket it files.
- No customer data from this integration is sent to third-party LLMs.
Troubleshooting
| What you see | Cause | Fix |
|---|---|---|
| A provider is missing | It is not in the catalog yet | Use Request more under the deployment cards, or ask your Safeguard contact |
| Connect shows no matching connector on the Connectors tab | That connector is not offered to your workspace | Ask your Safeguard admin to enable it, or use Request |
| The S3-compatible connector cannot sign in | The endpoint is not https://, or the key cannot list buckets | Use the provider's S3 endpoint with https:// and a key with the list and get permissions above |
Rotation and disconnect
- Rotate: create a new credential with your provider, update it in the connector, then revoke the old one.
- Disconnect: remove the connection from the connector it was made in, then revoke the credential with your provider.
Vendor references
- Kubernetes: organizing cluster access using kubeconfig files, checked 2026-10-17.
- OpenStack Keystone: application credentials, checked 2026-10-17.
- Amazon S3 API reference: ListBuckets, checked 2026-10-17.
- OCI distribution specification, checked 2026-10-17.