Configure Connectors

Connect and configure cloud provider connectors

Configure Connectors

Connect Aurora to your cloud providers using provider-specific authentication methods. Each provider has unique configuration requirements.

Google Cloud Platform (GCP)

POST /gcp/login

Initiate GCP OAuth 2.0 authentication flow.

Request Body:

userId · string · required

Aurora user identifier

Response:

login_url · string

OAuth authorization URL to redirect user to

Example:

{
  "userId": "user_123"
}

{
  "login_url": "https://accounts.google.com/o/oauth2/v2/auth?client_id=..."
}

OAuth Flow

1. Frontend calls /gcp/login with userId
2. Backend returns OAuth URL with encoded state
3. User redirects to Google consent screen
4. Google redirects to /gcp/callback with code
5. Backend exchanges code for tokens
6. Backend triggers post-auth setup (async)
7. Frontend polls /gcp/setup/status/:task_id

GET /gcp/setup/status/:task_id

Check post-authentication setup progress.

Response:

state · string

Task state: PENDING, STARTED, PROGRESS, SUCCESS, FAILURE

status · string

Human-readable status message

complete · boolean

Whether setup is complete

progress · number

Progress percentage (0-100)

step · number

Current step number

total_steps · number

Total number of setup steps

Example:

{
  "state": "PROGRESS",
  "status": "Enabling required APIs",
  "complete": false,
  "progress": 42,
  "step": 3,
  "total_steps": 7
}

POST /api/gcp/force-disconnect

Disconnect GCP account and delete credentials.

Authentication: Required (X-User-ID header)

Response:

{
  "success": true,
  "message": "GCP disconnected successfully"
}

---

Amazon Web Services (AWS)

POST /aws/auth

Connect AWS account using IAM role assumption.

Authentication: Required (X-User-ID header)

Request Body:

userId · string · required

Aurora user identifier

role_arn · string · required

IAM role ARN to assume

Format: arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME

external_id · string · required

External ID for secure role assumption (from Aurora workspace)

read_only_role_arn · string

Read-only role ARN for Ask mode (optional)

Example Request:

{
  "userId": "user_123",
  "role_arn": "arn:aws:iam::123456789012:role/AuroraRole",
  "external_id": "aurora-ext-abc123"
}

Response:

status · string

Status: success or error

message · string

Result message

account_id · string

AWS account ID

expires_at · string

Credential expiration timestamp

Success Example:

{
  "status": "success",
  "message": "Assume-Role successful",
  "account_id": "123456789012",
  "expires_at": "2024-03-15T11:30:00Z"
}

IAM Role Setup

Create an IAM role in your AWS account with:

1. Trust Policy allowing Aurora to assume the role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::AURORA_ACCOUNT_ID:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      }
    }
  ]
}

2. Permissions for infrastructure management (EC2, EKS, VPC, IAM, etc.)

GET /aws/get-credentials

Retrieve stored AWS credentials.

Response:

{
  "status": "success",
  "message": "AWS role credentials found",
  "has_credentials": true,
  "role_arn": "arn:aws:iam::123456789012:role/AuroraRole",
  "account_id": "123456789012"
}

---

Microsoft Azure

POST /azure/login

Connect Azure using service principal credentials.

Request Body:

userId · string · required

Aurora user identifier

tenantId · string · required

Azure tenant ID (Directory ID)

clientId · string · required

Service principal application (client) ID

clientSecret · string · required

Service principal client secret

subscriptionId · string

Specific subscription ID (uses first enabled if not provided)

subscriptionName · string

Subscription display name

readOnlyCredentials · object

Optional read-only credentials for Ask mode

clientId · string

Read-only service principal client ID

clientSecret · string

Read-only service principal secret

Example Request:

{
  "userId": "user_123",
  "tenantId": "tenant-guid",
  "clientId": "app-guid",
  "clientSecret": "secret-value",
  "subscriptionId": "sub-guid"
}

Response:

{
  "message": "Successfully logged in to Azure",
  "subscription_id": "sub-guid",
  "subscription_name": "Azure Production"
}

Service Principal Setup

1. Create app registration in Azure Active Directory
2. Generate client secret
3. Assign permissions to subscription (Contributor or custom role)
4. Note tenant ID, client ID, and client secret

---

Scaleway

POST /scaleway_api/scaleway/connect

Connect Scaleway account with API credentials.

Request Body:

accessKey · string · required

Scaleway access key (starts with SCW)

secretKey · string · required

Scaleway secret key (UUID format)

organizationId · string

Organization ID (auto-detected if not provided)

projectId · string

Default project ID (uses first project if not provided)

Example Request:

{
  "accessKey": "SCWXXXXXXXXXXXXXXXXX",
  "secretKey": "12345678-1234-1234-1234-123456789012",
  "organizationId": "12345678-1234-1234-1234-123456789012"
}

Response:

{
  "success": true,
  "message": "Scaleway connected successfully",
  "organizationId": "12345678-1234-1234-1234-123456789012",
  "projectsCount": 3
}

GET /scaleway_api/scaleway/projects

Fetch available Scaleway projects.

Response:

{
  "projects": [
    {
      "projectId": "proj-123",
      "projectName": "Production",
      "organizationId": "org-123",
      "description": "Production environment",
      "enabled": true
    }
  ]
}

POST /scaleway_api/scaleway/disconnect

Disconnect Scaleway account.

Response:

{
  "success": true,
  "message": "Scaleway disconnected successfully"
}

---

Tailscale

POST /tailscale_api/tailscale/connect

Connect Tailscale account using OAuth client credentials.

Request Body:

clientId · string · required

Tailscale OAuth client ID

clientSecret · string · required

Tailscale OAuth client secret

tailnet · string

Specific tailnet name (uses default if not provided)

Example Request:

{
  "clientId": "client-id-123",
  "clientSecret": "secret-value",
  "tailnet": "example.com"
}

Response:

{
  "success": true,
  "message": "Tailscale connected successfully",
  "tailnet": "example.com",
  "tailnetName": "Example Organization",
  "deviceCount": 12
}

OAuth Client Setup

1. Go to Tailscale admin console
2. Navigate to Settings → OAuth clients
3. Create new OAuth client
4. Set appropriate permissions (devices:read, devices:write, etc.)
5. Copy client ID and secret

GET /tailscale_api/tailscale/ssh-setup

Get SSH setup instructions and public key.

Response:

{
  "success": true,
  "sshPublicKey": "ssh-rsa AAAAB3NzaC1yc2...",
  "tailnet": "example.com",
  "instructions": [
    "1. Copy the SSH public key above",
    "2. On each device you want Aurora to access..."
  ],
  "command": "echo 'ssh-rsa AAAAB3...' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
}

POST /tailscale_api/tailscale/disconnect

Disconnect Tailscale account.

Response:

{
  "success": true,
  "message": "Tailscale disconnected successfully"
}

---

Security Considerations

Credential Storage

All credentials are stored securely:

• HashiCorp Vault - Credentials encrypted at rest
• Secret References - Only references stored in database
• Redis Cache - Credentials cached with TTL
• Automatic Cleanup - Credentials cleared on disconnect

Authentication Validation

Credentials are validated:

• On Connect - API calls verify access
• On Use - Credentials refreshed if expired
• Status Checks - Regular validation for active connections
• Error Handling - Invalid credentials trigger reconnection

Best Practices

1. Least Privilege - Grant minimum required permissions
2. Rotation - Rotate credentials regularly
3. Monitoring - Monitor for unauthorized access
4. Separation - Use separate credentials for read-only mode
5. Expiration - Set credential expiration policies

Multi-Account Support

Connect multiple accounts for the same provider:

// GCP
await connect('gcp', { userId, projectId: 'prod' });
await connect('gcp', { userId, projectId: 'dev' });

// AWS
await connect('aws', { userId, roleArn: 'arn:...:role/ProdRole', externalId });
await connect('aws', { userId, roleArn: 'arn:...:role/DevRole', externalId });

Each connection is tracked separately in the user_connections table.