> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/Arvo-AI/aurora/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Connectors

> Connect and configure cloud provider connectors

# Configure Connectors

Connect Aurora to your cloud providers using provider-specific authentication methods. Each provider has unique configuration requirements.

## Google Cloud Platform (GCP)

### POST /gcp/login

Initiate GCP OAuth 2.0 authentication flow.

**Request Body:**

<ParamField path="userId" type="string" required>
  Aurora user identifier
</ParamField>

**Response:**

<ResponseField name="login_url" type="string">
  OAuth authorization URL to redirect user to
</ResponseField>

**Example:**

```json theme={null}
{
  "userId": "user_123"
}
```

```json theme={null}
{
  "login_url": "https://accounts.google.com/o/oauth2/v2/auth?client_id=..."
}
```

### OAuth Flow

1. **Frontend** calls `/gcp/login` with userId
2. **Backend** returns OAuth URL with encoded state
3. **User** redirects to Google consent screen
4. **Google** redirects to `/gcp/callback` with code
5. **Backend** exchanges code for tokens
6. **Backend** triggers post-auth setup (async)
7. **Frontend** polls `/gcp/setup/status/:task_id`

### GET /gcp/setup/status/:task\_id

Check post-authentication setup progress.

**Response:**

<ResponseField name="state" type="string">
  Task state: `PENDING`, `STARTED`, `PROGRESS`, `SUCCESS`, `FAILURE`
</ResponseField>

<ResponseField name="status" type="string">
  Human-readable status message
</ResponseField>

<ResponseField name="complete" type="boolean">
  Whether setup is complete
</ResponseField>

<ResponseField name="progress" type="number" optional>
  Progress percentage (0-100)
</ResponseField>

<ResponseField name="step" type="number" optional>
  Current step number
</ResponseField>

<ResponseField name="total_steps" type="number" optional>
  Total number of setup steps
</ResponseField>

**Example:**

```json theme={null}
{
  "state": "PROGRESS",
  "status": "Enabling required APIs",
  "complete": false,
  "progress": 42,
  "step": 3,
  "total_steps": 7
}
```

### POST /api/gcp/force-disconnect

Disconnect GCP account and delete credentials.

**Authentication:** Required (X-User-ID header)

**Response:**

```json theme={null}
{
  "success": true,
  "message": "GCP disconnected successfully"
}
```

***

## Amazon Web Services (AWS)

### POST /aws/auth

Connect AWS account using IAM role assumption.

**Authentication:** Required (X-User-ID header)

**Request Body:**

<ParamField path="userId" type="string" required>
  Aurora user identifier
</ParamField>

<ParamField path="role_arn" type="string" required>
  IAM role ARN to assume

  Format: `arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME`
</ParamField>

<ParamField path="external_id" type="string" required>
  External ID for secure role assumption (from Aurora workspace)
</ParamField>

<ParamField path="read_only_role_arn" type="string" optional>
  Read-only role ARN for Ask mode (optional)
</ParamField>

**Example Request:**

```json theme={null}
{
  "userId": "user_123",
  "role_arn": "arn:aws:iam::123456789012:role/AuroraRole",
  "external_id": "aurora-ext-abc123"
}
```

**Response:**

<ResponseField name="status" type="string">
  Status: `success` or `error`
</ResponseField>

<ResponseField name="message" type="string">
  Result message
</ResponseField>

<ResponseField name="account_id" type="string">
  AWS account ID
</ResponseField>

<ResponseField name="expires_at" type="string">
  Credential expiration timestamp
</ResponseField>

**Success Example:**

```json theme={null}
{
  "status": "success",
  "message": "Assume-Role successful",
  "account_id": "123456789012",
  "expires_at": "2024-03-15T11:30:00Z"
}
```

### IAM Role Setup

Create an IAM role in your AWS account with:

1. **Trust Policy** allowing Aurora to assume the role:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::AURORA_ACCOUNT_ID:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      }
    }
  ]
}
```

2. **Permissions** for infrastructure management (EC2, EKS, VPC, IAM, etc.)

### GET /aws/get-credentials

Retrieve stored AWS credentials.

**Response:**

```json theme={null}
{
  "status": "success",
  "message": "AWS role credentials found",
  "has_credentials": true,
  "role_arn": "arn:aws:iam::123456789012:role/AuroraRole",
  "account_id": "123456789012"
}
```

***

## Microsoft Azure

### POST /azure/login

Connect Azure using service principal credentials.

**Request Body:**

<ParamField path="userId" type="string" required>
  Aurora user identifier
</ParamField>

<ParamField path="tenantId" type="string" required>
  Azure tenant ID (Directory ID)
</ParamField>

<ParamField path="clientId" type="string" required>
  Service principal application (client) ID
</ParamField>

<ParamField path="clientSecret" type="string" required>
  Service principal client secret
</ParamField>

<ParamField path="subscriptionId" type="string" optional>
  Specific subscription ID (uses first enabled if not provided)
</ParamField>

<ParamField path="subscriptionName" type="string" optional>
  Subscription display name
</ParamField>

<ParamField path="readOnlyCredentials" type="object" optional>
  Optional read-only credentials for Ask mode

  <ParamField path="clientId" type="string">
    Read-only service principal client ID
  </ParamField>

  <ParamField path="clientSecret" type="string">
    Read-only service principal secret
  </ParamField>
</ParamField>

**Example Request:**

```json theme={null}
{
  "userId": "user_123",
  "tenantId": "tenant-guid",
  "clientId": "app-guid",
  "clientSecret": "secret-value",
  "subscriptionId": "sub-guid"
}
```

**Response:**

```json theme={null}
{
  "message": "Successfully logged in to Azure",
  "subscription_id": "sub-guid",
  "subscription_name": "Azure Production"
}
```

### Service Principal Setup

1. Create app registration in Azure Active Directory
2. Generate client secret
3. Assign permissions to subscription (Contributor or custom role)
4. Note tenant ID, client ID, and client secret

***

## Scaleway

### POST /scaleway\_api/scaleway/connect

Connect Scaleway account with API credentials.

**Request Body:**

<ParamField path="accessKey" type="string" required>
  Scaleway access key (starts with SCW)
</ParamField>

<ParamField path="secretKey" type="string" required>
  Scaleway secret key (UUID format)
</ParamField>

<ParamField path="organizationId" type="string" optional>
  Organization ID (auto-detected if not provided)
</ParamField>

<ParamField path="projectId" type="string" optional>
  Default project ID (uses first project if not provided)
</ParamField>

**Example Request:**

```json theme={null}
{
  "accessKey": "SCWXXXXXXXXXXXXXXXXX",
  "secretKey": "12345678-1234-1234-1234-123456789012",
  "organizationId": "12345678-1234-1234-1234-123456789012"
}
```

**Response:**

```json theme={null}
{
  "success": true,
  "message": "Scaleway connected successfully",
  "organizationId": "12345678-1234-1234-1234-123456789012",
  "projectsCount": 3
}
```

### GET /scaleway\_api/scaleway/projects

Fetch available Scaleway projects.

**Response:**

```json theme={null}
{
  "projects": [
    {
      "projectId": "proj-123",
      "projectName": "Production",
      "organizationId": "org-123",
      "description": "Production environment",
      "enabled": true
    }
  ]
}
```

### POST /scaleway\_api/scaleway/disconnect

Disconnect Scaleway account.

**Response:**

```json theme={null}
{
  "success": true,
  "message": "Scaleway disconnected successfully"
}
```

***

## Tailscale

### POST /tailscale\_api/tailscale/connect

Connect Tailscale account using OAuth client credentials.

**Request Body:**

<ParamField path="clientId" type="string" required>
  Tailscale OAuth client ID
</ParamField>

<ParamField path="clientSecret" type="string" required>
  Tailscale OAuth client secret
</ParamField>

<ParamField path="tailnet" type="string" optional>
  Specific tailnet name (uses default if not provided)
</ParamField>

**Example Request:**

```json theme={null}
{
  "clientId": "client-id-123",
  "clientSecret": "secret-value",
  "tailnet": "example.com"
}
```

**Response:**

```json theme={null}
{
  "success": true,
  "message": "Tailscale connected successfully",
  "tailnet": "example.com",
  "tailnetName": "Example Organization",
  "deviceCount": 12
}
```

### OAuth Client Setup

1. Go to Tailscale admin console
2. Navigate to Settings → OAuth clients
3. Create new OAuth client
4. Set appropriate permissions (devices:read, devices:write, etc.)
5. Copy client ID and secret

### GET /tailscale\_api/tailscale/ssh-setup

Get SSH setup instructions and public key.

**Response:**

```json theme={null}
{
  "success": true,
  "sshPublicKey": "ssh-rsa AAAAB3NzaC1yc2...",
  "tailnet": "example.com",
  "instructions": [
    "1. Copy the SSH public key above",
    "2. On each device you want Aurora to access..."
  ],
  "command": "echo 'ssh-rsa AAAAB3...' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
}
```

### POST /tailscale\_api/tailscale/disconnect

Disconnect Tailscale account.

**Response:**

```json theme={null}
{
  "success": true,
  "message": "Tailscale disconnected successfully"
}
```

***

## Security Considerations

### Credential Storage

All credentials are stored securely:

* **HashiCorp Vault** - Credentials encrypted at rest
* **Secret References** - Only references stored in database
* **Redis Cache** - Credentials cached with TTL
* **Automatic Cleanup** - Credentials cleared on disconnect

### Authentication Validation

Credentials are validated:

* **On Connect** - API calls verify access
* **On Use** - Credentials refreshed if expired
* **Status Checks** - Regular validation for active connections
* **Error Handling** - Invalid credentials trigger reconnection

### Best Practices

1. **Least Privilege** - Grant minimum required permissions
2. **Rotation** - Rotate credentials regularly
3. **Monitoring** - Monitor for unauthorized access
4. **Separation** - Use separate credentials for read-only mode
5. **Expiration** - Set credential expiration policies

## Multi-Account Support

Connect multiple accounts for the same provider:

```javascript theme={null}
// GCP
await connect('gcp', { userId, projectId: 'prod' });
await connect('gcp', { userId, projectId: 'dev' });

// AWS
await connect('aws', { userId, roleArn: 'arn:...:role/ProdRole', externalId });
await connect('aws', { userId, roleArn: 'arn:...:role/DevRole', externalId });
```

Each connection is tracked separately in the `user_connections` table.