PAM

Cloud Credentials

CoreLink vends short-lived AWS, Azure, and GCP credentials on demand through provider-native APIs (AWS STS AssumeRole, Azure AD OIDC federation, GCP Workload Identity Federation). Each credential bundle is issued to a specific NHI or user, scoped to the requested role or service account, and expires automatically when the lease ends.

Leases can be revoked immediately if the consuming workload is decommissioned or compromised. Full issuance and revocation history is captured in the audit log with actor, scope, and reason.

Cloud Credentials screenshot

Key Configuration

  • Cloud provider (AWS, Azure, GCP)
  • Default lease duration
  • Role / service account allowlist
  • Revocation webhook endpoint
All documentation Question about this? Talk to us