Skip to main content

Credentials

follow the specific cloud and preferred method to create the necessary credentials below:

AWS​

One Click Role
CLI

How Massdriver uses your role​

To keep your environment secure, Massdriver uses a role with a trust policy to access your AWS account for provisioning and monitoring of your infrastructure. The account that assumes this role is private and has no access from the public internet.

Create a role with a trust policy​

Run the following command with the AWS CLI. Replace <UUID HERE> with Loading.... Save it for importing the role in to Massdriver.

aws iam create-role --role-name=massdriver-provisioner --description="Massdriver Cloud Provisioning Role" --assume-role-policy-document='{"Version":"2012-10-17","Statement":[{"Sid":"MassdriverCloudProvisioner","Effect":"Allow","Principal":{"AWS":["308878630280"]},"Action":"sts:AssumeRole","Condition":{"StringEquals":{ "sts:ExternalId":"<UUID HERE>"}}}]}'

Assign the role administrator privileges​

Fill in the role name used above and run this command to give Massdriver administrator privileges.

aws iam attach-role-policy --role-name={{ROLE_NAME}} --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Import role to Massdriver​

In the form to the left, name the credential as your AWS account for use within Massdriver and fill in both the aws arn as arn:aws:iam::YOUR_AWS_ACCOUNT_ID:role/{{ROLE_NAME}} and the external ID. Click submit and head to the projects page to start building your infrastructure.

Console

How Massdriver uses your role​

To keep your environment secure, Massdriver uses a role with a trust policy to access your AWS account for provisioning and monitoring of your infrastructure. The account that assumes this role is private and has no access from the public internet.

Create a role​

  1. Sign in to the AWS Management Console
  2. In the search bar, type IAM and select the IAM service
  3. In the left-hand menu, select Roles
  4. Click Create role

roles

  1. Select Another AWS account for the role type

roles

  1. For the account ID enter 308878630280. This is the Massdriver account which contains the role that will use the one you are creating now
  2. Check the Require external ID box and enter Loading....
  3. Make sure that the Require MFA option is unchecked

roles

  1. Click "Next: Permissions"
  2. Select the AdministratorAccess policy

roles

  1. Select Next: Tags
  2. Add a tag with the key massdriver

roles

  1. Add a name and a description to the role. Save the role name for entry in to the form to the left

roles

  1. In Massdriver, name the credential as your AWS account
  2. Paste the AWS arn for the role in the appropriate field with the format:
arn:aws:iam::YOUR_AWS_ACCOUNT_ID:role/ROLE_NAME
  1. If you haven't already paste your external ID in to the appropriate field
  2. Submit the role to Massdriver and head to the projects page to begin provisioning infrastruture.

Azure​

CLI

Install Azure CLI​

To get started, you'll need the Azure CLI installed locally on your machine. The Azure Cloud Shell available in the Azure Portal does not have the ability to grant the service principal the required permissions.

  1. Obtain your subscription ID

Paste this script into the command-line to list your subscriptions:

az account list --output table

Copy the value of the SubscriptionId and TenantId you want to use and paste it into Massdriver under Subscription ID and Tenant ID, and also store the SubscriptionId for the next step.

  1. Paste this script in the command-line to create an Azure service principal, and replace <mySubscriptionID> with the subscription ID you copied from the last step:
az ad sp create-for-rbac --name massdriver-service-principal \
                         --role owner \
                         --scopes /subscriptions/<mySubscriptionID>
  1. Copy the following attributes and paste them into Massdriver:
  • appId → Client ID
  • password → Client Secret

Once finished, click the Submit button in Massdriver to create your credential.

Console

Registering the service principal app in Azure AD​

  1. Sign into your Azure account through the Azure portal
  2. Search for and select Microsoft Entra ID
  3. Select App registration
  4. Select New registration

Massdriver example 1

  1. Name your application: massdriver-service-principal
  2. Select Accounts in this organization directory only
  3. Leave Redirect URI blank

Massdriver example 2

  1. Click Register
  2. On the Overview menu, copy the following values and paste them into Massdriver:
  • Application (client) ID → Client ID
  • Directory (tenant) ID → Tenant ID

Massdriver example 3

  1. Select Certificates & secrets on the left
  2. Select New client secret
  3. Set the description to platform, set expiration date, and click Add

Massdriver example 4

  1. Copy the Value password and paste into Massdriver under Client Secret. Do not use the Secret ID.

Massdriver example 5

Assign subscription Owner the service principal​

  1. In the Azure portal, search for and select Subscription
  2. Select the subscription you want to use in Massdriver
  3. In the Overview menu, copy your Subscription ID and paste it into Massdriver under Subscription ID
  4. Select Access control (IAM)
  5. Select Add > Add role assignment
  6. Select Privileged Administrator Roles tab and then the Owner role and click Next
  7. Select Select members, search for massdriver-service-principal, click on the service principal, and then click Select at the bottom, then Next
  8. Select Allow user to assign all roles except privileged administrator roles and click Next then Review + assign twice to finish.

Adding the Azure service principal to your Massdriver organization​

  1. In Massdriver, click on the menu on the top left and expand Organization Settings
  2. Click Configure Credentials
  3. Select Azure Service Principal
  4. Set the credential name to your subscription name
  5. Fill in the fields as guided below:
  • Client ID (appId in Azure CLI)
  • Client Secret (service principal password)
  • Subscription ID
  • Tenant ID (tenant in Azure CLI)

GCP​

CLI
Console