sts:AssumeRoleWithOIDC.
No access key is stored. Nuphos keeps only the role’s TRN.
Connect
The wizard in Connectors → Connect → Volcengine shows the issuer and client id for your team. Copy them from there.1. Add the identity provider
In the IAM console, create an OIDC identity provider with the issuer URL and client id from the wizard.2. Create the role
Create a role that trusts that provider, conditioned on the subject the wizard shows — that pins the role to your team. Attach a policy covering the work you want done (VKE and ECS, typically), then copy the role’s TRN. It looks liketrn:iam::2100000000:role/Nuphos.
3. Authorize cluster access
VKE grants cluster access per region, so repeat the in-cluster authorization for each region that has clusters you want the agent to reach.4. Bind the role
Enter the TRN in Nuphos.In the Nuphos app
- ECS instances — the account’s compute.
- Clusters — VKE clusters land in the shared cluster browser alongside EKS, GKE, and the rest.
What the agent can do for you
The agent operates the account within whatever policy you attached to the role, correlating it with your other connected accounts and proposing changes as plans.Permissions & authorization
- The role’s policy is the outer limit — Volcengine enforces it.
- Hard boundary — who can use it. Only team Administrators can bind or remove the account, and they can restrict it to specific members with a member allow-list.
- Soft boundary — what the agent may do with it. Reads run freely; changes go through plan approvals and Auto-authorization.