Skip to main content
Nuphos reaches Volcengine (火山引擎) through OIDC web-identity federation. You register Nuphos as an IAM identity provider, create a role that trusts it, and Nuphos mints a short-lived token per team and calls sts:AssumeRoleWithOIDC. No access key is stored. Nuphos keeps only the role’s TRN.

Connect

The wizard in Connectors → Connect → Volcengine shows the issuer and client id for your team. Copy them from there.

1. Add the identity provider

In the IAM console, create an OIDC identity provider with the issuer URL and client id from the wizard.

2. Create the role

Create a role that trusts that provider, conditioned on the subject the wizard shows — that pins the role to your team. Attach a policy covering the work you want done (VKE and ECS, typically), then copy the role’s TRN. It looks like trn:iam::2100000000:role/Nuphos.

3. Authorize cluster access

VKE grants cluster access per region, so repeat the in-cluster authorization for each region that has clusters you want the agent to reach.

4. Bind the role

Enter the TRN in Nuphos.

In the Nuphos app

  • ECS instances — the account’s compute.
  • Clusters — VKE clusters land in the shared cluster browser alongside EKS, GKE, and the rest.

What the agent can do for you

The agent operates the account within whatever policy you attached to the role, correlating it with your other connected accounts and proposing changes as plans.

Permissions & authorization

  • The role’s policy is the outer limit — Volcengine enforces it.
  • Hard boundary — who can use it. Only team Administrators can bind or remove the account, and they can restrict it to specific members with a member allow-list.
  • Soft boundary — what the agent may do with it. Reads run freely; changes go through plan approvals and Auto-authorization.
See the IAM trust model for how the token exchange works.