> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Volcengine

> Connect a Volcengine (火山引擎) account with OIDC federation — no access key to store.

Nuphos reaches Volcengine (火山引擎) through **OIDC web-identity federation**. You
register Nuphos as an IAM identity provider, create a role that trusts it, and
Nuphos mints a short-lived token per team and calls `sts:AssumeRoleWithOIDC`.

**No access key is stored.** Nuphos keeps only the role's **TRN**.

## Connect

The wizard in **Connectors → Connect → Volcengine** shows the issuer and client
id for your team. Copy them from there.

### 1. Add the identity provider

In the IAM console, create an **OIDC** identity provider with the issuer URL and
client id from the wizard.

### 2. Create the role

Create a role that trusts that provider, conditioned on the **subject** the
wizard shows — that pins the role to your team. Attach a policy covering the work
you want done (VKE and ECS, typically), then copy the role's **TRN**. It looks
like `trn:iam::2100000000:role/Nuphos`.

### 3. Authorize cluster access

VKE grants cluster access per region, so repeat the in-cluster authorization for
each region that has clusters you want the agent to reach.

### 4. Bind the role

Enter the TRN in Nuphos.

## In the Nuphos app

* **ECS instances** — the account's compute.
* **Clusters** — VKE clusters land in the shared
  [cluster browser](/infrastructure/clusters) alongside EKS, GKE, and the rest.

## What the agent can do for you

The agent operates the account within whatever policy you attached to the role,
correlating it with your other [connected accounts](/connectors/overview) and
proposing changes as [plans](/agent/plans).

## Permissions & authorization

* **The role's policy** is the outer limit — Volcengine enforces it.
* **Hard boundary — who can use it.** Only team **Administrators** can bind or
  remove the account, and they can restrict it to specific members with a
  [member allow-list](/security/access-control).
* **Soft boundary — what the agent may do with it.** Reads run freely; changes go
  through [plan approvals](/security/approvals) and
  [Auto-authorization](/security/auto-mode).

See the [IAM trust model](/security/iam-trust) for how the token exchange works.