Granting access key and password authentication

Edit online

Access Key Authentication enables the generation of AWS-style credentials for user accounts. These credentials can be used to perform AWS authentication for S3 requests. Password Authentication is also supported.

About this task

This task applies to accessing standard vaults and management vaults. Access keys for container access must be managed via the Service API or Cloud Storage Object API.

CAUTION:
It is recommended that at least one option is selected (Access Key Authentication or Password Authentication).

Procedure

  1. Navigate to Security > Enable/Disable Authentication Mechanisms
  2. Enable Access Key, Password Authentication, or both by clicking Configure
    The target account must exist or be created. Accounts that are created while Access Key Authentication is enabled no longer require a username/password to be set.
  3. Take the following steps for Access Key Authentication.
    1. Create access keys for the target account (Security | Account | Access Key Authentication).
    2. Click Change.
    3. Click Generate New Access Key to create new access keys (credentials).
      A maximum of 10 access keys can be created.

What to do next

Upon enabling Access Key Authentication, the Access Key Authentication section appears on the account page, and the Create Account flow allows an account to be created without requiring a user name and password.

A vault user with Access Key Authentication can log in to My Account and change Name, Email, Timezone, Username, Password, and change Access Keys. A vault user with Password Authentication does not have Access Keys.

An account can be disabled by someone with Security Officer privileges, which prevents vault access and the ability to log in to the Manager Web Interface. Individuals with these roles can also re-enable the account. An access key can be disabled by someone with Security Officer privileges or by the vault user that contains the access key. If a vault user attempts to use a disabled access key, the request will fail. Disabled access keys can be enabled by someone with Security Officer privileges or by the vault user that contains the access key.

Hide Secret Key can be enabled to enhance security measures for managing the Secret Key portion of Access Keys. Enabling the feature makes the Secret Key portion of Access Keys one-time accessible at the time of creation and inaccessible thereafter. If Access Keys exist before you enable the feature, those Secret Keys are no longer accessible. It is advised to keep a record of necessary Access Keys before you enable the feature. When you create new Access Keys with hiding enabled, Secret Key appears in a modal window along with an option to download a .csv file that contains both the Access Key ID and Secret Key token. After the modal is closed, the secret portion cannot be retrieved again.

Note: AWS authentication for S3 requests should not be used along with groups. Access Key authentication requests ignore group permissions.