stacks— setup includes a permissions policy for creating, updating, and deleting Nuon CloudFormation install stacks.ecr— image repository access (Amazon ECR): read-only permissions for selected repositories.gar— image repository access (Google Artifact Registry).acr— image repository access (Azure Container Registry).custom— setup includes only the OIDC trust configuration. Attach your own permissions policy to the IAM role before using it for stack operations.
stacks, ecr, and custom. GCP supports gar. Azure supports acr. A preset describes setup and verification behavior; the cloud provider enforces the permissions attached to the principal.
OIDC trust model
Nuon mints a short-lived OIDC token when it needs to perform an operation. The role trust policy must restrict these values:- Issuer — your Nuon control plane’s public API URL.
- Subject —
org:<org_id>:connection:<connection_id>, unique to one connection. - Audience —
sts.amazonaws.comfor AWS, the generated//iam.googleapis.com/projects/<project_number>/locations/global/workloadIdentityPools/<pool>/providers/nuonfor GCP, orapi://AzureADTokenExchangefor Azure.
Create and configure a connection
Creating a connection saves it in Nuon; it does not create the IAM role or OIDC provider in AWS. Connections are identity only and take no repository inputs.stacks preset also includes an explicit action allowlist covering the resources in Nuon’s install stack templates. With --preset custom, no permissions policy is generated: attach your own policy. The ecr, gar, and acr presets are for private images and carry their own prerequisites and repository setup; see Private image registries.
After applying the setup, verify the connection from the dashboard’s Verify step or run:
verified, the connection is available in the install creation wizard. For scripts, create --output json and get <connection-id> --output json include the generated setup material in setup without the human-readable next-step instructions.
Verification exchanges a Nuon OIDC token for temporary cloud credentials, checks the returned identity, and confirms that a foreign connection subject cannot assume the role. For stacks, it also makes a read-only CloudFormation DescribeStacks probe. This probe does not prove that every stack operation is permitted. For custom, verification checks identity and trust only; you are responsible for the permissions required by your operations.
Use connections for install stacks
When creating an AWS install, select a verified AWS connection whose role has stack-management permissions. The connection binding is immutable after creation: a connection cannot be added, replaced, or removed from an existing install. Nuon uses the pinned connection for CloudFormation stack creation, updates, and deletion. If no connection is selected at creation, the install remains customer-managed. A connection referenced by an install cannot be deleted; the API returns HTTP 409. Delete the referencing installs before deleting the connection.Share a principal across connections
Connections in the same organization may reference the same IAM role, GCP service account, or Entra application. Sharing gives you one place to revoke Nuon’s access, but every connection on the shared principal gets the combined permissions of all of them, and revoking it cuts them all off at once. Prefer a separate principal per connection unless you specifically want that blast radius. New connections default to their own role or service account name; sharing is opt-in through the dashboard’s Principal dropdown or by passing an existing principal tocreate.
Each connection keeps its own ID, exact federation subject, verification status, and saved assignments. Presets select setup and verification behavior; they are not permission boundaries. In setup instructions, choose Existing role or Existing service account when reusing a cloud resource: the instructions preserve existing trust and grants and add federation only for the current connection’s exact subject. Apply updates serially for a shared principal; read-and-merge cloud IAM updates are not atomic.
On AWS, deleting the account’s IAM OIDC provider for the Nuon issuer cuts off every Nuon role in that account at once, including roles shared by multiple connections. Deleting a connection stops Nuon from using it, but does not remove cloud trust or permissions; review those separately without disturbing other connections.
CLI
Usenuon cloud-connections list|get|create|verify|delete. Responses report the preset, status, status message, and last verification time. Connections are identity only: create and verify them without repository names. For private image repositories, use nuon image-repositories.
Nuon verifies connections on demand, not on a recurring schedule. The last verification time records the most recent verification attempt; a verified status does not guarantee that cloud trust or permissions have not changed since then. Use verify after changing the role or its policies. A failed verification updates the connection’s status and emits cloud-connection-verification-failed for notification subscriptions.
Stack operations still obtain temporary cloud credentials through the connection when needed. This does not repeat the full verification checks, including the foreign-subject trust check.