AuthFI Connect
AuthFI AuthFI Connect lets you manage who can access AWS, GCP, Azure, and OCI from a single control plane. Map AuthFI roles and groups to cloud IAM roles — users get temporary credentials or console signin with zero cloud passwords.
How It Works
- Connect cloud accounts — Add your AWS account ID, GCP project, Azure subscription, or OCI tenancy
- Map roles — AuthFI role “cloud-admin” → AWS
arn:aws:iam::123:role/Admin - Users get access — Based on their roles/groups, they can get credentials or open the cloud console
User logs in → AuthFI checks roles → Finds cloud mapping → Issues OIDC token → Exchanges for cloud credentials
Supported Providers
| Provider | Token Exchange | Console Signin | Method |
|---|
| AWS | STS AssumeRoleWithWebIdentity | Federation signin URL | OIDC |
| GCP | STS token exchange | Workforce Identity | OIDC |
| Azure | JWT-bearer on-behalf-of | Portal federation | OIDC |
| OCI | Token exchange | Identity federation | OIDC |
API Endpoints
User-Facing (Auth API)
| Method | Endpoint | Description |
|---|
| GET | /v1/{tenant}/cloud/access | List cloud accounts user can access |
| POST | /v1/{tenant}/cloud/user-credentials | Get temporary cloud credentials |
| POST | /v1/{tenant}/cloud/console-signin | Get console redirect URL |
Admin (Management API)
| Method | Endpoint | Description |
|---|
| GET/POST | /manage/v1/{tenant}/cloud/accounts | Manage cloud accounts |
| GET/POST | /manage/v1/{tenant}/cloud/mappings | Manage role mappings |
| GET | /manage/v1/{tenant}/cloud/logs | Cloud access audit log |
Policy Conditions
Role mappings support conditions:
{
"require_mfa": true,
"allowed_ips": ["10.0.0.0/8"],
"time_window": {
"start": "09:00",
"end": "18:00",
"tz": "UTC"
}
}
Plan Availability
| Feature | Scale | Enterprise |
|---|
| Cloud accounts | 4 | Unlimited |
| Console signin | Yes | Yes |
| MFA conditions | Yes | Yes |
| Access audit log | Yes | Yes |
Next Steps