Docs / Team and security

IAM trust model

How Pangea federates into your cloud accounts with short-lived, least-privilege credentials and no long-lived keys.

For the cloud providers on this page, Pangea holds no long-lived key. You set up a trust relationship once, and Pangea mints short-lived credentials on demand for each agent. This page explains how it works for each provider and why.

Note

Pangea uses federation wherever the provider supports it. Some connectors have no equivalent and take a token or key instead, which Pangea stores encrypted. Examples are the API tokens for Linode and Hetzner, and the optional R2 S3 credentials on Cloudflare. Each connector page says which it uses.

One Pangea identity provider

Pangea runs an OpenID Connect identity provider. When an agent needs cloud access, Pangea signs a short-lived token for your team and exchanges it with the cloud's token service.

Claim	Value
Issuer (`iss`)	`https://api.pangea.build`
Discovery document	`https://api.pangea.build/.well-known/openid-configuration`
Signing keys (JWKS)	`https://api.pangea.build/.well-known/jwks.json`
Subject (`sub`)	Your team's subject. It is unique to your team. Copy it from the connector dialog in the app.
Audience (`aud`)	Depends on the cloud. See the tables below.

The subject is the key isolation control. Your trust policy pins it, so the trust works only for your team. No other Pangea team can use it. This is the standard defence against the confused-deputy problem.

AWS: OIDC web-identity federation

Pangea calls sts:AssumeRoleWithWebIdentity against the IAM role you created. In the AWS console you add an OpenID Connect identity provider:

Field	Value
Provider URL	`https://api.pangea.build`
Audience	`sts.amazonaws.com`

Your role's trust policy pins both the audience and the subject with a StringEquals condition:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<your-account-id>:oidc-provider/api.pangea.build"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "api.pangea.build:aud": "sts.amazonaws.com",
          "api.pangea.build:sub": "<team-subject>"
        }
      }
    }
  ]
}

Replace <team-subject> with the value shown in the connector dialog. Pangea also makes sure a role ARN can be connected by only one team.

	Value
OIDC token lifetime	5 minutes
Assumed session lifetime	1 hour
What Pangea stores	The role ARN only

See Connect AWS for the full steps.

Azure, Tencent, Alibaba Cloud, Volcengine and Huawei Cloud

These clouds use the same Pangea identity provider as AWS: same issuer, same signing keys, same per-team subject. Only the audience differs, because each cloud pins its own client ID.

Provider	Token exchange Pangea calls	Audience (`aud`)	What Pangea stores
Azure	Entra `client_credentials` with `client_assertion`	`api://AzureADTokenExchange`	Tenant, client and subscription ID
Tencent Cloud	`sts:AssumeRoleWithWebIdentity`	`sts.tencentcloudapi.com`	Role ARN and OIDC provider name
Alibaba Cloud	`sts:AssumeRoleWithOIDC`	`sts.aliyuncs.com`	Role ARN and OIDC provider ARN
Volcengine	`sts:AssumeRoleWithOIDC`	`sts.volcengineapi.com`	Role TRN
Huawei Cloud	STS `AssumeAgencyWithOIDC`	`iam.myhuaweicloud.com`	Account ID, provider name and agency name

All of them get a 1-hour session.

Note

The Token exchange column is the API Pangea calls with the token. It is not always the action in your trust policy. On Alibaba Cloud, for example, the RAM trust policy grants sts:AssumeRole to the OIDC provider, with oidc:iss, oidc:aud and oidc:sub conditions. Pangea then calls the AssumeRoleWithOIDC API. Keep the action the console generates. See Connect Alibaba Cloud for the full policy.

Pangea stores no client secret, access key or service-account key for any of them. The per-team subject does the same isolation work as on AWS.

Each connector dialog shows the exact issuer, audience and subject to paste. Use the values from the dialog rather than typing them by hand. See Azure, Tencent Cloud, Volcengine and Huawei Cloud.

Google Cloud: workload identity federation, then impersonation

For Google Cloud you create a connector service account in your project. You grant Pangea the Service Account Token Creator role on it. Pangea then impersonates that account to mint short-lived access tokens.

You grant the role to a workload identity principal scoped to your team. It has this form:

principal://iam.googleapis.com/projects/NUMBER/locations/global/workloadIdentityPools/POOL/subject/TEAM_SUBJECT

Copy the exact principal from the connector dialog in the app. The pool lives in Pangea's own Google Cloud project, so you create no pool or provider yourself. Pangea federates into it with the same per-team token the other clouds use.

Google checks the subject in your grant against the token. So a token minted for another Pangea team can't use your grant. Google IAM enforces this, not Pangea's code.

	Value
Federated token lifetime	5 minutes
Impersonated token lifetime	1 hour
What Pangea stores	The service account email and project ID only

See Connect Google Cloud for the exact grant.

Why short-lived and per-agent

No standing keys. Federated connections store identity references, not cloud access keys. Token-based connectors have their own storage and rotation needs.
Limited blast radius. Credentials expire in about an hour and are scoped to the agent that asked for them.
You stay in control. You grant the trust in your own cloud. You can revoke it at any time by editing the role's trust policy or removing the impersonation grant.

Hardening

Start the role or service account read-only, and widen it only as the agent needs.
Keep the subject condition in place. It is what scopes the trust to your team.
Use access lists to limit who can use sensitive accounts.
Review significant cloud work with plans. Use provider IAM for a hard limit on what the agent can do.
Fix permission errors with an authorized administrator. Don't give an operational connector the power to widen its own permissions.

Questions? augusto@pangea.buildPrivacy · Terms