> For the complete documentation index, see [llms.txt](https://docs.unitlab.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.unitlab.ai/documentation/security/cloud-credential-governance.md).

# Cloud credential governance

Cloud connections extend the Unitlab trust boundary into another system. Scope the identity to the minimum bucket or prefix, monitor its ownership, and define how Unitlab behavior changes when access is removed.

For enterprise use, the connection should be treated as infrastructure, not as a convenient personal login:

1. Create a dedicated read-only or least-privilege identity for Unitlab.
2. Restrict it to the required bucket/container and prefix.
3. Avoid root or account-wide credentials.
4. Test with a small non-sensitive prefix.
5. Confirm that files, metadata, nested paths, and synchronization behave as expected.
6. Record the source system and connection owner.
7. Separate permission to manage cloud connections from permission to annotate data.

Workspace administrators can create, update, delete, test, and browse cloud connections from Workspace Settings. Connection administration requires cloud-storage permission and should remain separate from ordinary data browsing or annotation.

### Use this in production

* Use a dedicated organization-owned cloud identity.
* Grant the minimum read or write actions and exact storage scope required.
* Store secrets or role configuration in approved systems and rotate on schedule.
* Test enumeration and import against the intended prefix only.
* Before revocation, understand whether already-registered data, source references, and releases remain usable.

{% hint style="warning" %}
Do not publish provider account IDs, secret names, bucket paths, signed URLs, or regulated filenames in public documentation.
{% endhint %}