1. The account and IAM #
Protecting the main access.
Rules #
- Two-factor authentication (TOTP app, security key) on the customer account.
- OVHcloud IAM: local or federated users (SAML SSO), policies that allow actions on resources.
- Separate administrative, technical and billing contacts.
2. Technical identities #
For tools and applications.
OpenStack users and API #
| Identity | Usage | Good practice |
|---|---|---|
| OpenStack user | CLI, Terraform, applications | One per tool, minimal roles (Compute Operator, ObjectStore Operator…) |
| OVHcloud API key | OVHcloud API (billing, domains, Kubernetes…) | Rights limited to specific paths and methods, validity period |
| S3 credentials | Object Storage | Tied to a user; per-bucket policies |
openstack user list 2>/dev/null || echo "gestion des utilisateurs depuis l'espace client ou l'API OVHcloud"
openstack role assignment list --names --user user-terraform
openstack ec2 credentials create # couple accès/secret pour l'API S3
openstack keypair create --public-key ~/.ssh/id_ed25519.pub ma-cle3. Best practices #
Least privilege.
Rules #
- One identity per use and per environment; revoked when someone leaves.
- Secrets in a vault (Vault, the CI secrets manager), never in Git.
- SSH keys per person; password authentication disabled on instances.
- Log actions (activity logs, Logs Data Platform).
Common mistake: An openrc file contains a password or a token: protect it (chmod 600) and never commit it.
