AuthFI Connect — Multi-Cloud IAM

AWS · GCP · Azure · OCIOIDC token exchangeZero stored credentialsConsole signin federation

AuthFI Connect lets you manage who can access AWS, GCP, Azure, and OCI from a single control plane. Map AuthFI roles and groups to cloud IAM roles — users get temporary credentials or console signin with zero cloud passwords.

How it works

Connect cloud accounts — Add your AWS account ID, GCP project, Azure subscription, or OCI tenancy
Map roles — AuthFI role “cloud-admin” → AWS arn:aws:iam::123:role/Admin
Users get access — Based on their roles/groups, they can get credentials or open the cloud console

User logs in → AuthFI checks roles → Finds cloud mapping → Issues OIDC token → Exchanges for cloud credentials

Supported providers

AWS

STS AssumeRoleWithWebIdentity. Federation signin URL for console. Trust policy uses your-tenant.authfi.app as OIDC provider.

GCP

STS token exchange via Workload / Workforce Identity Federation. Service-account impersonation supported.

Azure

JWT-bearer on-behalf-of flow. Portal federation for console. Entra ID app registration trusts AuthFI tokens.

OCI

Token exchange against OCI Identity Federation. Compartment-level role mapping.

API Endpoints

User-facing (Auth API)

Method	Endpoint	Description
GET	`/v1/{tenant}/cloud/access`	List cloud accounts user can access
POST	`/v1/{tenant}/cloud/user-credentials`	Get temporary cloud credentials
POST	`/v1/{tenant}/cloud/console-signin`	Get console redirect URL

Admin (Management API)

Method	Endpoint	Description
GET/POST	`/manage/v1/{tenant}/cloud/accounts`	Manage cloud accounts
GET/POST	`/manage/v1/{tenant}/cloud/mappings`	Manage role mappings
GET	`/manage/v1/{tenant}/cloud/logs`	Cloud access audit log

Policy conditions

Role mappings support conditions:

{
  "require_mfa": true,
  "allowed_ips": ["10.0.0.0/8"],
  "time_window": {
    "start": "09:00",
    "end": "18:00",
    "tz": "UTC"
  }
}

Plan availability

Feature	Scale	Enterprise
Cloud accounts	4	Unlimited
Console signin	Yes	Yes
MFA conditions	Yes	Yes
Access audit log	Yes	Yes

Next steps

AWS Setup
GCP Setup (coming soon)
Azure Setup (coming soon)
OCI Setup (coming soon)