Infrastructure as Code Connection Profiles

The following topics describe the connection profile parameters for Infrastructure as Code Connection platforms and services:

AWS CloudFormation Connection Profile Parameters

Before you can define a job, you must create a connection profile in the Configuration domain. A connection profile contains authorization credentials—such as the username, password, and other plug-in-specific parameters—and enables you to connect to the application server with only the connection profile name. To create a connection profile, see Creating a Centralized Connection Profile.

For more information about this plug-in, see Control-M for AWS CloudFormation.

The following table describes the AWS CloudFormation connection profile parameters.

Parameter

Description

CloudFormation URL

Defines the AWS CloudFormation API authentication endpoint.

https://cloudformation.us-east-1.amazonaws.com

AWS Region

Determines the region where the AWS CloudFormation jobs are located.

us-east-1

Authentication

Determines one of the following authentication methods:

  • AWS Key & Secret: Authenticates with an AWS access key and secret, which are used for services outside the AWS infrastructure.

  • AWS IAM Role: Authenticates with an AWS IAM role from within the AWS infrastructure, which removes the need to provide additional credentials.

AWS Access Key

Defines the AWS CloudFormation account access key.

AWS Secret

Defines the AWS CloudFormation account secret access key.

IAM Role

Defines the Identity and Access Management (IAM) role name for the AWS CloudFormation connection.

Use External Vault

Determines whether to retrieve secret parameter values from an external vault, as described in CyberArk Secret Parameters in Connection Profiles.

Connection Timeout

Determines the number of seconds to wait after Control-M initiates a connection request before a timeout occurs.

Default: 30

Azure Resource Manager Connection Profile Parameters

Before you can define a job, you must create a connection profile in the Configuration domain. A connection profile contains authorization credentials—such as the username, password, and other plug-in-specific parameters—and enables you to connect to the application server with only the connection profile name. To create a connection profile, see Creating a Centralized Connection Profile.

For more information about this plug-in, see Control-M for Azure Resource Manager.

The following table describes Azure Resource Manager connection profile parameters.

Parameter

Authentication Method

Description

Azure Login URL

Service Principal

Managed Identity

Defines the base URL of the Microsoft Entra/Azure AD authentication endpoint.

Default:https://login.microsoftonline.com

Azure Base URL

 

Defines the Azure Resource Manager authentication endpoint base URL.

Default: https://management.azure.com

Subscription ID

Service Principal

Managed Identity

Defines the Azure account ID of your organization.

Authentication Method

Service Principal

Managed Identity

Determines one of the following authentication methods:

  • Service Principal: Access protected Azure services and resources based on roles assigned to the Service Principal by the Azure administrator. The Service Principal is also known as an App Registration. Use this method if the Control-M/Agent is installed on-premises or with another (non-Azure) cloud vendor.

  • Managed Identity: Access protected Azure services and resources using a key created and managed by the Azure platform, without login credentials. Use this method if the Control-M/Agent is installed on an Azure virtual machine that has a Managed Identity with the required permissions.

Tenant ID

Service Principal

Defines the Azure tenant ID for your organization.

App ID

Service Principal

Defines the Registered App for the Azure service in your Microsoft Entra/Azure AD tenant. The corresponding Service Principal must be assigned the Owner or Contributor role for the Azure service.

Client Secret

Service Principal

Defines the password associated with the Service Principal/registered application.

Use External Vault

Service Principal

Determines whether to retrieve secret parameter values from an external vault, as described in CyberArk Secret Parameters in Connection Profiles.

Specify Managed Identity Client ID

Managed Identity

Determines whether the Managed Identity is specified by the Managed Identity Client ID parameter.

Toggle on this option when you use the Managed Identity authentication method and your Azure virtual machine has multiple Managed Identities.

Managed Identity Client ID

Managed Identity

Defines the client ID of the Managed Identity that is used for access. If only one Managed Identity is defined on your Azure virtual machine, it is detected automatically, and you can leave this parameter empty.

Connection Timeout

Service Principal

Managed Identity

Determines the number of seconds to wait after Control-M initiates a connection request before a timeout occurs.

Default: 20

GCP Deployment Manager Connection Profile Parameters

Before you can define a job, you must create a connection profile in the Configuration domain. A connection profile contains authorization credentials—such as the username, password, and other plug-in-specific parameters—and enables you to connect to the application server with only the connection profile name. To create a connection profile, see Creating a Centralized Connection Profile.

For more information about this plug-in, see Control-M for GCP Deployment Manager.

The following table describes the GCP Deployment Manager connection profile parameters.

Parameter

Description

Identity Type

Determines one of the following authentication types using GCP Access Control:

  • Service Account: Authenticates using an application ID (service account) and client secret.

  • IAM: Authenticates based on a detected IAM role, which removes the need to provide additional credentials.

Deployment Manager URL

Defines the Google Cloud Platform (GCP) authentication endpoint for Deployment Manager.

https://www.googleapis.com/deploymentmanager/v2/projects/

Security Account Key

(Service Account) Defines a service account that is associated with an RSA key pair.

Use External Vault

Determines whether to retrieve secret parameter values from an external vault, as described in CyberArk Secret Parameters in Connection Profiles.

Connection Timeout

Determines the number of seconds to wait after Control-M initiates a connection request before a timeout occurs.

Default: 20

Terraform Connection Profile Parameters

Before you can define a job, you must create a connection profile in the Configuration domain. A connection profile contains authorization credentials—such as the username, password, and other plug-in-specific parameters—and enables you to connect to the application server with only the connection profile name. To create a connection profile, see Creating a Centralized Connection Profile.

For more information about this plug-in, see Control-M for Terraform.

The following table describes the Terraform connection profile parameters.

Parameter

Description

Terraform Org Name

Defines the organization name where the Terraform workspace is located.

Token

Defines a Terraform token for authentication of connections to the Terraform workspace.

Use External Vault

Determines whether to locate and retrieve a secret from an external vault, as described in CyberArk Secret Parameters in Connection Profiles.

Connection Timeout

Determines the number of seconds to wait after Control-M initiates a connection request to Terraform before a timeout occurs.

Default: 20