Cloud Credentials Tabs

Cloud Credentials tabs display cloud provider credentials in your lab interface, giving users easy access to AWS, Google Cloud, and Azure credentials. This tab type shows credentials for cloud account resources that already exist in your lab’s Sandbox tab, so at least one AWS Account, Azure Subscription, or Google Project resource must exist before you can add this tab.

Creating a Cloud Credentials Tab

To create a Cloud Credentials tab:

1. Navigate to the Tabs section in your lab editor
2. Click Add Tab and select Cloud Credentials from the dropdown. This option is disabled until your lab has at least one cloud account resource in the Sandbox tab
3. Use the Add cloud account menu to pick from your lab’s existing cloud account resources

If your lab has exactly one cloud account resource and the tab has no accounts added yet, that resource is added automatically when you open the tab.

Supported Fields

Field	Required	Description
Name (internal)	✓	Used for internal reference. Not visible to end users

Cloud Accounts

Each cloud account in the tab is backed by an existing sandbox resource, picked from the Add cloud account menu. The menu only lists resources that haven’t already been added. Once you add a resource, its target can’t be changed. To display a different resource instead, remove the account and add the one you want.

Removing an account is only available when your lab has more than one cloud account resource to choose from, since the last remaining resource can’t be removed from the tab.

AWS Account

Field	Required	Description
Target	✓	The AWS Account resource to display credentials from, picked from Add cloud account
Users	✓	IAM users from the target AWS Account whose credentials should be displayed

If the AWS Account resource has only one user, it’s selected automatically and can’t be deselected.

Note

Selecting a user with a risky managed policy (for example an Administrator or FullAccess policy) shows a warning that broad permissions may make it easier for users to take actions that increase costs.

Google Project

Field	Required	Description
Target	✓	The Google Project resource to display credentials from, picked from Add cloud account
Users		Users from the target Google Project whose credentials should be displayed
Service Accounts		Service accounts from the target Google Project whose credentials should be displayed

If the Google Project resource has only one user, it’s selected automatically and can’t be deselected.

Note

Selecting a user or service account with a risky role (for example owner, editor, or admin) shows a warning that broad permissions may make it easier for users to take actions that increase costs.

Azure Subscription

Field	Required	Description
Target	✓	The Azure Subscription resource to display credentials from, picked from Add cloud account
Users		Users from the target Azure Subscription whose credentials should be displayed
Service Principals		Service principals from the target Azure Subscription whose credentials should be displayed

If the Azure Subscription resource has only one user, it’s selected automatically and can’t be deselected.

Note

Selecting a user or service principal with a risky role (for example Owner, Administrator, or Contributor) shows a warning that broad permissions may make it easier for users to take actions that increase costs.

Validation Rules

• At least one provider block (aws_account, google_project, or azure_subscription) is required
• For AWS Account blocks, at least one user must be specified
• For Google Project blocks, at least one user OR service account must be specified
• For Azure Subscription blocks, at least one user OR service principal must be specified
• All user/account names must match names defined in the target cloud provider resource

Example Configuration

A Cloud Credentials tab displaying credentials from multiple cloud providers:

• AWS credentials for a “student” user
• Google Cloud credentials for a “developer” user and a service account
• Azure credentials for an “admin” user

Changes to a cloud credentials tab follow the same edit mode and publishing workflow as other lab resources.

Reference

For detailed HCL reference information, see the Cloud Credentials Reference.