Cloud IAM (Azure)

Nomos brokers Azure access via federated identity — your subscription trusts id.auto-nomos.com as an OIDC issuer, and Nomos mints subject-bound JWTs that Azure exchanges for short-lived AAD tokens on every PDP request.

No stored Azure credentials. No client secrets in Nomos's database. The trust lives in your subscription.

How it works

1. Agent → control plane: "I want to read this storage account."
2. Control plane mints a UCAN scoped to the resource + action.
3. Agent → PDP with UCAN.
4. PDP mints a federated assertion (signed by Nomos OIDC key, audience = api://AzureADTokenExchange).
5. PDP exchanges that for an AAD access token via Azure STS.
6. PDP calls Azure with the AAD token, returns the response.

The AAD token lives only inside the PDP process for the duration of one upstream call.

Bootstrap (Terraform)

The fast path: clone, terraform apply, paste two outputs into the dashboard.

git clone https://github.com/varendra007/agent-credential-broker.git
cd agent-credential-broker/infra/terraform/azurerm-nomos-bootstrap

cat > terraform.tfvars <<EOF
nomos_oidc_issuer = "https://id.auto-nomos.com"
nomos_subject     = "org/<your-nomos-org-id>"
target_subscription_id = "<your-azure-subscription-id>"
target_resource_group  = "rg-app-prod"
EOF

terraform init
terraform apply

Output:

client_id      = "abcd1234-…"
tenant_id      = "wxyz5678-…"

Wire in the dashboard

1. 1
   Open Cloud → Connect Azure

   /app/cloud/connect/azure. Paste the Terraform outputs.

   

2. 2
   Verify

   Click Test. Dashboard mints a no-op assertion, exchanges it for an AAD token, calls https://management.azure.com/subscriptions/<id> with the token. Green check = federation works.

Commands

• /azure/storage_blob/list, /azure/storage_blob/get, /azure/storage_blob/put (step-up)
• /azure/keyvault/secret/get, /azure/keyvault/secret/list (step-up)
• /azure/resource_group/list, /azure/resource_group/get
• /azure/vm/list, /azure/vm/start, /azure/vm/stop (step-up), /azure/vm/restart (step-up)
• /azure/cosmosdb/document/get, /azure/cosmosdb/document/upsert (step-up)

60+ commands across Storage, Key Vault, Resource Manager, Cosmos DB, VM, App Service, Functions. Full catalog: Policy templates.

Starter policies

• azure:read-only — list + get across the configured resource group.
• azure:storage-read — blob read only.
• azure:vm-operator — start/stop on one resource group, step-up on every destructive action.

Cedar fragment

permit (
  principal,
  action in [Action::"/azure/storage_blob/list", Action::"/azure/storage_blob/get"],
  resource
) when {
  resource.resource_group == "rg-app-prod" &&
  resource.account_name in ["acmeproddata"]
};

forbid (
  principal,
  action in [Action::"/azure/vm/restart", Action::"/azure/vm/stop"],
  resource
) when { !context.cosigner };