Cloud storage authentication
Use refreshed AWS role credentials or Azure VM managed identity in the agent and archive gateway.
AWS EC2 role
Attach an IAM instance profile to the customer VM and allow IMDSv2 access. Configure an existing bucket and region. No static AWS key variables are needed in role mode. When both AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN are set, web identity takes precedence; the platform must maintain the token file. Incomplete web identity configuration fails closed. IMDSv1 fallback is disabled.
coldctl destination add s3 --name aws-archive --bucket YOUR_BUCKET --region ap-south-1 --prefix coldctl --role-auth
coldctl destination test aws-archiveAWS permissions
Scope the agent to archive-prefix GetObject and PutObject permissions. destination test additionally needs DeleteObject for unique .coldctl-probe-* keys under that prefix. The gateway needs ListBucket restricted to the prefix and GetObject for archive objects; prefer a separate read-only role. Customer-managed KMS encryption requires corresponding key permissions and key policy. Bucket creation and IAM provisioning are outside the CLI.
Azure VM identity
Enable a system-assigned identity on the VM, or attach a user-assigned identity. Assign Storage Blob Data Contributor to the agent at container scope and Storage Blob Data Reader to the gateway, preferably with a separate identity. Allow role assignments to propagate. --managed-identity-client-id takes the user-assigned identity client UUID, not its object ID.
coldctl destination add azure --name azure-archive --account YOUR_ACCOUNT --container archives --prefix coldctl --managed-identity
coldctl destination test azure-archive
# For a user-assigned identity, add:
# --managed-identity-client-id YOUR_CLIENT_UUIDGateway settings
In [remote.provider], use role_auth = true for S3 or managed_identity = true for Azure. Azure accepts managed_identity_client_id for a user-assigned identity. Match the agent bucket/container, region and prefix. Static environment references are ignored in cloud identity modes. Changing authentication does not change the gateway archive namespace identity.
Supported identity environments
These modes support EC2 IMDSv2/AWS web identity and Azure VM metadata identity. They do not implement shared AWS profiles, AWS SSO, ECS task credentials, arbitrary assume-role chains, Azure CLI login, App Service identity endpoints or sovereign-cloud endpoint overrides. A laptop needs environment credentials unless it is running in a supported identity environment. Custom storage endpoints are rejected in identity modes; private networking can resolve the standard service hostname.
Remote trial checklist
Use verified TLS and database passwords for PostgreSQL and MongoDB. Test each source and destination, then run a bounded export without deletion. Verify the archive, refresh the gateway catalog, retrieve records and validate restoration. Only then authorize verified deletion or recurring archival. Exercise credential expiry and restart on the actual cloud VM. Local mock refresh tests and emulator tests do not verify your IAM/RBAC or network rules.
Google credentials
GCS supports service-account and authorized-user ADC JSON files and attached GCP instance credentials. External-account federation files are unsupported by the pinned SDK.