OVHcloud

Overview

The OVHcloud integration connects your OVHcloud account to Oneleet. It syncs the account owner and every IAM local user as user account assets, so Oneleet can monitor who can sign in to your OVHcloud Control Panel.

What does Oneleet monitor?

• The OVHcloud account owner
• OVHcloud IAM local users, including each user’s group (for example ADMIN or UNPRIVILEGED) and whether the user is disabled

OVHcloud doesn’t share whether the account owner or local users have turned on two-factor authentication, so these users show two-factor authentication as unknown.

Setup

To set up the OVHcloud integration, go to Integrations > Add integration > OVHcloud.

Oneleet connects to the OVHcloud API with a service account that has a read-only IAM policy. Create both while signed in as the account owner or as a local user in the ADMIN group.

Creating the service account

1. In the OVHcloud Control Panel, open Identity, Security & Operations › Identities in the left menu.
2. Open the Service account tab and click Add a service account.
3. Enter a Service account name and Description, for example compliance-monitor and Read-only access for compliance monitoring, then click Create.
4. The confirmation window shows the credentials only once. Copy the Service account name value (it starts with your region, for example US. or EU.) into Client ID in Oneleet, and the Password value into Client Secret, then click Close.

Giving the service account read access

1. Open Identity, Security & Operations › Policies and click Create a policy.
2. Enter a Policy name, for example compliance-monitor-read-only.
3. Under Identities, click Add service accounts and select the service account you created.
4. Under Product types, select OVHcloud customer account, then under Resources select your account ID (your NIC handle, for example ab123-ovh).
5. Under Actions › Actions added manually, add these two actions one at a time:
   • account:apiovh:me/get
   • account:apiovh:me/identity/user/get
6. Click Create policy.

See How to use IAM policies in the OVHcloud docs for more detail.

Choosing your region

Set Region in Oneleet to the region of your account: eu if you sign in at www.ovh.com/manager, ca for ca.ovh.com/manager, or us for manager.us.ovhcloud.com.

Troubleshooting

• OVHcloud rejected the service account credentials: the service account was deleted or its password was changed. Create a new service account, add it to the policy, then click Reconnect on the OVHcloud integration and enter the new client ID and secret.
• The service account isn’t allowed to read the account: the IAM policy is missing, or it doesn’t include both actions above. Fix the policy; Oneleet tries again on the next sync.