Cloud Identities

Grant CARTO access to cloud services without long-lived credentials

Cloud identity federation lets CARTO Self-Hosted access cloud services (storage, data warehouse, AI providers) using short-lived, automatically-rotated credentials instead of long-lived secret keys. Configure the mechanism that matches your Kubernetes vendor.

• Use Workload Identity in GCP — bind CARTO's Kubernetes service account to a GCP IAM service account on GKE

• Use EKS Pod Identity in AWS — associate an IAM role with CARTO's Kubernetes service account on EKS

Azure Managed Identities support will be documented here in a future update.