Service Accounts

Overview

Service accounts in Thalassa Cloud are non-human identities designed for automated systems and applications. They provide secure access to cloud resources without using human user accounts. Service accounts are perfect for CI/CD pipelines, monitoring systems, and other automated tools that need programmatic access.

Service accounts use access credentials that authenticate automated systems to Thalassa Cloud APIs. You can set an expiration date on credentials (recommended) or revoke them at any time. For production automation, prefer Workload Identity Federation (OIDC) so systems authenticate with short-lived tokens instead of stored secrets.

When to Use Service Accounts

Use service accounts for:

CI/CD pipelines that deploy applications
Monitoring systems that collect metrics
Backup systems that need access to storage
Automation scripts that manage infrastructure
Any system that needs automated access without human interaction

Don’t use service accounts for human users. Human users should use their personal accounts with appropriate roles and permissions.

How Service Accounts Work

Service accounts are identities that can have roles and permissions assigned to them. They work just like user accounts, but they’re designed for machines and applications. When you create a service account, you can assign it roles that define what it can do.

Service accounts use access credentials to authenticate with Thalassa Cloud APIs. Each credential is limited by the API scopes you select and can include an expiration date. You can also use service accounts with workload identity federation, which allows external systems to authenticate using OIDC tokens instead of storing credentials.

Creating Service Accounts

Step 1: Navigate to Service Accounts

Go to IAM in your organisation dashboard
Click on the “Service Accounts” tab
Click “Create Service Account” button

Step 2: Enter Account Details

Enter a name for your service account. Use descriptive names that explain what the account is for. For example:

ci-cd-pipeline for CI/CD systems
monitoring-service for monitoring tools
backup-system for backup services

Add a description that explains the account’s purpose. This helps others understand when and why this service account was created. Clear descriptions make it easier to manage service accounts over time.

Step 3: Create the Service Account

Review your configuration and click “Create Service Account”. The service account is now created and ready to use.

Assign Roles and Permissions

After creating the service account, you can assign roles to the service account, allowing the service account to take actions on the Thalassa Cloud API.

Select from predefined roles or create custom roles that match your needs. Choose roles that give the service account only the permissions it needs to do its job.

For example, a CI/CD pipeline might need:

Read access to Kubernetes clusters
Write access to container registries
Read access to VPCs and networking resources

A monitoring service might only need:

Read access to Kubernetes clusters
Read access to compute resources

Follow the principle of least privilege. Only grant the minimum permissions needed.

Managing Access Credentials

After creating a service account and assigning permissions, create access credentials to authenticate with Thalassa Cloud APIs. Access credentials do not have a name or description. You must select at least one API scope, and setting an expiration date is recommended.

Scopes limit what the credential itself can do. They cannot grant more access than the service account’s roles and IAM policies allow — both the scopes and the IAM permissions must allow the action.

Creating Access Credentials

Step 1: Navigate to the Service Account

Go to IAM → Service Accounts
Select the service account you want to create credentials for

Step 2: Configure Credentials

Click “Create Access Credentials” or “Add Credentials”
Select one or more scopes. At least one scope is required
Set an expiration date (recommended). After this date the credentials stop working

Step 3: Save Credentials

Click “Create Credentials”
Copy the credentials immediately. You won’t be able to see them again after closing the dialog
Store the credentials securely in a secrets manager or password vault

Available Scopes

Category	Scope	Description
OpenID	OpenID	OpenID authentication and user information
API	API Read	Read-only access to API endpoints
API	API Write	Read and write access to API endpoints
Object Storage	Object Storage	Access to object storage APIs
Container Registry	Container Registry (Pull)	Pull images from the container registry
Container Registry	Container Registry (Push/Pull)	Push and pull images from the container registry
Observability	Observability Prometheus	Access to the Prometheus API
Observability	Observability Prometheus Query	Access to the Prometheus Query API
Observability	Observability Prometheus Remote Write	Access to the Prometheus Remote Write API
Observability	Observability Prometheus Alerts Read	Access to the Prometheus Alerts Read API
Observability	Observability Prometheus Alerts Write	Access to the Prometheus Alerts Write API
Observability	Observability Prometheus Rules Read	Access to the Prometheus Rules Read API
Observability	Observability Prometheus Rules Write	Access to the Prometheus Rules Write API
Observability	Observability Prometheus Alertmanager Config Write	Access to the Prometheus Alertmanager Config Write API

Follow the principle of least privilege: grant only the scopes the workload needs. For example, a deploy pipeline that only pulls images needs Container Registry (Pull) and API Read, not push or write scopes.

Using Access Credentials

Once you have credentials, you can use them to authenticate with Thalassa Cloud APIs. You can use credentials with:

The tcloud CLI
Terraform provider
Direct API calls
Other tools that support Thalassa Cloud authentication

Example with tcloud CLI:

tcloud --oidc-client="access-key" --oidc-secret="<access-secret>" kubernetes list

Rotating Credentials

Rotate credentials regularly for security. When you rotate credentials:

Create new credentials for the service account
Update your systems to use the new credentials
Verify everything works with the new credentials
Delete the old credentials

This ensures that if credentials are compromised, they become useless quickly.

Revoking Credentials

If credentials are compromised or no longer needed, revoke them immediately:

Go to the service account’s page
Find the credentials you want to revoke
Click “Delete” or “Revoke”
Confirm the deletion

Revoked credentials stop working immediately. Make sure you have new credentials ready before revoking old ones.

Using Service Accounts with OIDC Identity Federation (Recommended)

Service accounts can be used with workload identity federation for more secure authentication. Instead of storing long-lived credentials, external systems can use OIDC tokens to impersonate service accounts.

This is more secure because:

No credentials to store or leak
Tokens are short-lived and automatically expire
Tokens are tied to specific conditions (repositories, branches, environments)

For example, GitHub Actions can use OIDC tokens to authenticate as a service account without storing credentials in secrets.

To set up workload identity federation, see the Workload Identity Federation documentation.