Federated connections for AWS S3, Azure DevOps, and SharePoint

Overview

To reduce reliance on long‑lived secrets and make connections more secure and manageable, we’ve added federated connection support to the AWS S3, Azure DevOps, and SharePoint connectors in Fusion. You can now authenticate these connectors using your organization’s identity provider (Azure AD / Microsoft Entra ID or AWS IAM federation) so Fusion obtains short‑lived credentials at runtime instead of storing client secrets or static keys.

What’s new

• Federated connection option — a new connection type for AWS S3, Azure DevOps, and SharePoint that uses your identity provider to mint temporary credentials or tokens.
• Consistent auth model — setup follows the same federated/OIDC or IAM role pattern you already use for other Azure AD or AWS identity integrations.
• No long‑lived secrets — Fusion uses short‑lived tokens/credentials returned by your IdP or AWS STS, reducing secret sprawl and rotation overhead.
• Admin controls — organizations can enforce which identity providers and roles are available, and limit connector permissions through standard Azure/AWS role and scope management.

How it works

1. In Fusion, go to Connections > Create Connection and choose AWS S3, Azure DevOps, or SharePoint.
2. Select the new Federated / Identity Provider authentication option instead of the client‑secret / token option.
3. Follow the connector’s guided steps to register or select the IdP/client, configure redirect/callback URLs (if required), and map the identity to the target role (AWS role, Azure app role, SharePoint service principal) that grants the needed permissions.
4. Save the connection. At runtime Fusion exchanges an IdP assertion (or assumes an IAM role) and receives short‑lived credentials/tokens which it uses for API calls.

Why this matters

• Improved security — temporary credentials reduce the window of exposure if a credential is compromised.
• Easier governance — use existing IdP and role/scopes to manage access, audits, and lifecycle instead of managing connector secrets separately.
• Consistent admin experience — the federated option follows patterns already used for Azure AD / AWS integrations, lowering setup friction across connectors.

How to get started

1. Decide which identity provider flow your organization will use:
   • AWS: configure an IAM role with a trust policy for your IdP and enable STS assume‑role or OIDC federation.
   • Azure/SharePoint/Azure DevOps: register an app in Azure AD / Microsoft Entra and grant the required API permissions and roles.
2. In Fusion: Connections > Create Connection > choose AWS S3, Azure DevOps, or SharePoint and select the Federated authentication option.
3. Provide the IdP metadata, role/client identifiers, and callback/redirect URL if prompted. Save and test the connection by performing a read action (list buckets, list repos, list sites) to validate permissions.
4. Work with your security/identity team to lock down which roles and scopes connectors may assume for least privilege.

Permissions and security

• Federated connections act with the permissions granted to the mapped role or service principal — they cannot exceed those rights.
• No long‑lived client secrets or static keys are stored in Fusion for these connections; Fusion stores only the connection metadata and uses short‑lived credentials at runtime.
• Follow your org’s policies for registering apps, consent, and role assignment. Consider automated role review and rotation policies on the IdP side.

Troubleshooting (quick)

• Unable to assume role / token exchange fails: Verify the IdP trust relationship / app registration, callback URLs, and that the role/client identifier in the Fusion connection matches the IdP/AWS configuration.
• Permission errors on actions: Confirm the mapped role or app has the required permissions in AWS, Azure DevOps, or SharePoint. Test with the minimal read action first.
• Unexpected token expiry: Check your IdP and AWS STS configuration for token TTL and clock skew; ensure Fusion’s runtime calls occur within the token lifetime.

Documentation

• AWS S3 modules
• Azure DevOps modules
• SharePoint modules

Feedback and support

Tell us how federated connections are working for your organization or request enhancements (examples: built‑in role templates, automated IdP setup snippets, or delegated admin approval flows) by:

• Posting in the Experience League Community thread for the respective connector.
• Opening a support ticket via the Admin Console Support portal for access or configuration help.
• When reporting issues, include the connector type, IdP flow used, example error messages, and the role/app identifiers to help us reproduce and resolve problems faster.

We’re pleased to offer federated authentication across AWS S3, Azure DevOps, and SharePoint — try the new federated connection option to reduce secret sprawl and align Fusion connections with your identity governance practices.