Authentication & Scopes

suve talks to each cloud's data plane using that cloud's own SDK credential chain — the same one the native CLI (aws / gcloud / az) uses. There is nothing suve-specific to configure: sign in the normal way, then point suve at the resource with an environment variable (or the equivalent flag).

Provider	Sign in (identity)	Point at the resource
AWS	aws sso login \ --profile prod	export AWS_PROFILE=prod export AWS_REGION=us-east-1
Google Cloud	gcloud auth \ application-default \ login	export GOOGLE_CLOUD_PROJECT=my-project
Azure	az login	# secret export AZURE_KEYVAULT_NAME=my-vault # param export AZURE_APPCONFIG_NAME=my-store

Note

• Every value has a flag equivalent: --profile/--region, --project, --vault-name/--store-name.
• AWS — the standard credential chain: SSO, static keys, ~/.aws/credentials, or an IAM role.
  • With aws-vault: aws-vault exec prod -- suve param show /my/param.
• Google Cloud — Application Default Credentials; or a service-account key via GOOGLE_APPLICATION_CREDENTIALS.
• Azure — the DefaultAzureCredential chain; or a service principal via AZURE_CLIENT_ID / AZURE_CLIENT_SECRET / AZURE_TENANT_ID.
  • az login sets no environment variables — it caches credentials under ~/.azure, which suve reuses.
  • The Key Vault / App Configuration name is a globally-unique endpoint, so no subscription or resource group is needed.

AWS Configuration

suve uses standard AWS SDK configuration:

Authentication (in order of precedence):

1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
2. Shared credentials file (~/.aws/credentials) and config (~/.aws/config)
   • Use AWS_PROFILE to specify which profile to load (default: default)
3. IAM role (EC2, ECS, Lambda)

Region:

• AWS_REGION or AWS_DEFAULT_REGION environment variable
• ~/.aws/config file

Warning

Ensure your IAM role/user has appropriate permissions:

• SSM: ssm:GetParameter, ssm:GetParameters, ssm:GetParameterHistory, ssm:PutParameter, ssm:DeleteParameter, ssm:DescribeParameters, ssm:AddTagsToResource, ssm:RemoveTagsFromResource
• SM: secretsmanager:GetSecretValue, secretsmanager:DescribeSecret, secretsmanager:ListSecretVersionIds, secretsmanager:ListSecrets, secretsmanager:CreateSecret (new secrets only), secretsmanager:UpdateSecret, secretsmanager:DeleteSecret, secretsmanager:RestoreSecret, secretsmanager:TagResource, secretsmanager:UntagResource

Google Cloud Configuration

Scope	Flag	Environment variable
Project	--project	GOOGLE_CLOUD_PROJECT

Credentials come from Application Default Credentials — set up locally with gcloud auth application-default login, or point at a service-account key with GOOGLE_APPLICATION_CREDENTIALS.

Azure Configuration

Scope	Flag	Environment variable
Key Vault name (secret)	--vault-name	AZURE_KEYVAULT_NAME
App Configuration store (param)	--store-name	AZURE_APPCONFIG_NAME
Namespace (param)	--namespace / --ns	AZURE_APPCONFIG_NAMESPACE

The target is addressed by its globally-unique name, so no subscription or resource group is needed. Credentials come from the DefaultAzureCredential chain — set up locally with az login, or a service principal via AZURE_CLIENT_ID / AZURE_CLIENT_SECRET / AZURE_TENANT_ID. The namespace axis is Azure App Configuration's "label".