> For the complete documentation index, see [llms.txt](https://docs.flashback.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flashback.tech/guides/configure-external-delegated-credentials.md).

# Configure External or Delegated Credentials

Delegated credentials let you authorize Flashgate using provider-native IAM identities and short-lived tokens instead of long-term static secrets.

In practice, this means:

* **Cloud Storage**: grant access via provider IAM roles/policies at bucket/container scope.
* **AI/LLM**: use provider-native identity flows (assumed roles, service accounts, managed identities, token exchanges) and pass endpoint + secret/token to Flashgate's existing AI LLM configuration model.

## When to prefer delegated access

Use delegated access when you want stronger security controls in production:

* avoid long-lived keys where possible,
* centralize permissions in cloud IAM,
* enforce least privilege at narrow scope,
* rotate or expire credentials automatically,
* improve auditability via cloud provider logs.

{% hint style="info" %}
Flashgate configuration still uses product fields documented in [Configure an AI LLM](/guides/setup-the-cloud-and-ai-gateway/start-with-cloud-storage/create-a-bucket-1.md) and [Configure a Bucket](/guides/setup-the-cloud-and-ai-gateway/start-with-cloud-storage/create-a-bucket.md). Delegated patterns in this section explain how to produce credentials/tokens securely on the provider side.
{% endhint %}

## Delegated Credentials for Cloud Storage

| Provider                                                                                                                            | Description                                                                   |
| ----------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
| [**Amazon Web Services (S3)**](/guides/configure-external-delegated-credentials/configure-external-access-for-aws-s3.md)            | Configure delegated external access using IAM role assumption patterns.       |
| [**Google Cloud Platform (GCS)**](/guides/configure-external-delegated-credentials/configuring-external-access-for-gcss-buckets.md) | Configure delegated external access using service-account impersonation.      |
| [**Microsoft Azure (Blob)**](/guides/configure-external-delegated-credentials/configure-external-access-for-azure-blob.md)          | Configure delegated external access using Entra ID and RBAC role assignments. |

## Delegated Credentials for AI / LLM (Cloud-hosted providers)

| Provider                                                                                                              | Description                                                                              |
| --------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| [**AWS Bedrock**](/guides/configure-external-delegated-credentials/configure-delegated-access-for-aws-bedrock.md)     | Use IAM role assumption and short-lived credentials for Bedrock invocation flows.        |
| [**GCP Vertex AI**](/guides/configure-external-delegated-credentials/configure-delegated-access-for-gcp-vertex-ai.md) | Use service accounts and short-lived OAuth tokens (or workload identity) for Vertex AI.  |
| [**Azure OpenAI**](/guides/configure-external-delegated-credentials/configure-delegated-access-for-azure-openai.md)   | Use Entra ID/RBAC or provider keys, then configure endpoint + secret/token in Flashgate. |

## Security recommendations

* Grant only required actions (read-only, write-only, or specific inference scopes).
* Prefer short-lived tokens over static keys in production.
* Use separate identities for environments (dev, staging, prod).
* Monitor provider audit trails (CloudTrail, Cloud Audit Logs, Azure Activity/Diagnostic logs).
* Review and rotate trust relationships and role assignments regularly.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.flashback.tech/guides/configure-external-delegated-credentials.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.