OpenStack

Connect OpenStack to collect cloud infrastructure evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In OpenStack:

   1. Authenticate the OpenStack command-line client as the user who will own the credential, scoped to the project Safeguard should read.
   2. Run openstack application credential create safeguard --role reader (the --role option limits the credential to the named role; repeat it for more roles; you can only delegate roles you hold on the project).
   3. Optionally add --expiration YYYY-mm-ddTHH:MM:SS. Leave out --unrestricted, so the credential cannot create other application credentials or trusts.
   4. Copy the id and secret from the output. The secret is hashed before it is stored and cannot be retrieved later; if it is lost, create a new application credential.

   Where to find the other values:

   • Application credential ID: The id returned by openstack application credential create.
   • Application credential secret: The secret returned by openstack application credential create (shown once).

   OpenStack shows the secret only once, so copy it before you leave the page.

   OpenStack's public documentation does not cover every step.

   Upstream OpenStack documents application credentials through the CLI and the Identity API; the official docs found no Horizon (dashboard) click path, so none is given. The API URL is the Keystone (Identity) endpoint of your cloud; Horizon's API Access panel can download an OpenStack RC file that contains it, but the exact panel location varies by Horizon version and provider. Region is the region name your provider uses. Public OpenStack clouds may add their own UI; check the provider's docs.

   Source: docs.openstack.org, docs.openstack.org, docs.openstack.org, checked 2026-10-07.

   The permissions Safeguard needs: reader.

2. On Compliance › Connectors, open OpenStack, click Connect, choose API token and fill in:

   Field	What to enter
   API URL	Required. Your own server: an https address reachable from the internet.
   Application credential ID	Required.
   Application credential secret	Required. Stored encrypted and never shown again.
   Region (optional)	—

3. Click Connect with token.

Frameworks

Safeguard's automated tests read OpenStack and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Cloud Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks