OVHcloud

Connect OVHcloud to collect cloud infrastructure evidence with automated compliance tests, switched on per workspace.

Step-by-step guide: Connect OVHcloud.

Connect with an API token

1. In OVHcloud:

   1. Open the OVHcloud token creation page linked from OVHcloud's API first-steps guide.
   2. Sign in with your OVHcloud customer ID and Password.
   3. Enter an application name and, optionally, a description of the application and a validity period.
   4. In Rights, add one GET line for each path Safeguard needs: /me, /me/*, /cloud/project, /cloud/project/*, /ip and /ip/*. Add no POST, PUT or DELETE rights.
   5. Click Create keys and copy the three keys it issues: the application key (AK), the secret application key (AS) and the consumer key (CK).
   6. Optional S3 keys: in the Public Cloud project, click Object Storage in the left-hand menu and click Create User (or pick an existing OpenStack user). The credentials are shown once the user is created.
   7. Go to the Object Storage Policy Users tab, click ... at the end of the user's line and select Import JSON file to upload a policy that allows only s3:GetBucketAcl and s3:GetBucketPolicy.
   8. To see the secret key again, click ... at the end of the user's line and choose the option to see the user's secret key.

   Where to find the other values:

   • Region: The OVHcloud API region whose token creation page you used.
   • Access key (optional): Shown with the user's credentials when the Object Storage user is created in the Public Cloud project.

   OVHcloud's public documentation does not cover every step.

   The guide gives https://api.ovh.com/createToken/?GET=/me as an example and says to put an asterisk in the path to allow all APIs for a method; it was not confirmed here which createToken URL applies to the Canada and US APIs. The guide does not say whether the Application Secret and Consumer Key can be viewed again; store them when shown. The Object Storage secret key can be shown again from the user's ... menu.

   Source: docs.ovhcloud.com, docs.ovhcloud.com, checked 2026-10-07.

   The permissions Safeguard needs: GET /me, GET /me/*, GET /cloud/project, GET /cloud/project/*, GET /ip, GET /ip/*. Optional, broader than read-only: an S3 user with a read-only policy (s3:GetBucketAcl, s3:GetBucketPolicy). Without it, the checks that need it show an error naming it. Safeguard only reads with it.

2. On Compliance › Connectors, open OVHcloud, click Connect, choose API token and fill in:

   Field	What to enter
   Application key	Required. Stored encrypted and never shown again.
   Application secret	Required. Stored encrypted and never shown again.
   Consumer key	Required. Stored encrypted and never shown again.
   Region	Required. The API where the keys were created: eu (eu.api.ovh.com), ca (ca.api.ovh.com) or us (api.us.ovhcloud.com). Keys made at ovh.com outside Europe and Canada usually belong to ca.
   Access key (optional)	Stored encrypted and never shown again.
   Secret key (optional)	Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read OVHcloud and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Cloud Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks