About Credentials
Credentials let AlloyScan authenticate to the devices and provider APIs it scans and audits. Where you add and store them depends on the segment's execution placement.
Local Audit Service credentials
Each Audit Service has its own credential pool. Segments using that service select credentials from its pool. The secrets remain in your local network.
Add and update these credentials from the Audit Service's Credentials tab. Stored secrets cannot be displayed; to rotate a password or key, edit the credential and enter the replacement value.
Cloud credentials
Segments using AlloyScan cloud worker use cloud credentials owned by the current Site. They support AWS, Azure, Google Cloud, Google Directory, and Jamf.
Cloud credentials are stored in AlloyScan. Secrets are encrypted before storage and decrypted when needed for scans and audits. Existing local Audit Service credentials are not transferred automatically when you select cloud execution.
Administrators can create, edit, disable, re-enable, and delete cloud credentials under Admin Center > Settings > Cloud credentials. The provider cannot be changed after creation. Deletion is blocked while a credential is referenced by segments, discovered devices, cloud work history, or audit data.
Update credentials after rotating a secret
When you change a password or key at the provider or target system, update the matching credential in AlloyScan or the Audit Service pool. Subsequent scans and audits use the updated secret.