Skip to the page
CloudArq
Sign inStart free
Sign inStart free

Sign in

To your CloudArq console. Your authenticator app comes after your password.

Forgot your password?

New to CloudArq? Create an account

ExampleWhat CloudArq draws for one role
  • octo-org/deployYour repository, main branchAdmitted by grant 1. Every claim grant 1 names is satisfied: aud and sub.
  • octo-org/deployYour repository, a pull requestAdmitted by grant 1. Every claim grant 1 names is satisfied: aud and sub.
  • octo-org-anything/deployAn organisation anyone can registerAdmitted by grant 1. Every claim grant 1 names is satisfied: aud and sub.
  • octocat/Hello-WorldAnyone else on GitHubNot admitted: one claim short of grant 1. Rejected on sub: the token carries repo:octocat/Hello-World:ref:refs/heads/main; grant 1 admits only a subject matching repo:octo-org*; after repo:octo the pattern requires -org and the token has cat/ there. aud satisfies grant 1, and iss is grant 1's issuer.
release-publisherAnyone on GitHub
Anyone on GitHub can assume this role.
The engine's answer for this role's trust policy. Paste your own in the explorer and it is drawn the same way.