# Cloud Workload Identity and Delegated Entities

> **📝 Note**: This is a Preview feature.Cloud Workload Identity and delegated entities are currently only available for workspaces deployed on AWS. This feature is not supported on Shared Edition.

**Cloud Workload Identity** represents a set of additional components (or resources) that are provisioned for each workspace. It consists of Kubernetes and AWS resources and configurations and enables workspace workloads to use IAM Roles for Service Accounts (IRSA) to access cloud resources without long‑lived static credentials. This identity is provisioned for each workspace and is represented by an IAM role ARN. Workloads can use this identity to authenticate to cloud provider services without storing or rotating static credentials.

> **📝 Note**: Cloud workload identity is unique to a workspace group. A workspace inherits the identity configuration from the workspace group that contains it.

**Delegated entities** are customer-owned AWS IAM roles that a workspace's cloud workload entity is allowed to assume. This enables pipelines and other workloads to access resources such as Amazon S3 using short‑lived credentials instead of AWS access keys.

## Permissions Required

You must have the following permissions to perform the respective task:

| Task                             | Permission Required         |
| -------------------------------- | --------------------------- |
| Add or delete delegated entities | `Manage Delegated Entities` |
| View delegated entities          | `View`                      |

Refer to [Predefined Roles for Workspace Groups in an Organization](https://docs.singlestore.com/cloud/security/administration/role-based-access-control-rbac-for-singlestore-helios/predefined-roles-for-workspace-groups-in-an-organization.md) for roles that include the `Manage Delegated Entities` permission by default. Optionally, you can also assign these permissions to custom roles.

## Configure Delegated Entities

To access cloud resources using cloud workload identity, perform the following tasks:

1. [Get the cloud workload identity ARN for the SingleStore workspace.](https://docs.singlestore.com/#section-id23539041172686.md)

2. [Configure an IAM role in your AWS account.](https://docs.singlestore.com/#section-id235390421452862.md)

3. [Add delegated entities.](https://docs.singlestore.com/#section-id235390423151351.md)

> **📝 Note**: You can configure a maximum of 20 delegated entities for each workspace group.

You can get the cloud workload identity and configure delegated entities using either the [Cloud Portal](https://portal.singlestore.com) or the `Management` API. Once the delegated entities are configured, access cloud resources using the ARN of your IAM role. For example, use cloud workload identity instead of static credentials to load data via S3 pipelines. Refer to [Load Data from Amazon Web Services (AWS) S3](https://docs.singlestore.com/cloud/load-data/data-sources/load-data-from-amazon-web-services-aws-s-3/#section-id235391782907589.md) for an example.

## Get the Cloud Workload Identity ARN for the SingleStore Workspace

The cloud workload identity value is the IAM role ARN of your workspace, for example: `arn:aws:iam::0000000000:role/xxxxxxxxxxxxxx`.

## Using the Cloud Portal

1. Log in to the [Cloud Portal](https://portal.singlestore.com).

2. Select **\<your\_deployment> > Security**.

3. Copy the cloud workload identity ARN of the SingleStore workspace specified under **Delegated Entities > Configure trust relationship**.

## Using the Management API

Use the `Identity` path (`/v1/workspaces/{workspaceID}/identity` endpoint) in the `Management` API to obtain the cloud workload identity ARN of the SingleStore workspace. For example:

```shell
curl -X 'GET' \
  'https://api.singlestore.com/v1/workspaces/xxxx/identity/' \
  -H 'accept: application/json'
```

Refer to [Management API](https://docs.singlestore.com/cloud/reference/management-api.md) and [Management API Reference](https://docs.singlestore.com/cloud/reference/management-api/reference.md) for related information.

## Configure an IAM Role in your AWS Account

To use delegated entities, configure an IAM role in your AWS account that the workspace's cloud workload identity can assume. Perform the following tasks:

1. **Create an IAM role** in your AWS account with the necessary privileges. You can also use an existing IAM role.

2. **Update the IAM role's trust policy** to allow the workspace's cloud workload identity to assume the role. Specify the cloud workload identity ARN of the workspace copied earlier. For example:
   ```json
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": "<workspace_cloud_workload_identity_arn>"
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }
   ```

## Add Delegated Entities

Add delegated entities to your workspace. Once the delegated entities are created, you can access cloud resources without using persistent static credentials. Ensure that you have the [permissions required](https://docs.singlestore.com/#section-id23567013433006.md) to configure and view delegated entities.

## Using the Cloud Portal

1. Log in to the [Cloud Portal](https://portal.singlestore.com).

2. Select **\<your\_deployment> > Security**.

3. Under the **Delegated Entities** section, select **Add Entity**.

4. Add the ARN of your IAM role to the delegated entities list. Alternatively, enter a role ARN pattern to match multiple roles that share a common naming pattern, such as `arn:aws:iam::987654321098:role/singlestore-*`. Patterns provide a flexible mechanism to configure delegated entities.

5. Save the configuration.

## Using the Management API

Use the `Delegated Entities` path (`/v1/workspaces/{workspaceID}/delegatedEntities` endpoint) in the `Management` API to add one or more delegated entities (ARN of your IAM role) to the workspace.

> **📝 Note**: Adding delegated entities at the workspace level also updates the delegated entities for the workspace group that contains it.

You can also view and delete the delegated entities for a workspace. Refer to [Management API Reference](https://docs.singlestore.com/cloud/reference/management-api/reference.md) for more information.

***

Modified at: July 8, 2026

Source: [/cloud/user-and-workspace-administration/cloud-workload-identity-and-delegated-entities/](https://docs.singlestore.com/cloud/user-and-workspace-administration/cloud-workload-identity-and-delegated-entities/)

(An index of the documentation is available at /llms.txt)