STACKIT

Configuring STACKIT integration

Tidal Control's STACKIT integration monitors the security configuration of your STACKIT cloud project for compliance purposes. All access is read-only — Tidal Control never creates, modifies, or deletes anything in your STACKIT project.

What this integration monitors:

• Service accounts: Identity inventory, including internal accounts
• Service account keys: Active state, creation date, validity, and key algorithm
• Members: Role assignments per project, for least-privilege reviews
• Projects: Name, lifecycle state, and creation time
• Kubernetes clusters: Kubernetes version, API server IP allowlist, allowed CIDRs, privileged container policy, and credential rotation state
• Servers: Status, key pair, attached service accounts, and security groups
• Security groups: Firewall rules, including direction, IP range, and port range
• Object storage buckets: Region and object lock (WORM) configuration
• KMS keys: State, algorithm, purpose, protection level, and scheduled deletion
• VPN gateways: State and routing type
• Secrets Manager: Instances, IP allowlist ACLs, and per-user read or write access

Requirements:

• Super User role in Tidal Control
• A STACKIT project with permission to create service accounts and service account keys
• The Reader role on the project for the service account, at minimum

Configuration step-by-step plan

What we're going to do: We'll create a STACKIT service account, give it read access to the project, generate a service account key, then add the connection in Tidal Control.

Configuration steps:

1. Create a service account and grant it read access
2. Create a service account key
3. Configure the integration in Tidal Control

Step 1: Create a service account and grant it read access

• Log in to the STACKIT Portal
• Select the project you want to monitor
• Go to Service Accounts
• Click to create a new service account, or select an existing one
• Assign the service account the Reader role on the project

Step 2: Create a service account key

• Open the service account from step 1
• Go to Keys and click Create Key
• Download the JSON key file — it is only offered once

The JSON file contains the key ID, the issuer email, the private key, and the token endpoint. Tidal Control needs the whole file, not just one field from it.

Step 3: Configure the integration in Tidal Control

• Go to Settings → Integrations in Tidal Control
• Click the plus icon next to STACKIT
• Fill in the configuration:
  • Name: A descriptive name, e.g. STACKIT
  • Service Account Key: Paste the entire contents of the JSON file from step 2
  • Project ID: The project ID from your project overview page
  • Region: The region your project's services run in, e.g. eu01
• Click "Create" to save the integration

Configuration fields explained

Name:

• A descriptive name for this connection
• For example: STACKIT, STACKIT Production

Service Account Key:

• The complete JSON key file downloaded in step 2, pasted as-is
• Tidal Control uses it to sign a token request — the private key never leaves the key vault
• Keep this value secure

Project ID:

• The identifier of the STACKIT project you want to monitor
• Found on the project overview page in the STACKIT Portal

Region:

• The region your project's services run in, for example eu01
• Required, because Kubernetes, compute, object storage, Secrets Manager, and KMS are all region-scoped

Available checks

Access control (ISO 27001 A.5.15, A.5.18, SOC 2 CC6.1 – CC6.3):

• Members holding the owner role, for privileged access review
• Service account inventory, including orphaned and internal accounts
• Secrets Manager users with write access

Credential hygiene (ISO 27001 A.8.3):

• Service account keys with no expiry date
• Inactive keys still present in the project
• Key algorithm strength and key age, for rotation checks

Network security (ISO 27001 A.8.20, NIS2):

• Security group rules that allow ingress from 0.0.0.0/0
• Kubernetes clusters whose API server has no IP allowlist
• Secrets Manager ACLs and the IP ranges they permit
• VPN gateway inventory

Configuration hardening:

• Kubernetes version currency
• Clusters allowing privileged containers
• Clusters whose credentials have never been rotated

Data protection (ISO 27001 A.8.10):

• Object storage buckets without object lock, so logs and backups have no WORM protection
• KMS key state, algorithm, and scheduled deletion

Verification

Check integration status:

• Settings → Integrations shows "Connected" status for STACKIT
• STACKIT tests are available in the Tests section
• Test refresh delivers results without authentication errors

Frequently asked questions

Does Tidal Control make changes in my STACKIT project? No. The integration is read-only and only reads configuration data.

Can one connection cover several projects? No. A service account key, project ID, and region scope one connection. Add one integration per project and region you want to monitor.

Which region should I enter? The region your project's services run in. For most STACKIT projects this is eu01. Check the region shown on your resources in the STACKIT Portal.

Can Tidal Control tell me whether a service account key is still in use? No. The STACKIT API does not expose a last-used timestamp for service account keys, so staleness cannot be detected automatically. The integration does report keys that never expire and keys that are inactive.

Common problems

Authentication fails after saving the integration

• Confirm you pasted the entire JSON key file, not just the private key
• Check that the key has not been deleted or deactivated in the STACKIT Portal
• Confirm the service account still has the Reader role on the project

Tests return no data for certain resource types

• Confirm those resources exist in the project and region this connection points at
• Region-scoped services such as Kubernetes, object storage, Secrets Manager, and KMS only return resources from the configured region

Only the project list returns data

• The service account is probably missing the Reader role on the project
• Grant Reader and refresh the tests

Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.