> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/sdgm/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/sdgm/_mcp/server. # Create and Manage Identities > Create and manage reusable external identities for data connectors An identity is an administrator-managed set of authentication settings that Kumo reuses to access an external data source. Admins assign identities to Groups so users can create connectors in the Projects that belong to those Groups. You need the **Admin** role to create or change identities. Before you create an identity, choose the provider that stores your data and review its requirements below. You also need at least one Group to assign to the identity. To create a Group, see [Add users to Groups](/admin-setup-guide#2-add-users-to-groups). To create an identity: 1. Open **Admin**, select **Identity settings**, then select **Add Identity**. 2. Enter an **Identity name** and, optionally, a slug and description. 3. Select the provider and complete the authentication fields for that provider. 4. Assign one or more **Kumo groups**, which determines which Projects can use the identity. 5. Select **Add**. ![Add Identity page with the Databricks provider selected, its provider fields completed, and one Kumo group assigned](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/nvidia-sdgm.docs.buildwithfern.com/71bbd7ebc3ee70b95aa705207111167d18724b94f9b19806675398a08c6c6829/img/kumo3/admin-add-identity.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260920%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260920T154556Z&X-Amz-Expires=604800&X-Amz-Signature=506c77483b4278a651d3062ab1c6d069314657c118346a7ecbf1e0856c2d86b2&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject) After creation, you can update an identity's name, description, and Group assignments. You cannot change an identity's provider or the principal it authenticates as, so create a new identity if you need different settings. For identities that store credentials, you can rotate the stored credential without changing that principal. The rotation updates every connector that uses the identity. Choose an identity type based on where your data is stored and how Kumo should authenticate. The provider sections list the required fields and the access that the selected identity needs. | Identity type | What it supports | | ------------------------------------------------------------ | ------------------------------------------------------------------------------------- | | [Amazon S3](#amazon-s3-identity) | Configures AWS role-based access to S3 data and, where needed, KMS-protected objects. | | [BigQuery](#bigquery-identity) | Configures Google Cloud authentication for BigQuery data access. | | [Snowflake](#snowflake-identity) | Configures service-account authentication for Snowflake. | | [Databricks](#databricks-identity) | Configures OAuth service-principal authentication for Databricks. | | [Azure Data Lake Storage](#azure-data-lake-storage-identity) | Configures Azure identity details for ADLS Gen2 access. | | [Google Cloud Storage](#google-cloud-storage-identity) | Configures Google Cloud authentication for GCS data access. | #### ![](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/nvidia-sdgm.docs.buildwithfern.com/756b9654b116def6452ec58a82a91b3110c9ac9190eab93897fd061989aabe8c/img/kumo3/connector-logos/amazon-s3.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260920%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260920T154556Z&X-Amz-Expires=604800&X-Amz-Signature=7537c10ac77edf1184f931cb8552886a187fd1ad70b3f3f1594ab5367120f8ce&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)Amazon S3 identity Create an **Amazon S3** identity with the shared fields above and these required fields. This identity configures Kumo to use AWS assume-role authentication. | Field | Requirement | | -------------------------- | ----------------------------------------------------------------------------------- | | **AWS partition** | Required. Defaults to `aws`. | | **Role ARN** | Required. This IAM role is the principal that needs S3 and any required KMS access. | | **External ID (optional)** | Supply when your assume-role policy requires one. | Before creating the identity: 1. Grant the role named in **Role ARN** read access to the relevant bucket and, when Kumo writes outputs, `s3:PutObject` and `s3:ListBucket` as appropriate. 2. Do not use the retired fixed `kumo-{% $customerId %}-external-shared-iam-role` principal from earlier documentation. Use this bucket-policy pattern, replacing `` and ``: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "" }, "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"], "Resource": [ "arn:aws:s3:::/*", "arn:aws:s3:::" ] } ] } ``` For step-by-step help, see AWS's [Add Bucket Policy guide](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html). For a KMS key in another AWS account: 1. Grant the same **Role ARN** `kms:Decrypt` and `kms:GenerateDataKey` on the key. 2. Keep the account-root permissions in the existing KMS key policy. ```json { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowExternalRoleToUseKey", "Effect": "Allow", "Principal": { "AWS": "" }, "Action": ["kms:Decrypt", "kms:GenerateDataKey"], "Resource": "*" } ] } ``` #### ![](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/nvidia-sdgm.docs.buildwithfern.com/36b1fa63c2ce2c31184fa45f31b7301965d46f8526048c630c05284ac869cc15/img/kumo3/connector-logos/bigquery.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260920%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260920T154556Z&X-Amz-Expires=604800&X-Amz-Signature=a9ff96fa39c8f29f850cc94c524825ae481abadaba025a1ffeff225a75fa5690&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)BigQuery identity Create a **BigQuery** identity with the shared fields above, then choose **Authentication**. The selected authentication option determines which Google Cloud principal needs access to BigQuery: | Authentication choice | Required details | | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------- | | **Use Kumo's GCP identity - Recommended** | Grant the deployed Kumo service account access to the target data. No customer credential is stored. | | **Workload identity (impersonation)** | **Target service-account email**. This option is available only when enabled for the deployment. | | **Service account JSON key** | Upload a **Service-account JSON file**. Kumo derives the service account and project information from the file. | Grant the selected principal the following roles: * `roles/bigquery.dataViewer` * `roles/bigquery.filteredDataViewer` * `roles/bigquery.metadataViewer` * `roles/bigquery.readSessionUser` * `roles/bigquery.user` * `roles/bigquery.dataEditor` when Kumo must export results back to BigQuery For a JSON-key identity, see Google's instructions to [create a service account](https://cloud.google.com/iam/docs/creating-managing-service-accounts#iam-service-accounts-create-console) and [create a service account key](https://cloud.google.com/iam/docs/keys-create-delete#creating). #### ![](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/nvidia-sdgm.docs.buildwithfern.com/bbafeb81e603a4af89d2adafe6b5d6eb61a9ad259a63752ee62df453b137332f/img/kumo3/connector-logos/snowflake.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260920%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260920T154556Z&X-Amz-Expires=604800&X-Amz-Signature=36e5831c4b878f548dab7feb0d58979c666d1b58f445ff490f778915ed7990ea&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)Snowflake identity Create a **Snowflake** identity with the shared fields above and provide the following: | Field | Requirement | | ---------------------------- | ----------- | | **Account** | Required. | | **Service-account username** | Required. | For **Authentication**, choose one of the following: | Authentication choice | Required details | | --------------------- | --------------------------------------------- | | **Password** | **Password** | | **Key pair** | **Private key** and **Passphrase (optional)** | For account-identifier format, see Snowflake's [account identifier guide](https://docs.snowflake.com/en/user-guide/admin-account-identifier#finding-the-organization-and-account-name-for-an-account). For key-pair authentication: 1. [Generate a private/public key pair](https://docs.snowflake.com/en/user-guide/key-pair-auth). 2. Assign the public key to the Snowflake user. 3. Preserve line breaks in the private key. For example: `ALTER USER example_user SET RSA_PUBLIC_KEY='MIIBIjANBgkqh...';`. The user owner or a user with `SECURITYADMIN` or higher must make this change. Alternatively, create a service user with its `RSA_PUBLIC_KEY` field set, as described in Snowflake's [CREATE USER reference](https://docs.snowflake.com/en/sql-reference/sql/create-user). #### ![](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/nvidia-sdgm.docs.buildwithfern.com/ab5837b999a5e77cbf404556ffbf717a16dc57c5917bf6e694cded94796d7e12/img/kumo3/connector-logos/databricks.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260920%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260920T154556Z&X-Amz-Expires=604800&X-Amz-Signature=efee17b02c145598cffaade0f82b5dc73f3b4d050e579b1bfe8966447c1c45f9&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)Databricks identity Create a **Databricks** identity with the shared identity fields above and provide the following for the Databricks service principal: | Field | Requirement | | ----------------------- | ----------- | | **Workspace host** | Required. | | **OAuth client ID** | Required. | | **OAuth client secret** | Required. | The current UI does not support personal access tokens for this workflow. #### ![](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/nvidia-sdgm.docs.buildwithfern.com/695137f4384f55c88e017a73bd21b3fe1667282b42fcc449b8e23c813b5977df/img/kumo3/connector-logos/azure-data-lake-storage.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260920%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260920T154556Z&X-Amz-Expires=604800&X-Amz-Signature=b840d00b84f92e6787d608a9ab9b79108ee1a5db5a3959e758a6997fee3c4352&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)Azure Data Lake Storage identity Create an **Azure Data Lake Storage** identity with the shared identity fields above and provide the following: | Field | Requirement | | --------------- | ----------- | | **Tenant ID** | Required. | | **Client ID** | Required. | | **Azure cloud** | Required. | The current form does not collect a client secret. Grant the identity's service principal the following access: * At least **Storage Blob Data Reader** on the container or storage account. * **Storage Blob Data Contributor** if Kumo must write prediction outputs. * For AKS deployments, workload identity can exchange the projected service-account token for an Azure credential, so no client secret is stored. To assign an Azure role: 1. Open the storage account or container in the Azure portal. 2. Open **Access Control (IAM)**. 3. Select **Add role assignment**. 4. Select **Storage Blob Data Reader** or **Storage Blob Data Contributor**. 5. Assign the role to the service principal. ##### AKS / Helm deployments with workload identity For AKS deployments: 1. Configure the Kumo service principal to federate with the AKS pod identity. 2. Use the workload-identity settings below: ```yaml workloads: rest: extraEnv: KUMO_AZURE_WORKLOAD_EXCHANGE_ENABLED: "true" serviceAccounts: control: podLabels: azure.workload.identity/use: "true" worker: podLabels: azure.workload.identity/use: "true" controller: podLabels: azure.workload.identity/use: "true" ``` The AKS workload identity mutating webhook injects `AZURE_FEDERATED_TOKEN_FILE` into labeled pods. Kumo exchanges that projected service-account token for a short-lived Azure credential at runtime. Set an ADLS URI for the dataplane storage bucket: ```yaml kumoConfig: storage: dataBucket: abfss://@.dfs.core.windows.net/disk-graph region: "" ``` #### ![](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/nvidia-sdgm.docs.buildwithfern.com/1fee976ebb805b68cdfb03a9aede045dfb70b95f3532f9468e02f204652afa03/img/kumo3/connector-logos/google-cloud-storage.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260920%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260920T154556Z&X-Amz-Expires=604800&X-Amz-Signature=06e3efcf3bb62fd7379f6ff614e393a34cc15792d9648ee0b0d4853ccef0097a&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)Google Cloud Storage identity Create a **Google Cloud Storage** identity with the shared identity fields above, then choose **Authentication**: | Authentication choice | Required details | | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Use Kumo's GCP identity - Recommended** | Kumo authenticates with its own Google Cloud service account. Grant that service account read access to your bucket with a single IAM binding. Nothing is uploaded and nothing is impersonated. | | **Workload identity (impersonation)** | **Target service-account email**. Kumo impersonates that account. This option is available only when the deployment enables GCP workload exchange. | | **Service account JSON key** | Upload a **Service-account JSON file**. Kumo encrypts and stores this long-lived private key. | Grant the selected principal the following roles: | Purpose | Minimum predefined role | Scope | | ------------------------------------- | ----------------------------------------- | --------------------------------- | | Read and list source data | `roles/storage.objectViewer` | Source bucket | | Write rooted output or dataplane data | `roles/storage.objectAdmin` | Output or dataplane bucket | | Impersonation and keyless URL signing | `roles/iam.serviceAccountTokenCreator` | Target or signing service account | | Requester-pays billing | `roles/serviceusage.serviceUsageConsumer` | Billing project | Narrower custom roles may grant equivalent permissions. Bucket creation, IAM mutation, and account-wide listing are not runtime requirements. For the recommended mode, apply one IAM binding to your bucket, then create the identity: ```bash gcloud storage buckets add-iam-policy-binding gs://YOUR_BUCKET \ --member=serviceAccount:KUMO_SERVICE_ACCOUNT \ --role=roles/storage.objectViewer ``` For a requester-pays bucket, set the connector's **Requester-pays project (optional)** and grant `serviceusage.services.use` on that project. This routes billing only, so the selected principal still needs read access to the bucket itself. For a JSON-key identity, see Google's instructions to [create a service account](https://cloud.google.com/iam/docs/creating-managing-service-accounts#iam-service-accounts-create-console) and [create a service account key](https://cloud.google.com/iam/docs/keys-create-delete#creating). ## Next steps Once you have a Group and a Project, [connect a data source](/data-connectors) so the Project has data to model.