Cloud provider integration support for Kong Gateway Enterprise

Kong Gateway Enterprise integrates with major cloud providers to support cloud-native IAM authentication in place of static credentials. This allows you to use AWS IAM, Azure Microsoft Entra ID, or GCP IAM to authenticate Kong Gateway with cloud-hosted backing services such as databases, caches, secret stores, object storage, and serverless functions.

The following shows which Kong Gateway features support cloud provider IAM authentication.

• PostgreSQL database (AWS, Azure, GCP)
• Redis (see plugin docs)
• Vault (AWS, GCP, and Azure)
• Data plane resilience

• AI plugins

  Note: AI plugins support more AI models and service providers beyond AWS, Azure, and GCP. See the Kong AI Gateway overview for a full list of supported providers.

Each cloud provider offers different IAM authentication mechanisms. The following table lists which authentication methods Kong Gateway supports for each cloud provider.

Unless otherwise noted, each supported authentication method can be used with any Kong Gateway feature that integrates with that cloud provider, as listed in the feature support matrix.

Important: Identity Federation isn’t supported as an authentication method for any cloud provider.

Kong Gateway Enterprise integrates with HashiCorp Vault as a secrets backend for storing and managing sensitive data such as certificates, API keys, and other credentials. To securely connect to a HashiCorp Vault instance, Kong Gateway Enterprise supports multiple authentication methods across generic, infrastructure, and cloud categories.

You can use both internal and external authentication methods depending on your environment. Internal authentication methods handle authentication entirely within HashiCorp Vault using credentials specific to Vault itself, such as a Vault token or an AppRole. External authentication relies on an identity managed by an external provider or infrastructure platform, such as Kubernetes, AWS IAM, or Azure Microsoft Entra ID. Authentication via a cloud provider uses JWT authentication. For details on which specific cloud IAM authentication mechanisms are supported, see the cloud provider support matrix.

Supported authentication methods

The following table describes which authentication methods are supported for HashiCorp Vault: