Skip to main content
Connect Temporal Cloud to Oleria to see who can act on your Temporal Cloud account and which namespaces they can reach: every user and service account, the API keys and mTLS client certificates that authenticate to Temporal Cloud, the user groups and account roles that grant access, the namespaces and Nexus endpoints that access reaches, and the audit log. Oleria connects with a Temporal Cloud API key.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Temporal Cloud account:
  • Accounts - every user in the account, with their account role and status, and who invited them if they were added in the last 30 days. For users who signed in during the last 30 days, Oleria shows the last sign-in and how they signed in: email and password (which Temporal Cloud always pairs with an authenticator app), Google, Microsoft, or SAML single sign-on. A user’s last activity also counts changes they made in the last 30 days, including through their own API key. A user with a pending invitation shows as not enabled until they accept it, along with the role and namespace access the invitation grants.
  • Non-human identities - service accounts (including namespace-scoped service accounts), API keys, and the client CA certificates that namespaces accept for mTLS. A user’s API key shows as a personal access token that acts as that user; a service account’s key shows as an API token. Each API key is paired with a credential that shows its status, expiry, and the user or service account it authenticates. Each client CA certificate is paired with a credential that shows its status, expiry, and the namespace it gives access to; no single identity holds a CA. Oleria never reads the key values.
  • Groups - user groups and their members, including groups synced from Google Workspace or a SCIM identity provider.
  • Roles - the six account roles (Account Owner, Global Admin, Developer, Finance Admin, Read-Only, and Metrics Read-Only), with each user’s, group’s, and service account’s role, and custom roles when your account has them.
  • Resources - namespaces and Nexus endpoints. Oleria shows each user’s, group’s, and service account’s direct namespace permission (Read, Write, or Namespace Admin), the access an mTLS client CA gives to its namespace, and the access account roles give to every namespace: Account Owners and Global Admins are Namespace Admins on all namespaces.
  • Activity - sign-ins and every change made in Temporal Cloud from the audit log, for the last 30 days, including which API key made each change and the user it acted for.
Oleria refreshes this data on its regular sync schedule.

​
Prerequisites

  • A Temporal Cloud user with the Account Owner or Global Admin role, to create the service account.
  • Admin access to the Oleria workspace.
Each Oleria integration covers one Temporal Cloud account. If you have several accounts, add one integration for each.

​
Create a service account and API key

We recommend a dedicated service account, so the connection doesn’t depend on a person’s account.
1

Create the service account

In Temporal Cloud, open the Identities page and select the Service Accounts tab, then Create Service Account. Name it, for example oleria.
2

Choose the role

Set Account Level Role to Global Admin. Leave Namespace Permissions empty: Global Admins already have access to every namespace. Select Create Service Account.
3

Create the API key

When Temporal Cloud offers to create an API key for the new service account, create one. Copy the key before you leave the page. Temporal Cloud shows it only once. Keys last at most two years, so note the expiry date and replace the key before then.
Oleria needs the Global Admin role (or an Account Owner’s key). With a lower role, Temporal Cloud returns users without their roles and permissions, only the key’s own API keys, and no audit log, so Oleria refuses the key when you connect. The same role covers remediation actions. Temporal Cloud has no separate write permission, and no read-only role returns the data Oleria needs, so the key can also make changes. Oleria makes changes only when an Oleria administrator runs a remediation action. See Remediations.

​
Connect Temporal Cloud to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Temporal Cloud.
2

Complete the connection form

3

Authenticate

Select Authenticate. Oleria checks that the key belongs to a Global Admin or Account Owner, reads your account ID, and saves the integration.

​
Verify the integration

Confirm Temporal Cloud appears on the Connected tab of your Oleria Integrations page. After the first sync completes, you can review the discovered users, service accounts, API keys, user groups, roles, and namespaces in your Oleria workspace.
If you replace the API key in Temporal Cloud, update it in Oleria by editing the integration. The account stays the same.

​
Remediation actions

Beyond discovery, Oleria can act on Temporal Cloud access to remediate risk. Oleria checks that the connection’s service account is a Global Admin or Account Owner before an action runs, and reports it if it isn’t. Oleria won’t act on the service account, user, or API key your connection runs as. It won’t change, grant, or remove the Account Owner role, and it assigns Finance Admin only when the connection is an Account Owner, as Temporal Cloud requires. Membership of groups synced from Google Workspace or SCIM is managed by your identity provider, so Oleria doesn’t change it. Revoking namespace access removes only a direct permission. If the user still has access through a user group or their account role, Oleria makes no change and says where the access comes from. A namespace-scoped service account’s own namespace, and the access an mTLS client CA gives, can’t be revoked from Oleria: delete or re-scope the service account, or change the namespace’s CA certificates, in Temporal Cloud.

​
Known limitations

  • Sign-in details and inviters cover 30 days. Temporal Cloud has no last-sign-in, sign-in-method, or created-by field. Oleria reads them from the audit log, which keeps 30 days, so users who haven’t signed in during that time show sign-in details as unavailable, and users and other objects created earlier show no creator.
  • Single sign-on and SCIM settings aren’t available. Temporal Cloud doesn’t expose its SAML or SCIM configuration through its API.
  • Last password change isn’t available. Temporal Cloud doesn’t record it in its API.
  • API key and certificate use by workers isn’t visible. The audit log records changes made to your account, not the use of keys and certificates by workers and clients, so last activity for service accounts and API keys reflects account changes only.
  • Users and service accounts can’t be suspended. Temporal Cloud has no suspend or disable for them. Oleria disables a service account’s API keys instead, and removing a user deletes them.
  • Custom roles and projects. Custom roles are a pre-release Temporal Cloud feature, and Temporal Cloud lists them only to an Account Owner. With a Global Admin key, Oleria shows each principal’s built-in account role but not their custom roles. Projects aren’t included.
  • Sessions can’t be revoked. Temporal Cloud has no API to end a user’s console sessions.

​
Contact us

For questions about this integration, contact us at support@oleria.com.