Disconnecting storage / off-boarding¶

When you disconnect a cloud storage account from Cytario — or when your organization stops using Cytario altogether — removing the Cytario-connected infrastructure from your own cloud account is your responsibility. Delete:

• the CloudFormation stack Cytario handed you when you connected the account (this removes the cross-account Cytario Admin Role and the OIDC identity provider), and
• the bucket-policy statements Cytario applied to your buckets when you created connections or shared folders.

Why this matters¶

Cytario identifies your organization by its alias. That alias is the value Cytario writes into the access condition on every layer of the storage grant: the cross-account role's trust policy, the temporary-session policy, and the bucket policy on your buckets. If your organization is later deleted and the same alias is re-issued to a different organization, any of that infrastructure you left behind in your cloud account would then trust and grant the new organization — across all three layers at once, because they all key on the same alias. This is the same consideration as GitHub Actions OIDC (below): the layers do not protect you independently here, since they share the one reused name.

Because this cleanup happens inside your own cloud account, Cytario cannot do it for you; Cytario will not re-issue an alias while such infrastructure may still exist. Deleting the CloudFormation stack and the managed bucket-policy statements when you stop using them closes that window.

This is the same consideration as GitHub Actions OIDC: a trust policy that names a repository keeps trusting that name even after the repository is deleted, so whoever re-creates the repository name could assume the role. Remove the trust relationship when it is no longer needed.