Clouds
Integrations → Clouds is where you connect AWS, GCP, and Azure accounts by pasting read-only credentials. Nothing else on the platform can see your infrastructure until an account is connected here. It is the one prerequisite for infrastructure discovery and the health and cost signals built on top of it.
Cloud providers are the odd ones out: unlike every other integration, they do not use an OAuth popup. You paste credentials into a form (an access key, a service-account JSON, a service-principal secret), the platform validates them against the provider's own API, and stores them in the same encrypted vault as everything else. The page's own description puts it plainly: "We only ever read."
In this section
- Connecting a cloud account: the per-provider credential form for AWS, GCP, and Azure, the setup guide and copyable commands, and what the validation result tells you.
- Managing cloud accounts: multiple accounts per provider, reconnecting after a credential error, disconnecting, and assigning an account to a project.
The workflow, in order
- Connect a provider account here, on Clouds. See Connecting a cloud account.
- Assign the account to a project, if you have more than one account for the same provider. See Managing cloud accounts.
- Run infrastructure discovery on the project's Discovery → Infrastructure tab: "Discover infra" censuses the account for resources, and "Investigate" cross-references them against your mapped code to produce a written Infra Map.
- Anywhere a connection breaks (an expired key, a revoked service account), a red error banner appears directly on the account's card here, with a reconnect action next to it.
Where to find it
- Left sidebar → Integrations → Clouds, or go straight to
/integrations/clouds. - Also reachable from Settings → Workspace → Connections, whose "Cloud connections" card ("Cloud provider accounts available to this workspace") links straight here (see Connections).
Permissions
Cloud connections are workspace-scoped: a connection belongs to exactly one workspace, so the page is gated on a selected workspace.
| Grant | Controls |
|---|---|
org:integrations:read | Seeing the Clouds page and the status of connected accounts |
org:integrations:manage | Connecting, reconnecting, or disconnecting an account; assigning an account to a project |
Without org:integrations:manage, the page shows a banner: "This workspace grants integration visibility only. Connection, credential, and project-assignment controls are read-only." org:integrations:manage requires org:integrations:read as a dependency; you cannot be granted one without the other.