> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting AWS, GCP, Azure, and Kubernetes accounts

> Connect your AWS, GCP, Azure, or Kubernetes accounts to InfraAudit. Includes required permissions and credential details for each provider type.

Cloud accounts in InfraAudit are called **providers**. Each provider stores your encrypted credentials, a display name, and sync metadata. You can connect multiple providers at the same time — for example, three AWS accounts, one GCP project, and two Kubernetes clusters all running concurrently.

## Adding a provider

<Steps>
  <Step title="Open Cloud Providers">
    In the sidebar, click **Cloud Providers**.
  </Step>

  <Step title="Choose your cloud">
    Click **Connect provider** and select the provider type.
  </Step>

  <Step title="Fill in credentials">
    Complete the credential form. Details for each provider type are below.
  </Step>

  <Step title="Connect">
    Click **Connect**. InfraAudit validates the credentials and starts the initial resource sync. The provider card shows **Syncing** while this runs.
  </Step>
</Steps>

## AWS

You need an IAM user or role with read access. The minimum required policy:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets",
        "rds:Describe*",
        "lambda:ListFunctions",
        "lambda:GetFunctionConfiguration",
        "cloudfront:ListDistributions",
        "ce:GetCostAndUsage",
        "ce:GetCostForecast",
        "ce:GetDimensionValues"
      ],
      "Resource": "*"
    }
  ]
}
```

**Credential form fields:**

| Field             | Description                            |
| ----------------- | -------------------------------------- |
| Access Key ID     | From an IAM user or assumed role       |
| Secret Access Key | The corresponding secret               |
| Default region    | e.g. `us-east-1`                       |
| Display name      | A label for this account in InfraAudit |

<Note>
  Credentials are encrypted at rest using AES-GCM with the server's `ENCRYPTION_KEY`. InfraAudit never stores plaintext credentials.
</Note>

## GCP

You need a GCP service account with the following roles:

* `roles/viewer` — basic read access across the project
* `roles/bigquery.dataViewer` — needed for BigQuery billing export

<Steps>
  <Step title="Create a service account">
    In the GCP console, go to **IAM & Admin → Service Accounts**. Create a new service account and assign the two roles above.
  </Step>

  <Step title="Download the JSON key">
    On the service account, create a key in JSON format and download it.
  </Step>

  <Step title="Paste into InfraAudit">
    In the InfraAudit credential form, paste the full JSON key file contents into the **Service Account JSON** field.
  </Step>
</Steps>

**Credential form fields:**

| Field                | Description                                  |
| -------------------- | -------------------------------------------- |
| Service Account JSON | The full contents of the downloaded key file |
| Project ID           | Your GCP project ID                          |
| Display name         | A label for this project in InfraAudit       |

## Azure

You need a service principal with the Reader role on your subscription.

Create the service principal using the Azure CLI:

```bash theme={null}
az ad sp create-for-rbac \
  --name infraudit-reader \
  --role Reader \
  --scopes /subscriptions/<subscription-id>
```

The command output includes `clientId`, `clientSecret`, `tenantId`, and `subscriptionId`. Copy all four.

**Credential form fields:**

| Field           | Description                                  |
| --------------- | -------------------------------------------- |
| Client ID       | `clientId` from the service principal output |
| Client Secret   | `clientSecret`                               |
| Tenant ID       | `tenantId`                                   |
| Subscription ID | `subscriptionId`                             |
| Display name    | A label for this subscription in InfraAudit  |

## Kubernetes

Connect a Kubernetes cluster by uploading a kubeconfig file or pasting its contents directly.

**Minimum RBAC permissions:**

```yaml theme={null}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: infraudit-reader
rules:
  - apiGroups: ["", "apps", "batch"]
    resources:
      - deployments
      - pods
      - services
      - namespaces
      - replicasets
      - daemonsets
      - statefulsets
      - jobs
      - cronjobs
    verbs: ["get", "list", "watch"]
```

The service account or user in the kubeconfig should be read-only.

**Credential form fields:**

| Field                | Description                                  |
| -------------------- | -------------------------------------------- |
| Kubeconfig           | File upload or paste the kubeconfig contents |
| Cluster display name | A label for this cluster in InfraAudit       |

InfraAudit reads the active context in the kubeconfig and connects to that cluster.

## Sync status

After connecting, the provider card shows one of the following statuses:

| Status           | Meaning                                           |
| ---------------- | ------------------------------------------------- |
| **Syncing**      | Initial or recurring sync in progress             |
| **Synced**       | Last sync completed successfully                  |
| **Error**        | Last sync failed — hover to see the error message |
| **Disconnected** | Provider is paused; credentials have been removed |

Resources sync every 6 hours by default; billing data syncs daily. To trigger an immediate sync:

```bash theme={null}
infraudit provider sync <provider-id>
```

Or click **Sync now** on the provider card in the UI.

## Disconnecting a provider

Click the provider card, then **Disconnect**. This removes the stored credentials but keeps all historical scan data — resources, drifts, costs, and compliance results. Historical data is only deleted if you explicitly delete the provider record.

## Next steps

* [Resources and inventory](/platform/resources-and-inventory) — browse what InfraAudit discovered
* [Drift detection](/platform/drift-detection) — run your first scan
* [Kubernetes](/platform/kubernetes) — Kubernetes-specific features and scans