# Cloud connections

> Connecting an AWS or Azure account, read-only, with credentials you control.

A cloud connection is a read-only link to one account. Create one from
**Organisation → Settings → Cloud connections**; it needs
`integration.manage`.

## Read-only access

> [!IMPORTANT]
> Continuum never writes to your cloud account. The permissions it asks for are
> descriptive: list and describe. If you are reviewing the role, anything that
> mutates infrastructure is out of scope and should be refused.

## AWS

Grant a role Blueprintr can assume, using the account id and external id the
connection page shows you. The external id stops another tenant assuming your
role. Do not omit it.

## Azure

Register an application and grant it a reader role over the subscriptions you
want visible.

## Scoping the grant

Grant the narrowest scope that covers what you want to draw: one subscription,
or one set of accounts. Widening the scope later is one edit. Narrowing it once
diagrams have been drawn from the wider scope changes those diagrams.

## Terraform

State can also be used as a source, for estates where reading state is easier
than granting access to the live account.