Cloud connections

A cloud connection is the read-only credential Continuum Cloud uses to discover your estate. Create one from Settings → Continuum Cloud on an organisation or a team.

You need cloud_connections.manage on that organisation or team, and a Teams plan or above. Below Teams the action refuses with "Continuum is a Teams-plan feature." Without any integrations permission the page returns a 404 rather than telling you the organisation exists.

Teams allows three connections per owner. Reaching the cap refuses with "Connection cap reached (3 per org)", or "(3 per team)", naming whichever owns it. Blueprintr first reclaims your own drafts that have sat untouched for a day with no credential of any kind and nothing referencing them. Drafts created by someone else, and your own from the last 24 hours, are left alone, so the cap can still refuse. Enterprise has no cap.

Read-only, always

AWS

The first step asks for your own 12-digit AWS account number, not for anything to copy back. Blueprintr then offers a prepared CloudFormation template through Launch in AWS, creates a read-only role, and watches for it to appear. If the CloudFormation form asks for an External ID, paste the one shown beside the launch button; the current template fills it in already. The external ID is what stops another tenant assuming your role.

If the watch times out, a collapsed panel lets you paste the role ARN yourself.

Choose the scope of the grant first

Connection scope offers two modes. It stays changeable while the connection is a draft, by going Back in the wizard. Once a role has been recorded it is fixed: "This connection already has a role, so its scope can't be changed. Create a new connection instead."

Mode	What it creates	Use it for
Single account	One read-only role in one account	One account you want to draw
AWS Organization	A role to enumerate accounts, plus a StackSet that places a member role in every account, including accounts created later	Control Tower, Landing Zone and other multi-account estates

Organization mode is run from the management or delegated-admin account and needs trusted access between AWS Organizations and CloudFormation StackSets, which is enabled once per organisation. A single-account role cannot serve an organisation-mode connection, and the mismatch fails at inventory time rather than at creation.

Azure

Register an Entra application, create a client secret on it, and grant it the built-in Reader role on the subscriptions you want visible. Paste back the Directory (tenant) ID, the Application (client) ID and the Client secret value, which is the value rather than the secret id, and which Azure shows once. Where policy forbids built-in Reader, the wizard offers a narrower custom role definition to create instead.

An Azure connection authenticates with a client secret. Workload identity federation is not available, so the wizard has no Federation option.

You create the secret in Azure. The copy-and-run script the wizard offers creates it with a two-year life; the portal click-path leaves Azure's own default, so check it. Blueprintr encrypts it at rest and never returns it to the browser. Replace it later from the connection's detail page rather than by rebuilding the connection.

One Azure connection covers a set of subscriptions. A connection whose app registration has no Reader grant fails verification outright: "The connection authenticated but no subscriptions are visible to it. Assign the Reader role at subscription scope." Grant Reader, then verify again.

Google Cloud

Continuum Cloud does not discover Google Cloud, and the wizard offers AWS and Azure only. Google Cloud Monitoring is available as a Continuum Link connector, which attaches alerting policies to shapes you draw yourself.

Terraform state

Terraform is not an alternative to granting access. Add a cloud connection first, then set a backend on that connection's detail page under Terraform backend. Continuum reconciles what you declared against what discovery found, and outlines a resource whose live configuration has diverged from state in amber.

For S3 remote state, give the bucket, object key and bucket region, and add s3:GetObject on the state object to the Continuum role policy. The template role cannot read bucket contents on its own.

For Terraform Cloud, give the workspace id and a workspace-scoped token with state:read. Saving without one is refused: "A workspace token is required when switching to Terraform Cloud."

A Terraform-source connection cannot back a single bound shape, because a state snapshot has no live resource to re-read.

Verifying

Verify re-proves the credential: an assume-role and identity check for AWS, a token plus subscription and resource-group read for Azure, and a fetch and parse for Terraform state. Discovery only runs on a connection that has verified, so verify after any credential change.

Regions and deletion

Regions are fixed when you create the connection: one region in single-account mode, a set of regions in AWS Organization mode. There is no region control on the connection afterwards, so covering a new region means a new connection.

Which of those regions a particular diagram uses is a separate choice, made per diagram under scopes.

Deleting a connection is refused while an integration or scope still references it: "Connection is in use by N integration(s) and M scope(s). Remove those first." A shape bound to the connection, or a Continuum Link connector borrowing its role, also blocks the delete, so unbind those too.