Cloud accounts

A cloud account is how ZopNight reaches your infrastructure; one per AWS account, GCP project, Azure subscription/tenant, or Databricks account. This page covers the auth methods per provider, the read-only vs read + write choice, and how to rotate credentials or switch auth methods later without losing anything.

Settings → Cloud accounts; each connected account with its permission level, credential type, and health, plus Add Cloud Account and per-account IAM import.

Supported providers & auth methods

For the mechanics of each (trust policies, encryption, rotation cadence), see Authentication. For the IAM permissions each needs, see Cloud permissions.

Read-only vs read + write

Every account carries a permission level that governs what ZopNight may do with it.

Level	ZopNight can	ZopNight cannot
Read-only	Discover resources, read metadata and billing, generate recommendations, and allow schedules to be attached	Start, stop, or remediate anything
Read + write	All of the above, plus manual start/stop, bulk start/stop, scheduled execution, and auto-remediation	None

Read-only is enforced server-side: the executor checks the account’s live permission level and returns a read-only error before any cloud call is made. The scheduler re-reads each account’s level whenever it reconnects to the config stream, so upgrading or downgrading takes effect on already-running schedules in real time, no restart needed.

Connecting an account

1. Open Add Cloud Account

   Settings → Cloud accounts → Add Cloud Account. Pick the provider and auth method.

2. Grant access on your side

   Follow the in-wizard setup guide (trust policy, service account, or app registration). For GCP One-Click, a guided 3-step Google consent flow provisions the managed service account for you.

3. Verify

   ZopNight verifies the credential live against the provider before persisting anything; a successful connect is itself the proof. The cloud_account_id is read from the provider’s response, not from your input.

Rotate credentials or switch auth method

You can rotate an account’s credentials, or switch its auth method entirely, without deleting and recreating the account. All resources, groups, recommendations, cost history, and schedules are preserved.

Provider	Supported transitions
AWS	Any-to-any across Static Keys, Temporary Credentials, and Assume Role (WIF)
Azure	Service Principal ↔ Workload Identity Federation; on a tenant parent the change cascades to every child subscription
GCP	One-Click Connect ↔ Service Account Key; rotate the key or re-provision the managed service account via the inline rotation form
Databricks	Rotate the OAuth M2M credential via the inline rotation form

This applies to rotations too, not just method switches: a same-method credential update runs the same live same-account check before storing, so a wrong or foreign credential can’t overwrite the vault and break discovery.

In the UI, the Edit Cloud Account drawer (AWS + Azure) has an Update credentials button that opens a 3-step wizard (Auth Method → Setup Guide → Enter Credentials), the same steps as the Connect wizard. Step 1 preselects your current method (marked Current): keep it to rotate, pick another to switch. GCP and Databricks use an inline rotation form.

Managing an account

Action	What it does
Update	Change display name, permission level, ZopDay access level (whether ZopDay may use this account for provisioning and deploys), credentials (verified rotation), or auth method (verified in-place change)
Permission upgrade (GCP One-Click)	Re-binds the managed service account’s roles using the stored OAuth token, no need to re-mint the SA key
Cluster registration (AWS)	Register an EKS cluster for kubeconfig access, for ZopDay. AWS Assume-Role / WIF accounts only. See Cluster registration
Delete	Soft-deletes the account (marks it inactive), cascades to Azure tenant children, and cleans up anything imported via IAM Import