Quickstart

Five minutes from sign-up to first finding

This guide walks you through connecting a cloud account in read-only mode and surfacing your first findings. No agents to install, no credit card.

1. Create a workspace

Sign in at zop.dev/signin. On first sign-in you’ll be asked for an organisation name; pick a short, lower-case identifier (e.g. acme). This becomes the URL prefix for your workspace.

2. Connect a cloud account

Settings → Cloud Accounts; each connected account with status, credential type, and an IAM import link.

Open the Connect cloud wizard from the workspace home. Pick the provider:

• AWS: paste the account ID. The recommended method is WIF-Assume Role (a keyless cross-account IAM role); the wizard generates the trust policy and a read-only policy document. See Cloud permissions for the exact policy JSON.
• GCP: pick organisation or project scope. The recommended method is One-Click Connect (sign in with Google; ZopNight provisions and manages a dedicated service account); you can also supply a Service Account Key.
• Azure: pick subscription scope. The recommended method is Service Principal (app registration plus client secret); Workload Identity Federation (OIDC, no secret) is also supported.

Apply the generated policy on your side, paste the resulting role ARN / SA email / SP ID back into the wizard, and click Verify. ZopNight pings the account read-only and confirms reachability. If Verify fails, the account shows as unreachable; recheck the role/external ID, the permission grant, and the region or scope, then retry, or contact support.

3. Wait for the first scan

The first scan starts within 60 seconds of a successful connect. Inventory typically completes in 2–4 minutes for accounts under 5,000 resources. Cost reconciliation begins once the first billing export is ingested; usually within a few hours of connect.

While you wait you can:

• Browse the All Resources page. 380+ resource types, three-level nesting, cascade filters.
• Open the Recommendations page; engine-by-engine breakdown with the metric, threshold, action, and projected dollar for each finding.
• Configure Teams so showback reports attribute spend correctly from day one.

4. Validate a finding

Recommendation drawer; every finding ships with the resource, the why, the 14-day evidence, and a one-click apply path.

Pick any high-confidence finding from the Recommendations page. Each one ships with:

• The rule that fired (e.g. “Idle EC2 Instance”).
• The resource identifier and current configuration.
• The observed metric and the threshold it crossed.
• The suggested action (stop, resize, schedule, delete).
• The projected monthly savings computed from your actual unit price.

Click Verify against bill to see the line item from your billing export that this projection is reconciled against; no rack-rate fiction.

5. Pick your operating mode

You’re now ready to choose how ZopNight runs for you:

• Monitor: read-only, finding-driven. Your team executes the actions through your existing workflow.
• Recommend: ZopNight prepares the action, your reviewer approves, ZopNight applies it inside a guarded change window.
• Autopilot: certified rules apply automatically inside policy boundaries. Audit trail captures every change.

You can mix modes per resource group, per environment, and per rule category.

Next steps

• Authentication: production-grade trust policies and rotation cadence.
• Scheduling: set up the first non-prod schedule.
• Scopes: how RBAC and resource visibility work across accounts and teams.