# Quickstart

> Connect your first cloud account in five minutes and surface real, bill-reconciled cost findings on day one.

Source: https://zop.dev/docs/zopnight/quickstart

---

## Five minutes from sign-up to first finding

This guide walks you through connecting a cloud account in read-only mode and surfacing your first findings. **No agents to install, no credit card.**

### 1. Create a workspace

Sign in at [zop.dev/signin](https://zop.dev/signin). On first sign-in you'll be asked for an organisation name; pick a short, lower-case identifier (e.g. `acme`). This becomes the URL prefix for your workspace.

### 2. Connect a cloud account

![Settings → Cloud Accounts view showing connected AWS, GCP, and Azure accounts with status, role type, IAM import link, and Add Cloud Account button](https://storage.googleapis.com/zopdev-blog-resources/1/files/originals/20260602/e014113b-a7a1-4117-b316-38e0f1b8a40c-zopnightcloudaccounts.png)

*Settings → Cloud Accounts; each connected account with status, credential type, and an IAM import link.*

Open the **Connect cloud** wizard from the workspace home. Pick the provider:

- **AWS**: paste the account ID. The recommended method is **WIF-Assume Role** (a keyless cross-account IAM role); the wizard generates the trust policy and a read-only policy document. See [Cloud permissions](https://zop.dev/docs/zopnight/cloud-setup/permissions) for the exact policy JSON.
- **GCP**: pick organisation or project scope. The recommended method is **One-Click Connect** (sign in with Google; ZopNight provisions and manages a dedicated service account); you can also supply a **Service Account Key**.
- **Azure**: pick subscription scope. The recommended method is **Service Principal** (app registration plus client secret); **Workload Identity Federation** (OIDC, no secret) is also supported.

Apply the generated policy on your side, paste the resulting role ARN / SA email / SP ID back into the wizard, and click **Verify**. ZopNight pings the account read-only and confirms reachability. If Verify fails, the account shows as unreachable; recheck the role/external ID, the permission grant, and the region or scope, then retry, or contact support.

### 3. Wait for the first scan

The first scan starts within 60 seconds of a successful connect. Inventory typically completes in 2–4 minutes for accounts under 5,000 resources. Cost reconciliation begins once the first billing export is ingested; usually within a few hours of connect.

While you wait you can:

- Browse the **All Resources** page. 380+ resource types, three-level nesting, cascade filters.
- Open the **Recommendations** page; engine-by-engine breakdown with the metric, threshold, action, and projected dollar for each finding.
- Configure **Teams** so showback reports attribute spend correctly from day one.

### 4. Validate a finding

![Recommendation drawer for retail-bedrock-pt-prod; resource details, Why This Recommendation explanation, 14-day evidence chart of InvocationsPerMinute with avg/max/min, and Dismiss / Mark Resolved / Open in AWS Console actions](https://storage.googleapis.com/zopdev-blog-resources/1/files/originals/20260602/cf12303e-7da5-4a09-803c-2b3f1dc8f4d1-zopnightrecommendationdetail.png)

*Recommendation drawer; every finding ships with the resource, the why, the 14-day evidence, and a one-click apply path.*

Pick any high-confidence finding from the Recommendations page. Each one ships with:

- The **rule** that fired (e.g. "Idle EC2 Instance").
- The **resource** identifier and current configuration.
- The **observed metric** and the threshold it crossed.
- The **suggested action** (stop, resize, schedule, delete).
- The **projected monthly savings** computed from your actual unit price.

Click **Verify against bill** to see the line item from your billing export that this projection is reconciled against; no rack-rate fiction.

### 5. Pick your operating mode

You're now ready to choose how ZopNight runs for you:

- **Monitor**: read-only, finding-driven. Your team executes the actions through your existing workflow.
- **Recommend**: ZopNight prepares the action, your reviewer approves, ZopNight applies it inside a guarded change window.
- **Autopilot**: certified rules apply automatically inside policy boundaries. Audit trail captures every change.

You can mix modes per resource group, per environment, and per rule category.

## Next steps

- **[Authentication](https://zop.dev/docs/zopnight/authentication)**: production-grade trust policies and rotation cadence.
- **[Scheduling](https://zop.dev/docs/zopnight/concepts/scheduling)**: set up the first non-prod schedule.
- **[Scopes](https://zop.dev/docs/zopnight/concepts/scopes)**: how RBAC and resource visibility work across accounts and teams.