Getting StartedConnecting Your Cloud Account

Connecting Your Azure Account

**CloudRift works read-only by default.** Scanning, cost analysis, governance scoring, and carbon reporting all run on the built-in **Reader** role — no agents, nothing installed, nothing changed. Write access (Contributor) is required **only** if you later enable Autopilot to execute approved fixes, and you can add it at that point.

CloudRift connects to your Azure tenant via a Service Principal — a secure, scoped identity.

Step 1: Create a read-only Service Principal (default)

Run these commands in Azure CLI or Cloud Shell:

# Create the Service Principal with the read-only Reader role
az ad sp create-for-rbac --name "CloudRift" --role Reader \
  --scopes /subscriptions/{your-subscription-id}

# Output: appId (client_id), password (client_secret), tenant (tenant_id)

That's everything analysis needs. Every finding, report, and recommendation works from here.

Optional: roles for Autopilot execution only

If — and only when — you enable Autopilot to execute approved actions (resize, delete, deploy), grant the additional role that matches what you approve:

Role	Required only for
Contributor	Executing approved fixes: resize, delete, deploy IaC
Desktop Virtualization Contributor	Deploying AVD/WVD environments
Virtual Machine Contributor	Executing VM resize actions
User Access Administrator	Reading RBAC assignments for governance depth

# ONLY when enabling Autopilot execution — not needed for analysis
az role assignment create --assignee {appId} \
  --role Contributor \
  --scope /subscriptions/{subscription-id}

Step 3: Add the Account in CloudRift

Go to Admin → Cloud Accounts

Click + Connect Account

Select Azure

Enter your Tenant ID, Client ID, and Client Secret

Click Test Connection — you should see a green checkmark

Click Save

Step 4: Run Your First Scan

After connecting, click Scan to discover all resources. Scans typically take 30–90 seconds depending on the size of your environment.

---

Connecting Your AWS Account

AWS uses Access Keys or an IAM Role for authentication.

Creating an IAM User

Go to AWS Console → IAM → Users → Add User

Select Programmatic access

Attach policy: ReadOnlyAccess — the default; all analysis works read-only. (PowerUserAccess only if you later enable Autopilot execution)

Save the Access Key ID and Secret Access Key

In CloudRift: Admin → Cloud Accounts → + Connect Account → AWS