Connect a cloud account

Connecting a cloud account lets Polo read what is in it, show it as a diagram and a list, and give your agents tools to work with it. A scan only reads. Nothing in the account changes unless a person creates a resource from Polo or approves a change an agent asks for. Only a workspace administrator can connect an account.

VideoConnect a cloud account

Before you start

Prepare read-only access in the cloud:

• AWS: an IAM user with read-only access, such as the AWS policy ReadOnlyAccess, and its access key. Where the form offers it, you can use a role instead of a key.
• Google Cloud: a service account with a read-only role, such as Viewer, on the projects Polo should map, and a JSON key for it.

Add permission to change machines only if agents should make those changes. Each one still waits for your approval.

The account signs in from a runner. If your Polo offers a default runner, you need to set up nothing. If the form says there is no runner to sign in from, add one under Connections → Runners first. See Runners and vault.

Connect an AWS account

1. Open Infrastructure and choose Connect a cloud account.
2. Enter a Name, such as “Production”.
3. Under What to connect, choose Amazon Web Services account.
4. If Signs in from is shown, choose the runner the account signs in from.
5. Under Signs in with, choose one of the ways the form offers:
   • An access key: enter the Access key ID and the Secret access key.
   • A role Polo may assume: enter the Role ARN. The form shows a trust policy to copy onto the role. Give the role read-only permissions.
   • With a runner of your own, the form can also offer a role that runner’s machine may assume, or the AWS access the machine already has.
6. Choose Connect and scan.

Polo encrypts the key, hands it only to the runner that signs in, and never shows it again.

To let agents start, stop or restart EC2 instances, or change an instance’s type, add those permissions (including ec2:ModifyInstanceAttribute for the type) to the same access.

Connect a Google Cloud account

1. Open Infrastructure and choose Connect a cloud account.
2. Enter a Name.
3. Under What to connect, choose Google Cloud account.
4. Paste the whole JSON key file into Service account key (JSON).
5. Choose Connect and scan.

Polo keeps only the service account’s email and private key, encrypted.

To let agents start, stop or reset instances, or change a machine type, give the service account that permission as well, for example the role Compute Instance Admin (v1).

Note

The same dialog connects a Kubernetes cluster through a Polo agent installed in the cluster. A Microsoft Azure subscription is connected differently, from Connections → Add connection. See Connections.

Wait for the scan

Polo finds the account and its regions or projects by itself, then reads what the access can see. The account’s row shows Scanning and then Mapped. If it shows Scan failed, the row says why, for example that the key was not accepted. Fix the access and choose Scan again.

Browse Infrastructure

Open the account. It has five views:

• Architecture: a diagram of the account. Choose a region under Show, zoom, and drag to move. Click a resource to see what it is connected to.
• Resources: every resource by kind. Filter by Region and search by name, ID or tag. Choose a row to see its details.
• Terraform: choose Generate Terraform to get a project of modules built from the scan, shown file by file, and Download project (.zip). Polo writes it only when you ask and runs nothing. A connected model can refine the layout with Refine with AI; the tab says which model it used and what it cost.
• Snapshots: choose Take snapshot to keep what a scan found. Later you can look at the account as it was then and see what has changed since.
• Access: how Polo signs in to the account, what this access could not read, and any part of the last scan that did not finish.

Choose Scan again to read the account afresh. ← All accounts returns to the list.

In a connected AWS account, Resources also offers Create resource: you choose a kind, fill in a short form and see exactly what Polo will ask AWS for before it is sent. An EKS cluster in the account can be opened with Browse cluster, to look only.

Let an agent use the account

Connecting an account does not give every agent access to it. Open the agent with Edit and, under Tools it may use, switch on what it needs. For a connected account the tools include:

• Read the account’s mapped resources
• Read the account’s cost
• Read where the account could spend less
• Start, stop or restart a cloud machine
• Change the size of a cloud machine

The last two are changes. Each request names one machine, waits for approval, and is followed by a fresh read of the machine. See Cloud and infrastructure.

Next steps

• Add Terraform to an agent
• Create infrastructure for a service