Cloud and infrastructure

Infrastructure shows your cloud accounts. Connect an account and Polo scans it, maps what it finds and draws its architecture. A scan only reads. Nothing in an account changes unless a person creates a resource from this page or approves a change an agent asks for.

Connect a cloud account

Only an administrator can connect an account.

1. Open Infrastructure and press Connect a cloud account.
2. Enter a Name and choose What to connect: Amazon Web Services account, Google Cloud account or Kubernetes cluster.
3. Choose where it Signs in from: Polo’s runner (nothing to install), where your deployment offers it, or one of your own runners.
4. Choose what it Signs in with:
   • AWS: an access key, a role, or, on your own runner, the AWS access that runner’s machine already has.
   • Google Cloud: a service account key (the JSON file).
   • Kubernetes: the service account of the Polo agent installed in the cluster.
5. Press Connect and scan.

Use read-only access, such as the AWS policy ReadOnlyAccess. Polo finds the account and its regions or projects by itself, then reads what that access can see. Step-by-step instructions are in Connect a cloud account.

Each account on the list shows a state:

State	Meaning
New	Connected but not scanned yet
Scanning	A scan is running; the page updates when it is done
Mapped	The last scan finished; press Open
Scan failed	The last scan failed; the row says why, for example rejected credentials or a runner that did not answer

Administrators and operators can press Scan again at any time.

Browse an account

Press Open on an account. It has five tabs.

Tab	What it shows
Architecture	A diagram of the account: networks, compute, databases, storage, messaging and traffic flow. Drag to move, zoom with −, Fit and +, and click a resource to see what it is connected to.
Resources	A table of everything Polo found, with region, kind and a search by name, ID or tag. Select a resource to read its configuration.
Terraform	Generates a Terraform project from the scan.
Snapshots	Keeps what a scan found so you can compare later.
Access	The regions or projects Polo read, what this access may not read, and any part of the scan that did not finish.

The Resources table shows the first 500 matches; search or filter by kind or region to narrow it.

Generate Terraform

On the Terraform tab, choose a region and press Generate Terraform. Polo writes a root and one module per part of the account, with every value taken from the scan, shown file by file. Download project (.zip) saves it. Polo writes it only when you ask and runs nothing: you plan it yourself, and it adopts the resources that already exist. Refine with AI lets a connected model improve the layout; the tab says which model it used and what it cost.

Snapshots

Name a snapshot and press Take snapshot to keep what the last scan found. Later, open a snapshot to see the account as it was then, or choose What changed since to list resources that are new, gone or changed.

Kubernetes

There are two ways to open a cluster.

• Install the Polo agent in the cluster. Add a runner on Connections → Runners, run its Kubernetes install command with kubectl, wait until it shows as Connected, then connect it on Infrastructure as a Kubernetes cluster. The agent connects out to Polo, so the cluster needs no public address.
• Open an EKS cluster of a connected AWS account. Open the account, choose the cluster under Resources and press Browse cluster. Nothing is installed. Through the account Polo only looks.

The cluster opens full screen as its own workspace.

• The sidebar lists every kind the cluster has, by section: Cluster, Workloads, Network, Storage, Configuration, Access and Custom resources.
• Overview shows how full the cluster is (CPU, memory, pods), what needs attention, the nodes and the latest warnings.
• A kind opens as a table with the columns kubectl get prints. A name opens the object’s page: summary, containers or rules, pods, conditions, events and YAML.
• Map shows, per namespace, what comes in, what it is reached as, what runs and what those use.
• On a pod, Logs and Shell open in a dock at the bottom of the window.
• Changes from Polo lists who changed what and when, and every shell that was opened.

What you can do depends on the cluster and on your role:

	Agent installed read-only	Agent bound to the edit role	EKS through the AWS account
Lists, object pages, map, logs	Yes	Yes	Yes
Edit, Scale, Restart, Delete, Create	No	Yes	No
Shell in a container	No	Yes	No
Following a log live	Yes	Yes	No

The agent installs read-only and cannot read Secrets. To allow changes, bind its service account to Kubernetes’ built-in edit role, for the whole cluster or one namespace. Kubernetes refuses anything that role does not allow. Administrators and operators can open YAML, read logs and make changes; viewers can browse only. Secret values stay hidden and Secrets cannot be created or changed from Polo. Edit shows exactly which lines would change before you apply, and an edit is refused if someone else changed the object after you opened it.

A table lists up to 500 objects of a kind, and you can have six shells or followed logs open at once.

Machine actions

An agent can start, stop or restart a machine, or change its size, in a connected AWS or Google Cloud account. Give the agent the tools Start, stop or restart a machine after approval and Change a machine’s size after approval for that account.

1. Ask the agent in a task, for example to stop a named instance.
2. The agent proposes the exact change. The approval shows the machine, its state when reviewed, the state the change should leave, and what the change costs or interrupts.
3. A person approves it.
4. Polo reads the machine again just before it sends the request. If the machine changed since the review, nothing is sent.
5. Polo reads the machine once more and reports whether it ended in the approved state.

A size change on a running machine stops it, changes the size and starts it again under one approval. If the machine does not start with the new size, Polo puts the old size back and starts it. The cloud must also allow the change: the account’s access needs permission to start, stop and reboot instances and, for a size change, to change the instance or machine type.

Caution

These machine changes are verified against local test fixtures only. They have not been run against a real AWS or Google Cloud account. Azure machine changes use a separate Azure connection with a runner you set up.

Create infrastructure

There are two ways to create something.

• By hand, in an AWS account. On the Resources tab press Create resource. Choose a kind (for example an S3 bucket, SQS queue, SNS topic or DynamoDB table, or any type by its CloudFormation name with properties as JSON), fill in the form, and review the exact request. Polo asks AWS to create exactly that, as you, and records the creation with your name. AWS decides whether the account’s access may create it. Created from Polo lists what people created. This is available to administrators and operators, for AWS accounts only.
• Through an agent, with Terraform. Give an agent a Terraform skill and ask for the change. The agent plans from your repository, and the plan is applied only after a person approves that exact plan. See Create infrastructure.