Cloud Accounts

Connect your AWS, GCP, or Azure accounts to enable resource discovery and scheduling.

Supported Providers

Amazon Web Services (AWS)

Google Cloud Platform (GCP)

Microsoft Azure

Permission Levels

Connected & last-synced visibility

Each cloud account card shows the date it was first connected and the most recent successful sync — broken down per provider service. Useful for spotting accounts where a credential rotation or a permissions drop has silently halted discovery.

Billing upgrade flow

If you connected an account in read_only mode without billing access, you can upgrade in three clicks without re-running setup. ZopNight detects the gap and surfaces a banner on the Dashboard with a per-account Fix button.

• Provider-specific guide — the upgrade drawer renders the exact IAM/role JSON for AWS or Azure based on your existing auth method.
• AWS one-click CloudFormation — for accounts using assume_role, ZopNight generates a CloudFormation template that adds ce:GetCostAndUsage and ce:GetCostAndUsageWithResources to your existing role. No manual policy editing.
• Async verify — the verify step polls the backend until a terminal state is reached, with a real-time spinner during the check.
• GCP excluded — billing is configured at the billing-account level, not the project, so the upgrade flow doesn't apply.

Create Cloud Account

curl -X POST https://zopnight.com/api/cloud-accounts \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{
  "provider": "aws",
  "cloudAccountID": "123456789012",
  "name": "Production AWS",
  "authMethod": "static_keys",
  "permissionLevel": "read_write",
  "credentials": {
    "accessKeyID": "AKIAIOSFODNN7EXAMPLE",
    "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLE"
  }
}'

curl -X POST https://zopnight.com/api/cloud-accounts \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{
  "provider": "aws",
  "cloudAccountID": "123456789012",
  "name": "Production AWS",
  "authMethod": "assume_role",
  "permissionLevel": "read_write",
  "credentials": {
    "roleArn": "arn:aws:iam::123456789012:role/ZopNightRole",
    "externalId": "zopnight-external-id"
  }
}'

curl -X POST https://zopnight.com/api/cloud-accounts \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{
  "provider": "gcp",
  "cloudAccountID": "my-gcp-project-id",
  "name": "Production GCP",
  "authMethod": "service_account",
  "permissionLevel": "read_write",
  "credentials": {
    "serviceAccountJSON": "{...service account key JSON...}"
  }
}'

curl -X POST https://zopnight.com/api/cloud-accounts \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{
  "provider": "azure",
  "cloudAccountID": "subscription-id",
  "name": "Production Azure",
  "authMethod": "service_principal",
  "permissionLevel": "read_write",
  "credentials": {
    "clientID": "app-client-id",
    "clientSecret": "app-client-secret",
    "tenantID": "azure-tenant-id"
  }
}'

{
"data": {
  "id": "ca_abc123",
  "provider": "aws",
  "cloudAccountID": "123456789012",
  "name": "Production AWS",
  "authMethod": "static_keys",
  "permissionLevel": "read_write",
  "status": "active",
  "createdAt": "2025-01-15T10:30:00Z",
  "updatedAt": "2025-01-15T10:30:00Z"
}
}

List Cloud Accounts

Get Cloud Account

Update Cloud Account

curl -X PUT https://zopnight.com/api/cloud-accounts/ca_abc123 \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{
  "name": "Renamed AWS Account",
  "permissionLevel": "read_write"
}'

Change the Authentication Method (in place)

You can switch a connected account from one authentication method to another — for example AWS access keys → keyless role federation — without deleting and recreating it. The account keeps the same identity, so its resources, groups, recommendations, cost history, schedules, and configuration all stay intact.

Supported switches

• AWS — any-to-any across static_keys, temporary_credentials, and assume_role.
• Azure — service_principal ↔ workload_identity_federation (a tenant-scoped parent cascades the change to its subscription children).
• GCP — not yet available in place; oauth needs an interactive Google consent flow, so switching to/from it still uses disconnect + reconnect.

In the UI, open the account's Edit drawer → Update credentials. This opens a guided 3-step wizard — Auth Method → Setup Guide (create the credentials, including AWS one-click CloudFormation) → Enter Credentials — the same steps used by the Connect Cloud Account wizard. Step 1 preselects the current method (marked Current): keep it and save to rotate the credentials, or pick a different method to switch. Saving re-verifies and re-keys the same account. (GCP and Databricks keep an inline credential form instead of the wizard, since they have no in-place method change.)

Via the API, send authMethod alongside the new credentials on the same PUT endpoint:

curl -X PUT https://zopnight.com/api/cloud-accounts/ca_abc123 \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{
  "authMethod": "assume_role",
  "credentials": {
    "roleArn": "arn:aws:iam::123456789012:role/ZopNightRole"
  }
}'

Same-account safety. The new credentials must resolve to the same cloud identity as the account (AWS 12-digit account ID via STS; Azure subscription membership; same tenant for tenant-scoped parents). If they point at a different account the request is rejected with 400 and nothing changes — an account can only be re-authenticated, never silently repointed. After a successful change ZopNight re-fetches credentials and re-runs the permission probe automatically.

Rotation is verified too. A same-method credential update (rotation) runs the exact same live check before storing — the new credentials must authenticate and resolve to the same account. This means a wrong or foreign credential is rejected with 400 instead of silently overwriting the working credential and breaking discovery.

Delete Cloud Account

GCP OAuth Flow

For GCP accounts, ZopNight supports a three-step OAuth flow as an alternative to service account keys. Tokens are encrypted with AES-256-GCM and are never exposed in plaintext.

1. Get OAuth URL

2. Exchange Code

3. Finalize

Cluster Access for Deployment Spaces

Once a cloud account is connected, you can register specific Kubernetes clusters (EKS, GKE, AKS) so ZopNight can mint short-lived kubeconfigs for them. Registering a cluster is the prerequisite for promoting it to a Deployment Space — the unit ZopNight provisions and deploys against.

{
"data": [
  {
    "name": "prod-eks",
    "region": "us-east-1",
    "type": "aws-eks",
    "registered": true,
    "registeredAt": "2026-04-15T08:00:00Z"
  },
  {
    "name": "staging-eks",
    "region": "us-east-1",
    "type": "aws-eks",
    "registered": false
  }
]
}

curl -X PUT "https://zopnight.com/api/cloud-accounts/ca_abc123/clusters/us-east-1/prod-eks/access" \
-H "Authorization: Bearer <token>"

Azure Workload Identity Federation

For secretless Azure authentication, ZopNight exposes OIDC discovery endpoints that Azure can use to validate tokens via Workload Identity Federation.

See Cloud Support Matrix for the complete list of discoverable and executable resource types per provider.