Managing Cloud Accounts

This page explains how to add, view, update, and delete cloud service provider accounts in your ACTIVATE organization. Cloud accounts store the credentials that ACTIVATE uses to provision infrastructure and start clusters on your behalf.

Adding a Cloud Account

1. Navigate to Organization > Cloud Accounts.
2. Click Add Account.
3. Enter a Name for the cloud account.
4. Select your Cloud Service Provider from the dropdown menu.
5. Fill in the provider-specific fields described below.
6. Click + Add Account.

Permission Checks

ACTIVATE checks AWS, Azure and Google Cloud credentials against every permission it needs to manage your infrastructure, so a missing permission shows up when you add the account instead of when a cluster or storage later fails to start.

• AWS — ACTIVATE checks the access key before it saves the account, using IAM policy simulation (iam:SimulatePrincipalPolicy) followed by a real EC2 call, so permissions blocked by a service control policy or permission boundary are caught too. If anything is missing, the account is not created and the error lists each missing action.
• Azure — ACTIVATE checks the service principal before it saves the account. It compares the principal's effective permissions on the subscription with every action and storage data action the platform uses, then reads the Microsoft Graph permissions from the principal's token. Access from custom roles, management groups, groups and wildcards all counts. If anything is missing, the account is not created and the error lists each missing permission.
• Google Cloud — ACTIVATE saves the account and then checks the service account's permissions on the project. Permissions granted through custom roles, inherited roles and group membership all count. While the check runs, the Permissions field on the detail page shows that it is verifying; when it finishes, the field shows whether it passed and lists each missing permission.

The required permissions are listed in the AWS, Azure and Google preparation guides. Add any missing permissions in your cloud provider, then update the credentials to run the check again.

Viewing Cloud Account Details

To view details for a cloud account, navigate to Organization > Cloud Accounts and click the account name.

The detail page displays the following information:

• Principal — The primary credential identifier (for example, the AWS Access Key ID or the Google service account email).
• Billing — Whether billing has been provisioned for this account, along with when billing data was last refreshed.
• Permissions — The result of the permission check. If the check fails, it lists the missing permissions and links to the relevant preparation guide.
• Credentials last updated — When the credentials were last changed.
• Shared with — Which groups or the entire organization have access to use this cloud account for network provisioning.
• Networks — A table of all networks provisioned under this cloud account.

From the detail page you can also manage access permissions, provision or deprovision billing, and add networks.

Updating Credentials

To rotate or update the credentials on an existing cloud account:

1. Navigate to Organization > Cloud Accounts and click the account name.
2. Click Update Credentials in the action bar.
3. Update the credential fields as needed. The account name and cloud service provider cannot be changed.
4. Click Update Credentials to save.

After updating, ACTIVATE runs the permission check again.

Deleting a Cloud Account

To delete a cloud account:

1. Navigate to Organization > Cloud Accounts.
2. Click the delete icon next to the account you want to remove.
3. Confirm the deletion in the dialog.

If billing has been provisioned for the account, deprovision billing before deleting the account.