Skip to main content

​
What is a Cloud Account?

A Cloud Account connects a cloud provider to Formal. Once connected, Formal can:
  • Discover resources automatically and keep your inventory in sync.
  • Deliver logs to cloud storage for retention and compliance.
  • Use cloud-native access to reach and authenticate to your resources.
A Cloud Account grants Formal scoped access. You enable only the capabilities you need.

​
How It Works

Every provider follows the same three steps.
1

Register

Create the integration in Formal from Cloud Accounts or Terraform. Formal returns the identity it uses to access your cloud.
2

Grant access

Run the provided setup in your cloud to grant Formal scoped access. AWS uses a cross-account IAM role; GCP uses Workload Identity Federation.
3

Activate

Once the setup reports back, Formal activates the integration and starts discovering resources and forwarding logs.

​
Supported Providers

AWS

Autodiscovery for RDS, Redshift, EKS, EC2, ECS, and S3, plus S3 log delivery

GCP

Autodiscovery for Cloud SQL, GKE, and Compute Engine, plus Cloud Storage log delivery

Azure

Coming soon

​
Capabilities

​
Resource Autodiscovery

Formal scans a connected account and adds discovered resources to Resources. Discovery is continuous, so new resources appear automatically, and provider tags sync to Formal. Autodiscovered resources are read-only by default. To customize one, create a manual resource with the same hostname. Formal prioritizes manual configuration over discovered settings.

​
Log Delivery

A Cloud Account can grant Formal write access to a storage bucket. You then create a Log Integration that points at a bucket to forward Connector logs for long-term retention and compliance.

​
Best Practices

Grant access only for the capabilities you use. Scoped permissions keep the integration least-privilege.
Create a separate Cloud Account for each AWS account or GCP project (production, staging, dev) for clean isolation.
Periodically review discovered resources and granted access so they match your actual infrastructure.

​
Next Steps

Connect AWS

Set up a cross-account IAM role

Connect GCP

Federate a Google Cloud project

Log Integration

Forward logs to S3, GCS, or a SIEM

Terraform

Manage integrations as code