> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Connect AWS and GCP so Formal can discover resources and deliver logs

## What is a Cloud Account?

A Cloud Account connects a cloud provider to Formal. Once connected, Formal can:

* **Discover resources** automatically and keep your inventory in sync.
* **Deliver logs** to cloud storage for retention and compliance.
* **Use cloud-native access** to reach and authenticate to your resources.

A Cloud Account grants Formal scoped access. You enable only the capabilities you need.

## How It Works

Every provider follows the same three steps.

<Steps>
  <Step title="Register">
    Create the integration in Formal from [Cloud Accounts](https://app.formal.ai/cloud-accounts) or Terraform. Formal returns the identity it uses to access your cloud.
  </Step>

  <Step title="Grant access">
    Run the provided setup in your cloud to grant Formal scoped access. AWS uses a cross-account IAM role; GCP uses Workload Identity Federation.
  </Step>

  <Step title="Activate">
    Once the setup reports back, Formal activates the integration and starts discovering resources and forwarding logs.
  </Step>
</Steps>

## Supported Providers

<CardGroup cols={3}>
  <Card title="AWS" icon="aws" href="/docs/guides/integrations/clouds/aws">
    Autodiscovery for RDS, Redshift, EKS, EC2, ECS, and S3, plus S3 log delivery
  </Card>

  <Card title="GCP" icon="google" href="/docs/guides/integrations/clouds/gcp">
    Autodiscovery for Cloud SQL, GKE, and Compute Engine, plus Cloud Storage log delivery
  </Card>

  <Card title="Azure" icon="microsoft">
    Coming soon
  </Card>
</CardGroup>

| Capability             | AWS                              | GCP                            |
| ---------------------- | -------------------------------- | ------------------------------ |
| Resource autodiscovery | RDS, Redshift, EKS, EC2, ECS, S3 | Cloud SQL, GKE, Compute Engine |
| Log delivery           | S3                               | Cloud Storage                  |
| Cloud-native access    | Cross-account IAM role           | Workload Identity Federation   |

## Capabilities

### Resource Autodiscovery

Formal scans a connected account and adds discovered resources to [Resources](https://app.formal.ai/resources). Discovery is continuous, so new resources appear automatically, and provider tags sync to Formal.

Autodiscovered resources are read-only by default. To customize one, create a manual resource with the same hostname. Formal prioritizes manual configuration over discovered settings.

### Log Delivery

A Cloud Account can grant Formal write access to a storage bucket. You then create a [Log Integration](/docs/guides/integrations/log) that points at a bucket to forward Connector logs for long-term retention and compliance.

## Best Practices

<AccordionGroup>
  <Accordion title="Enable only what you need" icon="toggle-on">
    Grant access only for the capabilities you use. Scoped permissions keep the
    integration least-privilege.
  </Accordion>

  <Accordion title="One integration per account" icon="building">
    Create a separate Cloud Account for each AWS account or GCP project
    (production, staging, dev) for clean isolation.
  </Accordion>

  <Accordion title="Audit regularly" icon="magnifying-glass">
    Periodically review discovered resources and granted access so they match
    your actual infrastructure.
  </Accordion>
</AccordionGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="Connect AWS" icon="aws" href="/docs/guides/integrations/clouds/aws">
    Set up a cross-account IAM role
  </Card>

  <Card title="Connect GCP" icon="google" href="/docs/guides/integrations/clouds/gcp">
    Federate a Google Cloud project
  </Card>

  <Card title="Log Integration" icon="pipe" href="/docs/guides/integrations/log">
    Forward logs to S3, GCS, or a SIEM
  </Card>

  <Card title="Terraform" icon="code" href="/docs/guides/configuration/terraform">
    Manage integrations as code
  </Card>
</CardGroup>