Cloud Connect
Discover and inventory cloud resources across your entire cloud account without installing any agents.
Cloud Connect is an agentless, organization-level integration that gives Cast AI read-only visibility into your cloud account. Instead of connecting clusters one by one, Cloud Connect discovers your Kubernetes clusters, virtual machines, and other cloud resources in a single setup — and keeps that inventory up to date with hourly syncs. The exact resources discovered depend on your cloud provider and the permission scope you choose.
Cloud Connect creates IAM trust relationships in your cloud account (IAM roles, service accounts, or app registrations). Cast AI uses these trust relationships to issue short-lived credentials on demand — no long-lived secrets are stored.
How Cloud Connect works
Setting up Cloud Connect involves three steps:
- Select your provider and permission scope. Choose which cloud provider to integrate and which permission scope matches your security requirements.
- Create IAM resources. Run the generated setup script (or apply the equivalent configuration via the Cast AI API) to create the necessary IAM roles, service accounts, or app registrations in your cloud account.
- Automatic sync begins. Cast AI starts discovering your cloud resources using short-lived credentials issued through the IAM trust relationship. Discovered clusters appear with a Discovered status in the console.
After the initial setup, Cast AI syncs resources automatically every 60 minutes.
You can set up Cloud Connect in several ways:
- Cast AI console — guided flow with a generated setup script. See Connect using the Cast AI console.
- Terraform — declarative modules for AWS and GCP.
- Cast AI API — direct API calls for programmatic setup.
Supported providers
Cloud Connect supports AWS, GCP, and Azure. Each provider differs in the scopes available and the resource types that get synced.
| Provider | Scopes | Resources synced |
|---|---|---|
| AWS | Account, Organization | EKS clusters, EC2 instances, RDS databases, load balancers, Elastic IPs, Savings Plans, Reserved Instances, Capacity Reservations. Optionally: SageMaker, Bedrock, and other AI/ML services; CUR bucket data. |
| GCP | Project, Organization | GKE clusters, Compute Engine VMs, persistent disks, Cloud SQL instances, CUDs, Flex CUDs, Capacity Reservations. |
| Azure | Subscription | AKS clusters, virtual machines, VM scale sets, Reserved Instances, Savings Plans. |
Organization-level scopes (AWS Organization and GCP Organization) let you discover resources across all accounts or projects in your organization from a single integration. Azure supports subscription-level scoping only.
Permission scopes
When you set up Cloud Connect, you choose a permission scope that controls how much read access Cast AI gets. All scopes are read-only — Cloud Connect never modifies your resources.
| Scope | What it covers | Available for |
|---|---|---|
| Full Access | Broad read-only access across all services | AWS, GCP, Azure |
| Minimal Permissions | Targeted access to core compute, Kubernetes, and database services | AWS, GCP, Azure |
| Commitments | Access to commitment and savings data (Reserved Instances, Savings Plans, CUDs) | AWS, GCP, Azure |
| AI Services | List and describe permissions for AI/ML services (Bedrock, SageMaker, Comprehend, and others) | AWS |
| CUR Bucket | Access to Cost and Usage Report S3 bucket | AWS (account scope only) |
You can combine multiple scopes during setup. For the full IAM policies, roles, and permissions for each scope, see Permissions for Cloud Connect.
What happens to discovered clusters
Clusters found by Cloud Connect appear in the Cast AI console with a Discovered status. For each discovered cluster, you can see basic metadata and optimization potential — without installing any components.
To start optimizing a discovered cluster, select it in the console and click Connect. This starts the standard connection flow described in Connect using the Cast AI console.
Cloud Connect and commitments
Cloud Connect also serves as the sync mechanism for cloud commitment data. When configured with the Commitments permission scope, Cast AI automatically imports and refreshes your Reserved Instances, Savings Plans, CUDs, and Flex CUDs every 60 minutes.
This enables the Cast AI autoscaler to factor your existing commitments into node provisioning decisions. For details, see Commitments.
Related resources
Updated 1 hour ago