Skip to main content
Cloud → Accounts lists every cloud account connected to your organisation and is where you add new ones. Every connection is read-only: Heimdall reads your resource configuration and never changes it.

​
Connecting an account

Click Connect account to open the four-step wizard.
1

Choose a provider

Pick Amazon Web Services, Microsoft Azure, or Google Cloud. Changing provider later in the wizard clears everything you entered, so pick first.
2

Enter account details

Give the connection a display name such as Production, then fill in the provider-specific fields:
  • AWS: your 12-digit account ID, plus the regions to scan. GovCloud and China regions are not offered, because Heimdall scans the standard partition only.
  • Azure: your Azure Active Directory tenant ID and the subscription ID to scan, both UUIDs.
  • GCP: the project ID to scan.
3

Run the setup template

Odin generates a ready-to-run template for your provider and shows the exact values it needs back:
  • AWS: a CloudFormation template that creates a read-only role trusting Borg’s scanner. Deploy it from the console or the AWS CLI, then paste the stack’s RoleArn output. The template already embeds a per-connection external ID, which the role’s trust policy must require.
  • Azure: an Azure CLI snippet that creates a Reader service principal. Paste back the clientId (appId) and clientSecret (password) it prints.
  • GCP: a gcloud snippet that creates a read-only service account and downloads a JSON key. Paste back the service account email and the full contents of the key file.
Tick the confirmation box once you have run the template.
4

Verify

Odin runs a health check against the new connection and polls until it settles, which usually takes a few seconds. If the check is still running after about 40 seconds, the wizard leaves the account as Pending and finishes in the background. The Accounts table picks up the result.
Give the role or service principal a moment to propagate before verifying. If verification fails, re-verify from the account’s actions menu rather than reconnecting from scratch.

​
The accounts table

Filter by provider or status with the two dropdowns above the table. Select rows with the checkboxes to re-verify or delete several accounts at once.

​
Account statuses

​
Account actions

The actions menu on each row offers:
  • Scan now: queue a discovery scan, which refreshes the asset inventory
  • Run CSPM scan: queue a security scan, which evaluates the inventory and produces findings
  • Re-verify: re-run the health check, for example after fixing permissions
  • Delete: remove the connection

​
Account details

Click a row to open the detail panel. Overview shows the asset count, the last scan, the last health check, and when the account was connected. Scan settings manages the account’s schedules, and Scan history lists recent runs, and clicking one opens its scan run page. Below that, a provider section lists the identifiers Odin holds for the connection, including the AWS external ID and role ARN.

​
Scan schedules

An account can carry several schedules. Each one sets:
  • Scan type: Discovery to refresh the inventory, or CSPM to evaluate it
  • Frequency: hourly, every 4 hours, every 12 hours, daily, or weekly
  • Profile: the Prowler profile to run, default unless you have been given another
  • Minimum severity: the lowest severity Heimdall reports from the scan
Add a schedule with Add schedule. Odin rejects a duplicate of one that already exists on the account. Each schedule row has a switch to pause it without deleting it.

​
Scan runs

A scan run page reports its status (queued, running, completed, failed, or cancelled), when it started and completed, how long it took, and how many resources it discovered, updated, and removed. A failed run also shows its error log.