> ## Documentation Index
> Fetch the complete documentation index at: https://docs.borghq.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting cloud accounts

> Give Heimdall read-only access to an AWS account, Azure subscription, or GCP project

**Cloud → Accounts** lists every cloud account connected to your organisation and is where you add new ones. Every connection is read-only: Heimdall reads your resource configuration and never changes it.

## Connecting an account

Click **Connect account** to open the four-step wizard.

<Steps>
  <Step title="Choose a provider">
    Pick **Amazon Web Services**, **Microsoft Azure**, or **Google Cloud**. Changing provider later in the wizard clears everything you entered, so pick first.
  </Step>

  <Step title="Enter account details">
    Give the connection a display name such as `Production`, then fill in the provider-specific fields:

    * **AWS**: your 12-digit account ID, plus the regions to scan. GovCloud and China regions are not offered, because Heimdall scans the standard partition only.
    * **Azure**: your Azure Active Directory tenant ID and the subscription ID to scan, both UUIDs.
    * **GCP**: the project ID to scan.
  </Step>

  <Step title="Run the setup template">
    Odin generates a ready-to-run template for your provider and shows the exact values it needs back:

    * **AWS**: a CloudFormation template that creates a read-only role trusting Borg's scanner. Deploy it from the console or the AWS CLI, then paste the stack's `RoleArn` output. The template already embeds a per-connection **external ID**, which the role's trust policy must require.
    * **Azure**: an Azure CLI snippet that creates a Reader service principal. Paste back the `clientId` (`appId`) and `clientSecret` (`password`) it prints.
    * **GCP**: a gcloud snippet that creates a read-only service account and downloads a JSON key. Paste back the service account email and the full contents of the key file.

    Tick the confirmation box once you have run the template.
  </Step>

  <Step title="Verify">
    Odin runs a health check against the new connection and polls until it settles, which usually takes a few seconds. If the check is still running after about 40 seconds, the wizard leaves the account as **Pending** and finishes in the background. The Accounts table picks up the result.
  </Step>
</Steps>

<Info>
  Give the role or service principal a moment to propagate before verifying. If verification fails, re-verify from the account's actions menu rather than reconnecting from scratch.
</Info>

## The accounts table

| Column        | Description                                                  |
| ------------- | ------------------------------------------------------------ |
| **Provider**  | AWS, Azure, or Google Cloud                                  |
| **Name**      | The display name you gave the connection                     |
| **Account**   | The AWS account ID, Azure subscription ID, or GCP project ID |
| **Status**    | The current connection status                                |
| **Assets**    | How many resources have been discovered in this account      |
| **Last scan** | When the account was last scanned                            |

Filter by provider or status with the two dropdowns above the table. Select rows with the checkboxes to re-verify or delete several accounts at once.

### Account statuses

| Status           | Meaning                                                     |
| ---------------- | ----------------------------------------------------------- |
| **Connected**    | The last health check succeeded and scans are running       |
| **Pending**      | The first health check hasn't finished yet                  |
| **Degraded**     | The connection works but the health check raised a warning  |
| **Disconnected** | Heimdall can no longer reach the account                    |
| **Error**        | The health check failed. The reason is shown on the account |

## Account actions

The actions menu on each row offers:

* **Scan now**: queue a discovery scan, which refreshes the asset inventory
* **Run CSPM scan**: queue a security scan, which evaluates the inventory and produces findings
* **Re-verify**: re-run the health check, for example after fixing permissions
* **Delete**: remove the connection

## Account details

Click a row to open the detail panel.

**Overview** shows the asset count, the last scan, the last health check, and when the account was connected. **Scan settings** manages the account's schedules, and **Scan history** lists recent runs, and clicking one opens its [scan run](#scan-runs) page. Below that, a provider section lists the identifiers Odin holds for the connection, including the AWS external ID and role ARN.

### Scan schedules

An account can carry several schedules. Each one sets:

* **Scan type**: **Discovery** to refresh the inventory, or **CSPM** to evaluate it
* **Frequency**: hourly, every 4 hours, every 12 hours, daily, or weekly
* **Profile**: the Prowler profile to run, `default` unless you have been given another
* **Minimum severity**: the lowest severity Heimdall reports from the scan

Add a schedule with **Add schedule**. Odin rejects a duplicate of one that already exists on the account. Each schedule row has a switch to pause it without deleting it.

## Scan runs

A scan run page reports its status (queued, running, completed, failed, or cancelled), when it started and completed, how long it took, and how many resources it discovered, updated, and removed. A failed run also shows its error log.