Frequently asked questions
Answers to common Cloud Control questions: read-only access, supported clouds, the empty-to-real cutover, enumeration safety, lockout, API tokens, databases and cost data.
Common questions about how Cloud Control works. If your question is about a specific failure, see Troubleshooting.
Does Cloud Control need write access to my cloud accounts?
No. Cloud Control connects read-only and uses short-lived, assumed credentials — a cross-account IAM role for AWS and workload identity federation for GCP. It discovers and reports; it cannot change your infrastructure, and there are no long-lived keys to store.
Which clouds are supported today?
AWS and GCP connection and inventory sync are real. Azure and Alibaba adapters are on the roadmap; the UI names their intended connection methods but they are not connectable yet.
What does a brand-new organization look like before I connect a cloud account?
Cloud Control runs only real environments — there is no demo dataset. A never-connected organization shows an honest empty state on every screen with a 'Connect a cloud account' call-to-action, until your first connection turns healthy and real data flows in.
Why is a section still empty after I connected an account?
The empty-to-real cutover fires only when a connection first reaches healthy. If a section is still empty, the connection is probably still connecting/warning/error, or its first sync has not finished. Check the connection health on Cloud accounts and click Verify.
How is authentication kept safe from account enumeration?
Wrong-email and wrong-password sign-ins return the identical message; password reset returns the same response whether or not the address exists; SSO start returns the same 404 for an unknown org or one with no SSO; and hidden surfaces return 404 rather than 403. Cross-organization ids also return 404 everywhere.
What happens after too many failed sign-ins?
Five failed attempts for the same email lock sign-in for 15 minutes with a 429 (and a Retry-After header). The same cap applies to wrong MFA codes per user. A successful password reset clears the counter for that email.
Can API tokens do everything I can?
No. A token carries a role as its capability ceiling that can never exceed the creator's own capabilities, and it never confers owner or platform-admin powers. Tokens also can't manage tokens — token administration requires a signed-in session.
Which database does my deployment use?
Call GET /api/health — it reports database as sqlite, postgres or turso. SQLite is the local default; Postgres is selected by DATABASE_URL; Turso by TURSO_DATABASE_URL. Serverless deployments must use Postgres or Turso.
Is the cost data real?
The FinOps core is real: native billing is normalized to the FOCUS standard (reconciling to source to the cent), with spend by cloud/service/tag, budgets and statistical anomaly detection. Optimization recommendations, price comparison, chargeback export and multi-currency are on the roadmap.
How do I fully remove Cloud Control's access to a cloud account?
Disconnect the account in Cloud Control (which stops sync and marks rows disconnected, never purging them), then delete the IAM role or workload identity federation config in your cloud account to revoke the trust entirely.