Connect your cloud

This page is for a workspace admin who wants Veriom to see what runs in a cloud account. Quick-connect creates a read-only identity in your cloud. A daily GitHub Actions job then sends Veriom a list of your resources. Veriom never holds a cloud key.

Before you startCopy Anchor Link

• You have the Admin or Owner role in the workspace.
• One GitHub repository is connected through the Veriom GitHub App. Its CI runs the collection job. See Connect a repository.
• You can create IAM roles in the AWS account, role assignments in the Azure subscription, or service accounts in the Google Cloud project.
• The workspace has fewer than 25 cloud connections.

Connect a cloud accountCopy Anchor Link

1. In Veriom, open Integrations and select the Cloud tab.

2. In Cloud provider, choose AWS, Azure, or Google Cloud.

3. In the Quick-connect card, choose the Repository whose CI collects it.

4. Click Connect AWS, Connect Azure, or Connect Google Cloud. Confirm your identity if Veriom asks.

5. Veriom shows setup links and a command. Use one of them:

   Provider	Fastest option	Also available
   AWS	Open in the AWS console, or My account already trusts GitHub if the account already has GitHub's OIDC provider	A command for AWS CloudShell
   Azure	A command for Azure Cloud Shell	Deploy to Azure
   Google Cloud	A command for Google Cloud Shell

6. Wait for the status to change from Waiting for the identity to Connected.

The setup links and the command work once and expire after 24 hours. If they expire, click New setup links.

If you used Deploy to Azure, the portal cannot report back to Veriom. Click Enter the outputs, paste the tenant_id, subscription_id, and client_id from the deployment outputs, and click Finish connecting.

Merge the collection workflowCopy Anchor Link

When the connection is ready, Veriom opens a draft pull request in the repository you chose. It adds one workflow file, .github/workflows/veriom-cloud-<provider>-<id>.yml.

1. Open the pull request on GitHub and review it.
2. Merge it.

For an AWS account, the workflow looks like this. Veriom fills in your account, role, region, workspace, and a daily time:

name: "Veriom cloud inventory (AWS account 123456789012)"
on:
  schedule:
    - cron: "17 4 * * *"
  workflow_dispatch:
  push:
    branches: ["main"]
    paths: [".github/workflows/veriom-cloud-aws-<id>.yml"]
permissions:
  contents: read
  id-token: write
concurrency:
  group: veriom-cloud-aws-<id>
  cancel-in-progress: false
jobs:
  collect:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Assume the read-only role
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: "<ARN of the role quick-connect created>"
          aws-region: "us-east-1"
      - name: Collect inventory for Veriom
        uses: Veriom/actions/cloud-collector@v2
        with:
          provider: "aws"
          region: "us-east-1"
          api-url: "https://api.veriom.ai"
          workspace-id: "7f3c9a52-1b4e-4d8a-9c61-2e5f0a7b8d13"

Azure workflows sign in with azure/login, and Google Cloud workflows with google-github-actions/auth. No cloud key or Veriom token is stored in the repository.

If Veriom could not open the pull request, the connection still shows Connected with a Propose the workflow button. Click it to try again.

The workflow runs once when it lands, then once a day, and whenever you start it by hand. It signs in to your cloud with GitHub's OIDC token, collects the inventory, and sends it to Veriom. The connection card shows the time of the last snapshot.

What quick-connect creates in your cloudCopy Anchor Link

Every identity trusts only GitHub Actions runs from the default branch of the repository you chose. Nothing else can use it.

What Veriom receivesCopy Anchor Link

The collector reads your resource list with read-only calls and sends Veriom:

• up to 500 resources, each with its ID or ARN, name, type, category, region, and a short list of allowed properties;
• up to 1,000 relationships between those resources.

It does not read data inside resources, secrets, or logs.

Stop collectingCopy Anchor Link

Veriom has no disconnect button yet. To stop collection:

1. Delete the veriom-cloud-*.yml workflow file from the repository.
2. Delete the identity that quick-connect created in your cloud (see the table above).

If something goes wrongCopy Anchor Link

See Troubleshooting for more codes.