> ## Documentation Index
> Fetch the complete documentation index at: https://docs.idyl.network/llms.txt
> Use this file to discover all available pages before exploring further.

# idyl cloud-account

> Manage connected cloud accounts

View and manage the cloud accounts this account provisions capacity into.

A connection names a credential you created in your own cloud estate and that
trusts the platform. You keep ownership of the cloud account and every instance
created in it; the platform assumes the credential at runtime and holds no
long-lived secret for it.

Connections carry a name you choose and a 12-digit ID the platform assigns.
Commands address a connection by its ID; the name is what a manifest matches on.

## Usage

```bash theme={null}
idyl cloud-account
```

## Aliases

* `cloud-accounts`

## Commands

| Command                      | Description                                 |
| ---------------------------- | ------------------------------------------- |
| `idyl cloud-account connect` | Connect a cloud account                     |
| `idyl cloud-account get`     | Get a connected cloud account, or list them |

## Inherited flags

| Flag                                 | Description                                                        |
| ------------------------------------ | ------------------------------------------------------------------ |
| `-a <string>, --account-id <string>` | Account ID to use, overriding the current context.                 |
| `-c <string>, --context <string>`    | Use the named context for this command.                            |
| `--homedir <string>`                 | Override the configuration directory. Defaults to \~/.config/idyl. |
| `-n <string>, --namespace <string>`  | Namespace to address, overriding the entered context.              |
| `--network <string>`                 | Override the Network for this command.                             |
| `-p <string>, --profile <string>`    | Override the access profile for this command.                      |
| `-s <string>, --subnet <string>`     | Subnet to use for this command, overriding the current context.    |
| `--workspace <string>`               | Workspace within the namespace, overriding the entered context.    |

## Examples

```bash theme={null}
idyl cloud-account list
idyl cloud-account get <cloud-account-id>
idyl cloud-account connect --name prod-aws --cloud aws --role-arn <role-arn>
```

## Subcommand reference

### `idyl cloud-account connect`

Connect a cloud account so the platform can provision capacity into it.

The credential named here is one you created in your own cloud estate and that
trusts the platform: a scoped IAM role for AWS, a federated service account for
GCP, an app registration for Azure. No secret is transmitted or stored.

Connecting is reconciled by name, exactly as applying a CloudAccount manifest
is: a name the account does not have creates the connection, and a name it
already has re-declares it. Re-running after fixing a trust policy is
therefore how a connection is re-verified.

AWS trust requires an external ID the platform assigns from your account. It is
not something you choose: connect once, read the external ID this prints, add
it to the role's trust policy, then run the same command again to verify.

#### Usage

```bash theme={null}
idyl cloud-account connect [flags]
```

#### Flags

| Flag                               | Description                                                                          |
| ---------------------------------- | ------------------------------------------------------------------------------------ |
| `--client-id <string>`             | Client ID of the app registration. Required with --cloud azure.                      |
| `--cloud <string>`                 | Required. Cloud to connect: aws, gcp, or azure.                                      |
| `--name <string>`                  | Required. Connection name. The stable handle for this connection within the account. |
| `-o <string>, --output <string>`   | Output format: table, json, yaml. Default: `table`.                                  |
| `--project-id <string>`            | GCP project capacity is provisioned into. Required with --cloud gcp.                 |
| `--role-arn <string>`              | ARN of the IAM role the platform assumes. Required with --cloud aws.                 |
| `--service-account-email <string>` | Service account the platform impersonates. Required with --cloud gcp.                |
| `--subscription-id <string>`       | Subscription capacity is provisioned into. Required with --cloud azure.              |
| `--tenant-id <string>`             | Tenant the app registration lives in. Required with --cloud azure.                   |

#### Examples

```bash theme={null}
idyl cloud-account connect --name prod-aws --cloud aws --role-arn <role-arn>
idyl cloud-account connect --name prod-gcp --cloud gcp --project-id <project> --service-account-email <email>
idyl cloud-account connect --name prod-azure --cloud azure --tenant-id <tenant> --subscription-id <subscription> --client-id <client>
```

### `idyl cloud-account get`

Get one connected cloud account, or list the account's connections.

With no argument, lists every connection the account owns. With a 12-digit
cloud account ID, shows that connection: the credential it declares, the
external ID the platform assigned it, and whether the last verification
succeeded.

#### Usage

```bash theme={null}
idyl cloud-account get [cloud-account-id] [flags]
```

#### Aliases

* `list`
* `ls`

#### Flags

| Flag                             | Description                                                                                                        |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| `-o <string>, --output <string>` | Output format: table, json, yaml, or manifest (the resource as a manifest `idyl apply` accepts). Default: `table`. |

#### Examples

```bash theme={null}
idyl cloud-account list
idyl cloud-account get <cloud-account-id>
```