Skip to main content
Connecting your cloud lets Enclave link your code to the resources it runs on. Enclave uses that to tell which issues an attacker can actually reach. This step is optional, but answers and severities are more accurate with it.

​
Connect a provider

Open Settings → Integrations, click Connect next to your provider, and follow its guide.
You need the Owner or Admin role in Enclave, and admin rights in your cloud: for example, permission to create IAM roles in AWS, or to grant roles at your Azure tenant root. Each provider’s guide lists what it needs.
You can connect more than one account or project. Each one is shared with your whole organization.

​
Read-only access

Enclave reads configuration and metadata for compute, networking, data stores, and identities. Enclave can’t:
  • Create, change, or delete anything in your cloud.
  • Read the contents of your storage or databases.
  • Hold long-lived credentials.
You can revoke access at any time from your cloud provider.

​
When Enclave scans

Enclave scans when you connect an account, and once a day after that. To scan now, click Analyze Environment in Coverage.

​
Kubernetes

Enclave can scan a Kubernetes cluster through an agent you install in it. You need Helm and access to the cluster that can create the enclave namespace and install a Helm chart in it.
1

Install the agent

Click Connect next to Kubernetes, copy the install command, and run it against your cluster.
2

Read the enrollment token

Run the kubectl command shown on the page to read the one-time token.
3

Finish the connection

Name the cluster, paste the token, and submit. The cluster appears under Connected clusters.