Cloud
Query AWS, GCP, or Azure through a Plural cloud connection
Use the Cloud integration to give a workbench read-only SQL access to the resources in an AWS account, GCP project, or Azure subscription. The tool is backed by a cloud connection, which stores the provider credentials, and by Plural's cloud query service, which exposes cloud resources as Steampipe tables. After you configure the tool once, you can attach it to one or more workbenches and ask questions about your cloud inventory and configuration in natural language.
This guide uses the Plural Console UI. For the complete list of integrations and general tool behavior, see Workbench tools.
Prerequisites
Before you begin, make sure you have:
- An AWS account, GCP project, or Azure subscription to query, and read-only credentials for it. See Provider credentials.
- A cloud connection for that account, or admin access in Plural Console to create one.
- Permission in Plural Console to create a configured tool and edit the target workbench.
- An existing workbench, or permission to create one. See Setting up a workbench.
Provider credentials
Each cloud connection holds credentials for one provider:
Provider | Credentials | Recommended access |
|---|---|---|
| AWS | Optional access keys, optional region, optional role to assume | ReadOnlyAccess, or a narrower read-only policy |
| GCP | Project ID and a service account key | roles/viewer on the project, or narrower read-only roles |
| Azure | Subscription, tenant, client ID, and client secret of a service principal | Reader on the subscription |
For AWS, Plural can authenticate in two ways:
- Ambient identity. Leave the access keys empty and Plural's cloud query service uses its own AWS identity, such as a workload identity (IRSA or EKS Pod Identity) on a self-hosted install.
- Access keys. Enter an access key ID and secret for a dedicated IAM user.