Skip to main content

Get Started

Use this guide to register a trial account with Cloudaware and connect cloud accounts.

Before You Begin​

  • Confirm that you have the permissions required to add cloud accounts to Cloudaware.

Register a Trial Account with Cloudaware​

To get a Cloudaware trial account:

  1. Go to the Create Account Page.

    • You can continue with Google or register with your work email. Email registration is recommended for corporate accounts.

  2. In the Cloudaware Control Hub, select the boxes that match your trial goals. Click Continue.

  3. Add your profile information, then click Continue.

  4. Click Connect infrastructure, then select your preferred cloud provider:

    Follow the setup instructions for the selected cloud provider.

  5. After Cloudaware validates your cloud account, the trial registration is submitted.

tip

Check your inbox for the Registration Complete email. Registration may take up to 1 hour.

Connect Cloud Accounts​

Some providers require setup in the cloud console before you complete the Cloudaware form.

AWS​

note

Connect AWS accounts using IAM roles whenever possible.

In the Cloudaware Control Hub:

  1. Select Connect AWS.
  2. Enter an AWS account name.
  3. Choose an authentication method:
    • IAM Role — recommended, uses a cross-account role with an External ID.
    • Access & Secret Keys — uses a dedicated IAM user with access keys.

For IAM Role​

  1. In the External ID section, click Generate External ID (crossed arrows icon near the field).
  2. Select the CloudFormation launch option:
    • Click this pre-generated template to open a pre-generated CloudFormation template in the AWS console for quick launch.
    • Click this template to download the CloudFormation template and create a stack manually.
    • Proceed in the AWS console as described below.
  3. Select AWS partition (aws for public AWS cloud, aws-us-gov for AWS GovCloud).
tip

Cloudaware also supports the AWS China partition. Authenticate using Access & Secret Keys.

In the AWS console:

Quick launch

  1. On the Create stack page that opens, review the template details. The Amazon S3 URL is pre-selected as the template source.
  2. Click Next and proceed to Stack Parameters.
  3. Specify the stack parameters:
    • Stack name: Enter a descriptive stack name.
    • CloudAware Role ARN: Enter CloudAware.aws.
    • CloudAware Role Name: Enter a descriptive role name, e.g., CloudawareRole.
    • External ID: Paste the External ID generated in Cloudaware.
  4. Optional. Configure tags, stack failure options, and additional settings.
  5. On the next page, acknowledge IAM resource creation and click Next.
  6. On the next page, review the stack settings and click Submit to create the stack.
  7. After the stack deployment completes, open the stack Outputs tab.
  8. Copy the IAM Role ARN for further setup in Cloudaware.

Manual creation

  1. Open the AWS console and navigate to CloudFormation.
  2. Click Create stack → With new resources (standard).
  3. In Specify template, choose Upload a template file and upload the CloudFormation template downloaded from Cloudaware.
  4. Click Next and proceed to Stack Parameters.
  5. Specify the stack parameters:
    • Stack name: Enter a descriptive stack name.
    • CloudAware Role ARN: Enter CloudAware.aws.
    • CloudAware Role Name: Enter a descriptive role name, e.g., CloudawareRole.
    • External ID: Paste the External ID generated in Cloudaware.
  6. Optional. Configure tags, stack failure options, and additional settings.
  7. On the next page, acknowledge IAM resource creation and click Next.
  8. On the next page, review the stack settings and click Submit to create the stack.
  9. After the stack deployment completes, open the stack Outputs tab.
  10. Copy the IAM Role ARN for further setup in Cloudaware.

Return to the AWS setup form in Cloudaware:

  1. Paste the IAM Role ARN into the form.
  2. Click Continue to validate credentials.
  3. Click Save.
tip

For large environments, onboard the management account first and use AWS Organizations with StackSets to discover member accounts.

For Access & Secret Keys​

  1. Click Cloudaware IAM policies.
  2. Download all base access Collector policies (Part #1-5).

In the AWS console:

  1. Go to IAM → Policies.
  2. Click Create Policy.
  3. Create custom policies using the downloaded files:
    • Switch to the JSON tab.
    • Paste the collector policy Part #1 JSON and save.
    • Repeat for each collector policy.
  4. Go to IAM → IAM Users:
    • Create a user or select the existing one.
    • In Set Permissions, select Attach policies directly and filter by Customer managed type
    • Assign the custom (collector) policies to the user.
    • Create an Access key. Copy and save the Secret access key, as it can’t be retrieved later.

Return to the AWS setup form in Cloudaware:

  1. Paste the user access & secret access keys into the form.
  2. Click Continue to validate credentials.
  3. Click Save.

After Cloudaware validates the AWS account, the trial registration is submitted.

Microsoft Azure​

In the Azure portal:

  1. Register the Azure application for Cloudaware:

    • From the Azure portal home page, search for and select App registrations → New registration
    • Set the application values:
      • Name: Enter a descriptive name, for example, cloudaware-api-access.
      • Supported account types: Select Single tenant only - Default Directory (Accounts in this organizational directory only) or Multiple Entra ID tenants (Accounts in any organizational directory)(in this case, specify allowed tenant IDs manually).
      • Redirect URI (optional): Select Web and enter https://cloudaware.com.
    • Click Register.

  2. On the application Overview page, copy and save the following values:

    • Application (client) ID
    • Directory (tenant) ID

  3. Add API permissions and grant admin consent:

    • In the left pane under Manage, select the API permissions tab → Add a permission.
    • Add the following permissions:
      • Azure Service Management:
        • Delegated permissions: user_impersonation → Add permissions
      • Microsoft Graph:
        • Delegated permissions: Directory → Directory.Read.All → Add permissions
        • Application permissions: Directory → Directory.Read.All → Add permissions
      • Click Grant admin consent for [directory name] → Yes.
    note

    Without admin consent, the API permissions are not granted, and the application cannot read Azure AD data.

    If the Grant admin consent button is disabled, the signed-in account lacks sufficient Microsoft Entra permissions. Ask a Global Administrator or Privileged Role Administrator to grant tenant-wide admin consent for the application.

    If grant consent fails with the error "This application requires application permissions to another application. Consent for application permissions can only be performed by an administrator", sign out and sign in as an administrator. If you are not an administrator, ask a tenant admin with Global Administrator or Privileged Role Administrator to open this app registration and click Grant admin consent for [directory name].

  4. Create a client secret:

    • In the left pane, go to Certificates & secrets.
    • Click + New client secret to create a client secret:
      • Description: Enter a meaningful name, e.g., ca-api-key.
      • Expires: Select 730 days (24 months) or set a custom expiration period.
      • Click Add.
    • Copy and save the client secret Value.
    note

    Copy the client secret Value, not the Secret ID. The Value is displayed only once and cannot be retrieved later.

  5. Assign the Reader role:

    • To assign access at the management group level:

      • From the Azure portal home page, search for and select Management groups.
      • Select the tenant root management group.
      Can't see or select management groups?

      It means you don't have permission to access this level. Workaround:

      • From the Azure portal home page, go to Microsoft Entra ID.
      • On the Properties tab, under Access management for Azure resources, set the toggle to Yes.
      • Log out of the Azure portal and log in.
      • In the left pane under Manage, select the Access Control (IAM) tab. Assign the Reader role to Tenant Root Group.
      • Go back to Microsoft Entra ID → Properties. Under Access management for Azure resources, set the toggle to No.

      To learn more, refer to the Microsoft documentation.

      • In the left pane under Manage, go to the Access Control (IAM) tab. Click + Add → Add role assignment.
      • Assign the Reader role to the Cloudaware application:
        • On the Role tab, find the Reader role in the list. Click Next.
        • On the Members tab, leave User, group, or service principal selected. Click + Select members.
        • Start typing the name of the Cloudaware application, e.g., cloudaware-api-access, and select it in the list. Click Select.
        • Click Review + assign → Review + assign.

    • To assign access at the subscription level:

      • From the Azure portal home page, search for and select Subscriptions.
      • Choose the target subscription.
      • In the left pane under Manage, select the Access Control (IAM) tab. Click + Add → Add role assignment.
      • Assign the Cloudaware application the Reader role:
        • On the Role tab, find the Reader role in the list. Click Next.
        • On the Members tab, leave User, group, or service principal selected. Click + Select members.
        • Start typing the name of the Cloudaware application, e.g., cloudaware-api-access, and select it in the list. Click Select.
        • Click Review + assign → Review + assign.
    note

    Microsoft Entra ID roles, such as Global Administrator, do not automatically grant permission to assign Azure RBAC roles. To assign the Reader role, you need Owner or User Access Administrator permissions at the subscription or management group level.

  6. From the Azure portal home page, go to Microsoft Entra ID → Overview. Copy and save the Name value.

Return to the Azure setup form in Cloudaware:

  1. Select Connect Azure.
  2. Fill out the setup form:
    • Subscription Name: Enter the Azure subscription name.
    • Subscription ID: Enter the Azure subscription ID.
    • Active Directory Name: Enter the Microsoft Entra ID Name. To find it, go to Microsoft Entra ID → Overview, then copy the Name value.
    • Active Directory ID (Tenant ID): Enter the Directory (tenant) ID copied from the Cloudaware application Overview page.
    • Application ID (Client ID): Enter the Application (client) ID copied from the Cloudaware application Overview page.
    • Environment: Leave as Azure, unless the subscription is in another Azure cloud, such as Government, China, or Germany.
    • Client Secret: Enter the saved client secret value generated for the Cloudaware application.
  3. Click Continue to validate credentials.
  4. Click Save.

After Cloudaware validates the Azure subscription, the trial registration is submitted.

Google Cloud​

In the Google Cloud console:

  1. Create a dedicated service account for Cloudaware:
    • Select the Google Cloud project you want to connect to Cloudaware.
    • Go to IAM & Admin → Service accounts. Click + CREATE SERVICE ACCOUNT.
    • Enter a service account name. Click Create and continue.
  2. Assign the Viewer role for the target Google Cloud project:
    • In the Permissions section, click the Select a role field.
    • In the drop-down list, select Project in the left list, then select Viewer in the right list. Click Continue.
    • Optional. In the Principals with access section, add users if needed.
    • Click Done.
  3. Create and download the service account JSON key:
    • Find the created service account in the list. Click the three-dot menu → Manage keys.
    • Click Add key → Create new key.
    • Select JSON → click Create. The JSON key file is downloaded automatically. Save the key file in a secure location because it is required for further setup in Cloudaware.
  4. Enable APIs for the target Google Cloud project (where the service account for Cloudaware was created):
    • Use the console search bar to find and select APIs & Services.
    • Click + ENABLE APIS AND SERVICES. Find and enable the following APIs:
      • Compute Engine API
      • Identity and Access Management (IAM) API
      • Cloud Resource Manager API
      • Kubernetes Engine API (optional; required for Google Kubernetes Engine (GKE))
      • Cloud Billing API (optional; required for Google Billing)
note

Enabling APIs may take several minutes.

Return to the GCP setup form in Cloudaware:

  1. Select Connect GCP.
  2. Enter the service account name.
  3. Click Load credentials from file to upload the service account key file.
  4. Click Continue to validate credentials.
  5. Click Save.

Oracle Cloud​

In the Cloudaware Control Hub:

  1. Select Connect Oracle.
  2. Click Continue.
tip

After you click Continue, Cloudaware processes the request and notifies you when the trial account is ready.

Alibaba Cloud​

Cloudaware also integrates with Alibaba Cloud. To connect Alibaba Cloud inventory, register for a trial by adding other cloud provider inventory, and then add Alibaba Cloud accounts from the Cloudaware Admin Console.

note

If you need help during onboarding, contact Cloudaware Support in the chat (question mark icon in the lower right corner) or via email support@cloudaware.com.

Confirm Access to the Trial Account​

After Cloudaware provisions your account, log in and confirm access to:

Next Steps​