Connections

Flows can be executed without direct access to cloud resources, but some flows may create, modify, or delete cloud resources. A flow's access to cloud resources is controlled using connections. Connections contain the necessary roles and permissions that allow the flow to perform its actions on the cloud.

Note

For organizations onboarded through DoiT PartnerOps, GCP CloudFlow connections are unavailable. The GCP provider tab and its connection creation options are not displayed on the Connections page.

Furthermore, depending on your permissions, you can control who can create connections and flows. This separation allows you to:

• Enforce the principle of least privilege, giving a user permission to build and create connections and flows without granting them access to your cloud resources.

• Separate the role of flow developer from cloud resource manager. A flow developer can focus on the business logic of the flow, while a DevOps or FinOps team can manage and audit the connections and permissions that the flow uses.

• Streamline the process of updating permissions. If a flow needs a new permission, the security team can update the connection that the flow uses without affecting the user who created it. This also makes it easier to reuse connections and permissions across multiple flows. Instead of managing permissions for each individual flow, you can manage permissions for a single connection and then use that connection in multiple flows.

For example, your FinOps Head is responsible for setting up the necessary connections. The FinOps Head then delegates control by granting the Technical Leads access to the connections. The Technical Leads use the connections when they are building their flows for their teams. The Technical Leads invite other users to use the flows, without having to give them access to the underlying connections.

Access levels

There are three connection access levels, Owner, Editor, User. You assign access levels when you create your connections. The following table describes the connection permissions associated with each access level.

Permissions	Owner	Editor	User
Create	✓	✓
Access	✓	✓	✓
Edit	✓	✓
Delete	✓

Furthermore, depending on your access level to connections, you can transfer ownership or share connections with others in your tenant.

Permissions hierarchy

The CloudFlow and connections permissions model is based on permissions and access levels.

A flow may or may not include a connection. All connections must be configured with cloud provider roles and permissions which are used to authorize actions on your behalf with your cloud provider.

The following diagram describes the relationship between CloudFlow and connection permissions and access levels.

Configure connections

There are two stages to configuring connections.

1. Create a connection. You can either:

   • Create from existing permissions: Reuse permissions for connected AWS accounts, Azure tenants, GCP resources, or OCI Assets. This is the only way to create Oracle Cloud connections. For provider-specific setup, see Oracle Cloud connection.

   • Create a new cloud connection: Create an AWS, Azure, or GCP connection, depending on the cloud resources your flow is accessing. Select this if you want to define scope, policies, and deploy IAM roles, applications, or service accounts for the connection. You can assign access to other DoiT users in User access.

   • Create an Admin API connection: Create an OpenAI or Anthropic Admin API connection so your flows can call provider administration APIs. These connections are independent of cloud IAM roles and of the OpenAI and Anthropic billing integrations.

   Select Create connection from existing permissions when accounts, tenants, or resources are already connected to Cloud Intelligence and you only need a connection for flows. Oracle Cloud connections always use this option. Select Create connection for AWS, Azure, or GCP when you need a dedicated CloudFlow IAM role, application, or service account, custom scope, or separate policies.

2. Add a connection. Finally, when configuring your flows, add the connections as necessary. Connections can be used at both flow and node-level.