Cloud Providers

SKE provisions infrastructure in your cloud account — it never hosts your application or data. To get started, you connect a cloud provider by giving SKE credentials with the required permissions.

Supported providers

Provider	Compute	Registry	Infra provisioning
AWS	Lambda	ECR	CloudFormation
GCP	Cloud Run	Artifact Registry	Native GCP APIs

How it works

1. You create an IAM role (AWS) or service account (GCP) with the permissions SKE needs.
2. You connect it to a workspace via the CLI or dashboard.
3. SKE validates the credentials and checks each permission group.
4. When you deploy or provision infrastructure, SKE assumes the role / uses the service account to act inside your cloud account.

SKE uses temporary credentials where possible. On AWS, it calls sts:AssumeRole with your role ARN and a per-connection External ID to get short-lived session credentials (15–60 min TTL). On GCP, it uses the service account credentials directly.

Provider scope

Cloud providers are scoped to a workspace. A workspace can have multiple providers — for example, one AWS account for production and a separate GCP project for development. Each environment references a specific provider.

Setup guides

• AWS — create an IAM role, configure the trust policy, and connect
• GCP — create a service account, enable required APIs, and connect
• IAM Reference — complete list of required AWS permissions and GCP roles

Validation

When you connect a provider, SKE validates permissions per feature area. Each feature group is checked independently so you can see exactly what works and what needs adjustment:

✓ ecr         Container registry
✓ lambda      Compute
✓ cloudformation  Infrastructure provisioning
✓ ssm         Parameters
✓ s3          Asset storage
✗ rds         Databases — missing rds:CreateDBInstance
✓ logs        Log access

Features with missing permissions still allow connection — the provider works for everything that passed. You can add permissions later and re-validate.