Open the Add a Source wizard

There are two ways in:

• On Home, a new account sees See Your Infrastructure in Kumo.io. Select Connect infrastructure.
• In the sidebar, open Connections › Cloud Connections and select Add a Source.

Both open the same wizard. If you only want to look around first, the wizard also offers Explore Sample Data. See Try Kumo.io with sample data.

Step 1: choose a provider

Under 1 · Choose a Provider, pick one of:

The rest of this page walks through AWS with a cross-account role, the recommended path. The other providers ask for the fields listed in the table and then follow the same connect-and-sync steps.

Step 2: create the read-only AWS role

For AWS, 2 · How Should Kumo.io Authenticate? offers:

• Cross-account role (recommended): Kumo.io assumes a read-only IAM role in your account, so no long-lived keys leave it.
• Access key: an IAM user's access key and secret. Prefer a read-only user.
• Runtime identity (advanced): self-hosted only. Kumo.io crawls as the identity its own deployment already runs with, such as an instance profile or task role. It is offered only when Kumo.io detects such an identity, and hosted Kumo.io never accepts it.

With Cross-account role (recommended) selected, the Stand Up the Read-Only Role panel appears:

1. Note the external ID Kumo.io generated for this connection. It is built into the template, and it stops anyone else from pointing Kumo.io at your role. It stays the same until this connection succeeds, even if you reload the page or come back later from another browser.
2. Pick a Region for the stack, then select Copy Template and Open CloudFormation console.
3. In the AWS console, create a stack from the template you copied. It creates one IAM role, KumoReadOnlyRole. The role trusts Kumo.io's AWS account, requires your external ID, and has the AWS-managed ReadOnlyAccess policy attached.
4. When the stack finishes, copy the RoleArn value from the stack's Outputs.

Kumo.io also publishes a narrower read-only policy that lists 144 individual read actions. If your security team prefers it to ReadOnlyAccess, attach it to the role instead.

Step 3: paste the role ARN and connect

Under 3 · Paste the Role ARN:

1. Paste the ARN into Role ARN. It looks like arn:aws:iam::123456789012:role/KumoReadOnlyRole.
2. Optionally give the source a Name, under Advanced Options. The default is the provider name, plus the account if one is given.
3. Choose the Workspace the estate syncs into. If you have no workspace yet, Kumo.io creates one named "Default workspace".
4. Select Test Connection to check the role before you commit. Kumo.io shows the identity it connects as, and the accounts the credential can see.
5. Select Connect Source.

Kumo.io stores the credential, discovers the account behind it, creates the source, and starts the first sync. You don't have to choose scopes first. To learn how to narrow what a workspace sees later, read Workspaces and scopes.

Watch the first sync

After Connect Source, Kumo.io takes you straight to the Sync Run page. Its progress strip moves through Queued, Syncing sources, Composing snapshot and Done, and shows how many sources have synced so far. The Sync Log panel streams what the sync is doing while it runs.

You can leave the page. Every run is listed under Activity › Runs, and Home shows Watch the sync while the first one is still going.

If the first sync couldn't start, the wizard says so and links to View Activity. Start it yourself from the workspace with Sync Now.

Open your first diagram

When the run succeeds, or partly succeeds, the Sync Run page shows Snapshot Ready: "Kumo.io composed your infrastructure snapshot and generated diagrams automatically." Select Open Diagram →.

If the diagrams are still being generated, the button reads Browse Diagrams → instead. All diagrams are under Inventory › Diagrams, and Inventory › Resources lists everything the sync found.

That first sync sealed your first revision, the start of your timeline. From now on, Kumo.io syncs the workspace on your plan's schedule (every 6 hours on Team, for example), and you can run Sync Now whenever you want a fresh revision sooner. How syncing works explains when Kumo.io reads your cloud and the limits on how often you can sync.

During a trial, diagrams are shown blurred and can't be exported or shared. Full diagrams start when you subscribe to Team or above.

Next steps

• Invite your team
• Environments: how Kumo.io groups what it found.
• Views and diagrams: the diagrams Kumo.io draws for you.