Connect Your Cloud

SkaleData deploys infrastructure inside your cloud account. The skale CLI handles the entire setup — it detects your active cloud session, creates the deployer role, verifies the connection, and registers it with SkaleData.

Install the CLI


brew install skaledata/tap/skale
skale auth login

Connect your cloud

Prerequisites

An AWS account with admin access
AWS CLI installed and authenticated — the setup command runs against your active AWS session, so you must be logged in first:


# SSO-based auth
aws sso login
 
# Or configure with access keys
aws configure

Important: The person running skale clouds setup must have an active, authenticated AWS CLI session with permissions to create IAM roles and policies. This is typically an account administrator.

Run setup


skale clouds setup --provider aws

The CLI will:

Detect your AWS account ID and region from the active CLI session
Create the SkaleDataDeployer IAM role
Verify that SkaleData can assume the role
Register the cloud connection


Cloud connected!  AWS — 123456789012 (verified)

Next step:
  skale clusters create --cloud <cloud-id>

What gets created

An IAM role (SkaleDataDeployer) with the following managed policies:

Policy	Purpose
`AmazonEC2FullAccess`	VPC, subnets, security groups, instances
`AmazonS3FullAccess`	DAG storage buckets
`AmazonEC2ContainerRegistryFullAccess`	Container image registry
`IAMFullAccess`	Create per-app IAM roles (IRSA)
`CloudWatchFullAccess`	Monitoring and logging
`AmazonSSMReadOnlyAccess`	Parameter store lookups

Plus an inline policy for:

Permission	Purpose
`eks:*`	EKS cluster lifecycle
`route53:*`	DNS records for data plane routing
`kms:*`	Encryption key management
`elasticloadbalancing:*`	Load balancers for ingress

No long-lived credentials are stored. SkaleData uses OIDC federation to assume the role with short-lived tokens.

Default configuration

Setting	Value
Cluster type	EKS
Default node size	`m5.xlarge` (4 vCPU, 16 GB)
Node autoscaling	1–5 nodes
DAG storage	S3 bucket

Prerequisites

A GCP project with billing enabled
gcloud CLI installed and authenticated — the setup command runs against your active gcloud session, so you must be logged in first:


gcloud auth login
gcloud config set project your-project-id

Important: The person running skale clouds setup must have an active, authenticated gcloud session with Owner or Editor role on the target project. This is typically a project administrator.

Run setup


skale clouds setup --provider gcp

You can also specify the project directly:


skale clouds setup --provider gcp --project-id my-project

The CLI will:

Detect your GCP project ID from gcloud config
Create the skaledata-deployer service account and Workload Identity Federation pool
Verify that SkaleData can impersonate the service account
Register the cloud connection


Cloud connected!  GCP — my-project (verified)

Next step:
  skale clusters create --cloud <cloud-id>

What gets created

A service account (skaledata-deployer) with the following IAM roles:

Role	Purpose
`roles/container.admin`	GKE cluster lifecycle
`roles/compute.admin`	VPC, firewall rules, instances
`roles/iam.serviceAccountAdmin`	Create per-app service accounts
`roles/iam.serviceAccountKeyAdmin`	Manage SA keys for local dev
`roles/iam.workloadIdentityPoolAdmin`	Workload Identity Federation
`roles/storage.admin`	GCS buckets for DAGs and state
`roles/secretmanager.admin`	Secrets backend for apps
`roles/artifactregistry.admin`	Container image registry
`roles/resourcemanager.projectIamAdmin`	IAM policy bindings
`roles/serviceusage.serviceUsageAdmin`	Enable required GCP APIs
`roles/monitoring.admin`	Cloud Monitoring metrics
`roles/iam.serviceAccountUser`	Act as service accounts

No long-lived keys are stored. SkaleData uses Workload Identity Federation for short-lived credentials.

Default configuration

Setting	Value
Cluster type	GKE Standard
Default node size	`e2-standard-4` (4 vCPU, 16 GB)
Node autoscaling	1–5 nodes
DAG storage	GCS bucket

Prerequisites

An Azure subscription
Azure CLI (az) installed and authenticated — the setup command runs against your active Azure session, so you must be logged in first:


az login

Important: The person running skale clouds setup must have an active, authenticated Azure CLI session with Contributor role and permissions to create app registrations. This is typically a subscription administrator.

Run setup


skale clouds setup --provider azure

The CLI will:

Detect your Azure subscription ID and tenant ID from az account show
Create the SkaleData Deployer app registration and service principal
Verify that SkaleData can authenticate via federated credentials
Register the cloud connection


Cloud connected!  Azure — a1b2c3d4 (verified)

Next step:
  skale clusters create --cloud <cloud-id>

What gets created

An app registration (SkaleData Deployer) and service principal with:

Role / Permission	Scope	Purpose
`Contributor`	Subscription	AKS, networking, storage, DNS
`User Access Administrator`	Subscription	Assign roles to per-app identities
`Application.ReadWrite.All` (Graph API)	Tenant	Temporary app passwords for local dev

The setup script also:

Creates a skaledata-deployer resource group
Registers required resource providers (Microsoft.ContainerService, Microsoft.Network, Microsoft.Storage, Microsoft.ContainerRegistry)
Sets up OIDC federated credentials so SkaleData can authenticate from GCP without stored secrets

No long-lived credentials are stored. SkaleData uses federated identity credentials for short-lived tokens.

Default configuration

Setting	Value
Cluster type	AKS
Default node size	`Standard_D4s_v3` (4 vCPU, 16 GB)
Node autoscaling	1–5 nodes
DAG storage	Azure Blob Storage

Useful commands


# List connected clouds
skale clouds list
 
# Re-verify a connection
skale clouds verify <cloud-id>
 
# Create a cluster on this cloud
skale clusters create --cloud <cloud-id>