Cloud Accounts

Save cloud provider details and encrypted credentials for deployment and network setup

Save cloud account IDs, VPC details, and credentials once for reuse across the platform. VPC Peering, PrivateLink, and BYOC use saved accounts to fill setup fields.

Overview

Each saved cloud account belongs to a tenant. The platform encrypts provider-specific credentials at rest. You can filter accounts by provider or region.

Creating a Cloud Account

From the Console

Open the tenant's Settings page.
Open Cloud Accounts and click Add Cloud Account.
Select the provider, such as AWS.
Enter a unique name of 1-100 characters and the cloud account ID.
If needed, select a default region.
Enter provider-specific credentials, such as an AWS IAM role ARN, in Settings.
Add optional remarks of at most 500 characters.
Click Save.

Supported Cloud Providers

Provider	Value	Status
AWS	`aws`	Available
GCP	`gcp`	Available

AWS Settings

Supply the AWS configuration in this format:

{
  "aws": {
    "identity_arn": "arn:aws:iam::123456789012:role/LaserDataRole",
    "external_id": "unique-external-id",
    "vpc_id": "vpc-0abc123def456",
    "vpc_cidr": "10.0.0.0/16"
  }
}

Field	Required	Description
`identity_arn`	Yes	IAM role ARN that LaserData assumes for provisioning
`external_id`	Yes	External ID for secure cross-account role assumption
`vpc_id`	Yes	VPC ID where infrastructure will be provisioned
`vpc_cidr`	No	CIDR block of the VPC (used for network planning)

GCP Settings

Supply the GCP configuration in this format:

{
  "gcp": {
    "vpc_network": "my-vpc-network",
    "vpc_cidr": "10.128.0.0/20"
  }
}

Field	Required	Description
`vpc_network`	No	VPC network name for infrastructure provisioning
`vpc_cidr`	No	CIDR block of the VPC (used for network planning)

The database encrypts this configuration at rest.

Account Status

Status	Description
`active`	Account is active and can be used for deployments
`inactive`	Account is inactive
`locked`	Account is locked
`deleted`	Account has been deleted

Permissions

Managing cloud accounts requires tenant-level settings:manage. Reading them requires settings:read. See Roles & Permissions.

Plan Limits

Resource	Basic	Pro	Enterprise
Cloud accounts	1	5	10

API Reference

Create a Cloud Account

curl -X POST https://api.laserdata.cloud/tenants/{tenant_id}/cloud_accounts \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "cloud": "aws",
    "name": "production-aws",
    "account_id": "123456789012",
    "region": "us-west-1",
    "settings": {
      "aws": {
        "identity_arn": "arn:aws:iam::123456789012:role/LaserDataRole",
        "external_id": "unique-external-id",
        "vpc_id": "vpc-0abc123def456",
        "vpc_cidr": "10.0.0.0/16"
      }
    },
    "remarks": "Main production AWS account"
  }'

Field	Required	Description
`cloud`	Yes	Cloud provider: `aws`, `gcp`
`name`	Yes	Unique name (1-100 chars)
`account_id`	Yes	Cloud provider account ID (max 256 chars)
`region`	No	Default region for this account
`settings`	No	Cloud-specific credentials (see AWS Settings)
`remarks`	No	Notes (max 500 chars)

A successful request returns 201 Created.

List Cloud Accounts

curl "https://api.laserdata.cloud/tenants/{tenant_id}/cloud_accounts?page=1&results=10" \
  -H "ld-api-key: YOUR_API_KEY"

Use these query parameters to filter the list:

Parameter	Type	Description
`page`	integer	Page number (optional)
`results`	integer	Results per page (optional)
`name`	string	Filter by name (contains match, optional)
`cloud`	string	Filter by cloud provider (optional)
`region`	string	Filter by region (contains match, optional)

The response lists the newest accounts first:

{
  "total_pages": 1,
  "total_results": 2,
  "page": 1,
  "items": [
    {
      "id": 1,
      "cloud": "aws",
      "name": "production-aws",
      "account_id": "123456789012",
      "region": "us-west-1",
      "validated_at": null,
      "status": "active",
      "created_at": "2026-06-01T10:00:00Z",
      "updated_at": "2026-06-01T10:00:00Z"
    }
  ]
}

Get Cloud Account Details

curl https://api.laserdata.cloud/tenants/{tenant_id}/cloud_accounts/{cloud_account_id} \
  -H "ld-api-key: YOUR_API_KEY"

{
  "id": 1,
  "cloud": "aws",
  "name": "production-aws",
  "account_id": "123456789012",
  "region": "us-west-1",
  "status": "active",
  "created_at": "2026-06-01T10:00:00Z",
  "updated_at": "2026-06-01T10:00:00Z",
  "settings": {
    "aws": {
      "identity_arn": "arn:aws:iam::123456789012:role/LaserDataRole",
      "external_id": "unique-external-id",
      "vpc_id": "vpc-0abc123def456",
      "vpc_cidr": "10.0.0.0/16"
    }
  },
  "remarks": "Main production AWS account"
}

Details include settings and remarks. List responses omit these fields.

Update a Cloud Account

curl -X PUT https://api.laserdata.cloud/tenants/{tenant_id}/cloud_accounts/{cloud_account_id} \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "production-aws-updated",
    "region": "us-west-2",
    "status": "active"
  }'

Include only fields that you want to change. To clear an optional field, set it to null.

Field	Type	Description
`name`	string	New name (must be unique within the tenant)
`account_id`	string	Updated cloud account ID
`region`	string or null	Updated region, or `null` to clear
`settings`	object or null	Updated credentials, or `null` to clear
`remarks`	string or null	Updated notes, or `null` to clear
`status`	string	Account status: `active`, `inactive`, `locked`, `deleted`

A successful request returns 204 No Content.

Delete a Cloud Account

Deletion permanently removes the saved cloud account and cannot be undone.

curl -X DELETE https://api.laserdata.cloud/tenants/{tenant_id}/cloud_accounts/{cloud_account_id} \
  -H "ld-api-key: YOUR_API_KEY"