> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amnify.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud Source Permissions

> What access Amnify requests when you connect a cloud source, and why.

When you connect a source, Amnify requests the access it needs to assess that source's security posture — and, for GitHub, to prepare fixes for you to review. This section explains what Amnify requests for each provider and why.

Two principles hold across every provider:

* **Least privilege.** Amnify requests only the access its work requires. For the cloud providers that means strictly **read-only** access — Amnify reads resource and identity configuration to assess posture and never creates, modifies, or deletes anything. **GitHub is the exception:** to deliver fixes it also needs write access, but that write is tightly bounded. Amnify only ever opens a **pull request** for you to review — it never pushes to your default branch, and nothing merges without your approval.
* **Customer-granted and revocable.** You grant access to Amnify on your side and can revoke it at any time. Wherever the provider allows it the grant is keyless, with no long-lived secret to hand over; where you do supply a credential, it is one you control and can rotate or revoke.

Amnify organizes each provider into **tiers**. Tier 1 is the minimum needed to assess a source. Later tiers are optional and widen coverage, for example into the identity layer.

<CardGroup cols={2}>
  <Card title="Azure" icon="https://mintcdn.com/amnify/AL0ypr1pQS1RfxJ6/images/azure.svg?fit=max&auto=format&n=AL0ypr1pQS1RfxJ6&q=85&s=bbfc4558b48f2c66c6b4ef3e5686075e" href="/agent/permissions/azure" width="96" height="96" data-path="images/azure.svg">
    Read-only access via Amnify Enterprise Application.
  </Card>

  <Card title="AWS" icon="https://mintcdn.com/amnify/AL0ypr1pQS1RfxJ6/images/aws.svg?fit=max&auto=format&n=AL0ypr1pQS1RfxJ6&q=85&s=04651cf36598681e9e9d0d5efb06e1b8" href="/agent/permissions/aws" width="256" height="153" data-path="images/aws.svg">
    Read-only access via an AssumeRole.
  </Card>

  <Card title="GCP" icon="https://mintcdn.com/amnify/AL0ypr1pQS1RfxJ6/images/gcp.svg?fit=max&auto=format&n=AL0ypr1pQS1RfxJ6&q=85&s=b515ac5de5565b9f4e57000444332f4e" href="/agent/permissions/gcp" width="256" height="206" data-path="images/gcp.svg">
    Read-only access via a Service Account.
  </Card>

  <Card title="GitHub" icon="github" href="/agent/permissions/github">
    Read and write via Amnify GitHub App.
  </Card>
</CardGroup>