You can connect more than one source of each provider: several GitHub organizations, GitLab groups, AWS accounts, Azure tenants or GCP service accounts. Once a provider has a connection, its section shows how many are connected, lists them a few at a time with Show more, and adds another with Connect more. The same GitHub organization, GitLab group, AWS account, Azure tenant or service account cannot be connected twice. Scopes are not deduplicated across sources, so if two GCP service accounts can see the same project, select it under only one of them.
Selecting scopes
When a source connects, Amnify opens its scope selection straight away, listing the scopes it can see with nothing selected. Select what it should scan, then save. An unselected scope is never scanned, and produces no findings and no cost. You can change the selection at any time. Your plan sets how many repositories and how many cloud accounts your organization can select. AWS accounts, Azure subscriptions and GCP projects count toward the same cloud account limit. The selection shows the limit, how many are in use and how many remain before you pick anything. Once the limit is reached, nothing more can be selected until you deselect a scope or the limit is raised, which for most organizations means an owner choosing a bigger plan from Billing.Permissions
Amnify requests only the access its work requires. Cloud sources are read only: Amnify reads how resources are configured and has no access to what is inside them. GitHub and GitLab are the exception, because delivering a fix means writing to the repository, and that write is bounded to a new branch and a pull request, or a merge request on GitLab. You grant the access on your side and can revoke it at any time. Where the provider allows it the grant is keyless, with no long lived secret to hand over. Where you do supply a credential, such as a GitLab service account token, it is one you own and can revoke. Each provider is organized into tiers. Tier 1 is the minimum needed to assess a source, and later tiers are optional, widening coverage into the identity layer.
Azure
Read only, via the Amnify enterprise application.
AWS
Read only, via an assumed scan role.
GCP
Read only, via a service account you own.
GitHub
Read, plus bounded write via the Amnify GitHub App.
GitLab
Read, plus bounded write via a service account you create.
Sources are what Amnify scans. Integrations are the tools your team already works in, such as your ticket tracker.