> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amnify.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect your code and cloud

> What Amnify reads and scans: your code, your cloud and your authorized applications.

A **source** is one connection Amnify reads. A **scope** is one thing inside it that gets scanned on its own. You choose the scopes, and the agents only ever look at what you selected.

| Source              | Scopes                     | Access                                            |
| ------------------- | -------------------------- | ------------------------------------------------- |
| GitHub organization | Repositories               | Read, plus write bounded to opening pull requests |
| AWS connection      | Accounts                   | Read only                                         |
| Azure tenant        | Subscriptions              | Read only                                         |
| GCP connection      | Projects                   | Read only                                         |
| Pentest application | Target hosts and endpoints | Active testing, after you verify domain ownership |

## Selecting scopes

Amnify lists the scopes it can see, all selected. Deselect anything it should leave alone, then save. An unselected scope is never scanned, and produces no findings and no cost. You can change the selection at any time.

## Permissions

Amnify requests only the access its work requires. Cloud sources are read only: Amnify reads how resources are configured and has no access to what is inside them. GitHub is the exception, because delivering a fix means writing to the repository, and that write is bounded to a new branch and a pull request.

You grant the access on your side and can revoke it at any time. Where the provider allows it the grant is keyless, with no long lived secret to hand over. Where you do supply a credential, it is one you own and can rotate.

Each provider is organized into tiers. Tier 1 is the minimum needed to assess a source, and later tiers are optional, widening coverage into the identity layer.

<CardGroup cols={2}>
  <Card title="Azure" icon="https://mintcdn.com/amnify/AL0ypr1pQS1RfxJ6/images/azure.svg?fit=max&auto=format&n=AL0ypr1pQS1RfxJ6&q=85&s=bbfc4558b48f2c66c6b4ef3e5686075e" href="/connect/permissions/azure" width="96" height="96" data-path="images/azure.svg">
    Read only, via the Amnify enterprise application.
  </Card>

  <Card title="AWS" icon="https://mintcdn.com/amnify/AL0ypr1pQS1RfxJ6/images/aws.svg?fit=max&auto=format&n=AL0ypr1pQS1RfxJ6&q=85&s=04651cf36598681e9e9d0d5efb06e1b8" href="/connect/permissions/aws" width="256" height="153" data-path="images/aws.svg">
    Read only, via an assumed scan role.
  </Card>

  <Card title="GCP" icon="https://mintcdn.com/amnify/AL0ypr1pQS1RfxJ6/images/gcp.svg?fit=max&auto=format&n=AL0ypr1pQS1RfxJ6&q=85&s=b515ac5de5565b9f4e57000444332f4e" href="/connect/permissions/gcp" width="256" height="206" data-path="images/gcp.svg">
    Read only, via a service account you own.
  </Card>

  <Card title="GitHub" icon="github" iconType="brands" href="/connect/permissions/github">
    Read, plus bounded write via the Amnify GitHub App.
  </Card>
</CardGroup>

Removing a source stops all access immediately. Existing findings and history stay readable.

<Note>
  Sources are what Amnify **scans**. [Integrations](/connect/integrations) are the tools your team already works in, such as your ticket tracker.
</Note>