title: CloudSlash - Cloud Providers Reference description: Five official plugins: AWS, GCP, Azure, Kubernetes, and Linode. Each implements the same 5-method gRPC contract. And remember, these are just the built-in pl...

Cloud Providers¶

Five official plugins: AWS, GCP, Azure, Kubernetes, and Linode. Each implements the same 5-method gRPC contract.

And remember, these are just the built-in plugins. Developers have total freedom to build, override, and deploy their own versions of these plugins or entirely new ones to the registry. You are never locked in.

AWS¶

Plugin

Credential Chain¶

The engine evaluates the standard AWS credential chain in the following order:

1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
2. Shared credentials file (~/.aws/credentials)
3. AWS SSO session (aws sso login)
4. IAM instance role (EC2 metadata service)
5. ECS task role

export AWS_PROFILE=production
export AWS_REGION=us-east-1

Scanned Resources¶

22 Types

IAM Verification¶

The engine uses iam:SimulatePrincipalPolicy for formal privilege verification. This catches hidden admin permissions behind innocuous role names that string-matching approaches miss.

# Generate the minimum IAM policy for CloudSlash
cloudslash permissions > cloudslash-policy.json

GCP¶

Plugin

Credential Chain¶

1. GOOGLE_APPLICATION_CREDENTIALS environment variable (service account JSON)
2. Application Default Credentials (gcloud auth application-default login)
3. GCE metadata server (automatic on Compute Engine)

export GOOGLE_APPLICATION_CREDENTIALS="/path/to/sa-key.json"
export CLOUDSDK_CORE_PROJECT="infrastructure-prod-42"

Scanned Resources¶

12 Types

Azure¶

Plugin

Credential Chain¶

1. Environment variables (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID)
2. DefaultAzureCredential (managed identity → CLI login)
3. Azure CLI (az login)

export AZURE_CLIENT_ID="..."
export AZURE_CLIENT_SECRET="..."
export AZURE_TENANT_ID="..."
export AZURE_SUBSCRIPTION_ID="..."

Scanned Resources¶

11 Types

Cross-Provider Topology¶

The daemon deduces cross-provider dependencies deterministically via CIDR block overlap heuristics during ingestion. For example, an AWS Transit Gateway with CIDR 10.0.0.0/16 connected to a GCP VPC with subnet 10.0.1.0/24 produces a FlowsTo edge in the Universal Graph.

The Topology workspace (2) in the TUI visualizes these cross-provider links with egress cost calculations and compliance violation detection.

cs daemon --region us-east-1

Cloud connections are displayed in the TUI with CIDR ranges, provider counts, monthly egress costs, and traffic compliance status.