Frequently asked questions
Answers to common Cushy questions: read-only access, supported clouds, the empty-to-real cutover, enumeration safety, lockout, API tokens and cost data.
Common questions about how Cushy works. If your question is about a specific failure, see Troubleshooting.
Does Cushy need write access to my cloud accounts?
Not by default. Connections are read-only, using short-lived assumed credentials (cross-account role / workload-identity federation) — no long-lived keys are ever stored. Real Terraform provisioning is a separate, explicit per-account opt-in: only when you enable it (with an acknowledgement) can an approved apply create resources, using freshly-minted short-lived write credentials that are never stored.
Which clouds are supported today?
All four — AWS, GCP, Azure and Alibaba Cloud — have real, keyless connection adapters: inventory sync, network topology, cost and deploy blueprints. Azure uses Entra federated credentials (no client secret); Alibaba uses a RAM OIDC provider with AssumeRoleWithOIDC (no AccessKeySecret).
What does a brand-new organization look like before I connect a cloud account?
Cushy runs only real environments — there is no demo dataset. A never-connected organization shows an honest empty state on every screen with a 'Connect a cloud account' call-to-action, until your first connection turns healthy and real data flows in.
Why is a section still empty after I connected an account?
The empty-to-real cutover fires only when a connection first reaches healthy. If a section is still empty, the connection is probably still connecting/warning/error, or its first sync has not finished. Check the connection health on Cloud accounts and click Verify.
How is authentication kept safe from account enumeration?
Wrong-email and wrong-password sign-ins return the identical message; password reset returns the same response whether or not the address exists; SSO start returns the same 404 for an unknown org or one with no SSO; and hidden surfaces return 404 rather than 403. Cross-organization ids also return 404 everywhere.
What happens after too many failed sign-ins?
Five failed attempts for the same email lock sign-in for 15 minutes with a 429 (and a Retry-After header). The same cap applies to wrong MFA codes per user. A successful password reset clears the counter for that email.
Can API tokens do everything I can?
No. A token carries a role as its capability ceiling that can never exceed the creator's own capabilities, and it never confers owner or platform-admin powers. Tokens also can't manage tokens — token administration requires a signed-in session.
Is the cost data real?
The FinOps core is real: native billing is normalized to the FOCUS standard (reconciling to source to the cent), with spend by cloud/service/tag, budgets and statistical anomaly detection. Optimization recommendations, price comparison, chargeback export and multi-currency are on the roadmap.
How do I fully remove Cushy's access to a cloud account?
Disconnect the account in Cushy (which stops sync and marks rows disconnected, never purging them), then delete the IAM role or workload identity federation config in your cloud account to revoke the trust entirely.