formae connect registers a cloud account against your hosted installation and
establishes the trust that lets the agent act in it. Trust is federated: the
installation exchanges a short-lived identity token for cloud credentials at
call time. No long-lived key is created, stored, or rotated.
This command needs a hosted profile. Sign in with formae login --hosted first.
If you work through an AI assistant, you do not run this command yourself. The
formae MCP server drives the same flow through its own tools, and the
formae Cloud quickstart walks
through it.
Choosing how trust is established
Every cloud offers two ways in, and which one suits you depends on how much access you are willing to give a CLI. Provision directly when you have local cloud credentials and are content for formae to use them once. formae creates the trust and registers it in a single command, and the credentials are never stored. Register trust you established yourself when you would rather not give a CLI provisioning rights. You apply a small template in your own console or pipeline, then hand formae the identifiers it produced. formae never holds a provisioning credential on this path. Registering trust you established yourself validates the shape of what you pass and nothing more. It does not check that the identity exists, that it trusts the formae issuer, or that it has any access. The first command that needs the trust is what proves it, and it fails plainly if the trust is wrong.formae connect aws
Connects an AWS account.
Run without flags to be asked for what is missing. The interactive quick-create
path prints the link and waits, so you can apply the stack and finish
registering in the same sitting.
formae connect azure
Connects an Azure subscription.
Provisioning creates a user-assigned managed identity and grants it Contributor
and User Access Administrator on the subscription. That is near-owner access,
and it is what the agent needs to manage arbitrary infrastructure.
formae authenticates with whatever Azure credentials the machine already has:
environment variables, a managed identity, or an existing
az login session. It
never opens a browser or starts a sign-in itself. With no usable credentials the
command stops and names both remedies rather than guessing.
When registering an existing Azure identity, supply the subscription and client
IDs. formae derives the tenant by asking Azure Resource Manager which directory
owns the subscription, without credentials. If that lookup fails, supply
--tenant-id explicitly.
formae connect azure template
Prints an ARM template that establishes the same trust without any credential on
your machine.
Standard output is the template alone, so it redirects cleanly to a file.
Guidance goes to standard error, and leads with a link that opens the template
in the Azure portal with your installation’s coordinates already filled in.
Deploy it in the portal or your own pipeline, then register what it created with
formae connect azure --subscription <id> --client-id <c>, taking the client
id from the deployment’s outputs. The tenant is worked out from the
subscription, so only one value has to make the trip by hand; pass
--tenant-id as well if you would rather be explicit.
formae connect gcp
Connects a GCP project.
Provisioning creates a workload identity pool and provider in the project and
grants formae editor access plus the ability to manage the project’s IAM.
If the machine has no usable Google credentials, formae runs
gcloud auth application-default login, which opens a browser. Expect it. Under
machine output the sign-in is declined unless you pass --allow-login, so an
automated caller does not stall on a browser nobody will see.