---
title: Create a Discovery account
url: /docs/discovery-governance/get-started/create-a-discovery-account/
---
> This [Pulumi Cloud](/docs/iac/concepts/pulumi-cloud/) feature is available in the [Essentials, Pro, and Enterprise editions](/pricing/#insights-discovery).



With the prerequisites in place, you'll add your first cloud account to Pulumi Cloud and kick off a discovery scan. You aren't creating a new account with your cloud provider: a Discovery account is Pulumi Cloud's connection to a cloud account you already have. In this example you will see the steps for AWS; Azure and Google Cloud follow the same flow with their own browser-based sign-in. For Oracle Cloud and Kubernetes, choose **Connect using existing ESC credentials** on the Authentication step instead, using the [Pulumi ESC (Environments, Secrets, and Configuration)](/docs/esc/) environment you configured earlier.

> **Note:** Currently while in public preview, Discovery supports AWS, Azure, Oracle Cloud, Kubernetes, and Google Cloud.

## Create a Discovery account

1. In the Pulumi Cloud console, navigate to **Resources** > **Discovery**. This page lists your Discovery accounts and their scan statuses.

1. Select **Connect cloud accounts** and choose your cloud provider. For this example, choose **AWS**.

1. On the **Authentication** step, keep the recommended **Connect using IAM Identity Center (SSO)** option. Enter your organization's **SSO start URL** and **Region**, then select **Next** and approve the authorization request that AWS opens in a new window. The wizard then lists the AWS accounts you can access. If your organization doesn't use IAM Identity Center, choose **Connect using static credentials**, or **Connect using existing ESC credentials** with [an environment you configure yourself](/docs/discovery-governance/concepts/discovery/cloud-accounts/#configure-esc-credentials).

1. On the **Accounts** step, the wizard pre-selects every discovered account that isn't already connected. For this tutorial, select **Edit selected accounts** and narrow the selection to a single account. Keep the default **Build & Manage** access level, or switch to the read-only **Discovery & Policy** level if your security review requires it.

1. On the **Discovery** step, review the defaults: scheduled scans and policy evaluation are both enabled, with a default policy pack pre-selected. For AWS, also review the partition the account belongs to and the regions you want scanned; global services are always scanned. For this tutorial, keep the default selections.

> **Note:** Scheduled scans run every 24 hours by default; you can switch to a 12-hour schedule instead.

To finish, select **Next**. The wizard creates the IAM role and an ESC environment for the account, connects it, and shows a summary with next steps. The account in Pulumi is named after the AWS account it connects: for example, an AWS account named `production` becomes the `production` account in Pulumi. The rest of this guide uses `production` as the example name; substitute the name of the account you connected.

For the full reference on the wizard, including the other authentication options and what gets created in your cloud accounts, see [Connect cloud accounts](/docs/discovery-governance/guides/connect-cloud-accounts/).

Next, you will learn how to manage your accounts, and manually launch a scan.

---
[← Previous step](/docs/discovery-governance/get-started/before-you-begin/)
[Next: Manage accounts and scans →](/docs/discovery-governance/get-started/manage-accounts-and-scans/)