Integrations

Configure Slack, AWS, Azure, GCP, and AI providers from the CLI.

Slack Integration

Get notified about drifts and scans in Slack.

Setup

controlinfra slack setup

You'll be prompted to enter your Slack webhook URL:

? Enter your Slack webhook URL: https://hooks.slack.com/services/...
✓ Slack integration configured

Test with: controlinfra slack test

Or provide it directly:

controlinfra slack setup --webhook https://hooks.slack.com/services/...

Test

Send a test message:

controlinfra slack test

Output:

✓ Test message sent to Slack

Status

Check integration status:

controlinfra slack status

Output:

┌──────────────────────────────────────────────────────────┐
│ Slack Integration                                         │
├──────────────────────────────────────────────────────────┤
│ Status:    Connected                                      │
│ Webhook:   https://hooks.slack.com/*****/***              │
└──────────────────────────────────────────────────────────┘

Remove

Remove Slack integration:

controlinfra slack remove

---

AWS Credentials

Configure AWS credentials for drift scanning.

Setup

controlinfra aws setup

Interactive mode:

  AWS Credentials Setup

  These credentials are used to access your AWS account for drift detection.

? AWS Access Key ID: AKIA...
? AWS Secret Access Key: ****
? Default AWS Region: us-east-1
✓ AWS credentials saved

Test credentials with: controlinfra aws test

Or provide directly:

controlinfra aws setup \
  --access-key AKIAIOSFODNN7EXAMPLE \
  --secret-key wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY \
  --region us-east-1

Test

Validate credentials:

controlinfra aws test

Output:

✓ AWS credentials are configured

Credentials will be validated during the next scan.

Status

Check credential status:

controlinfra aws status

Output:

┌──────────────────────────────────────────────────────────┐
│ AWS Credentials                                           │
├──────────────────────────────────────────────────────────┤
│ Status:      Configured                                   │
│ Access Key:  AKIA****MPLE                                 │
│ Region:      us-east-1                                    │
└──────────────────────────────────────────────────────────┘

Remove

Remove AWS credentials:

controlinfra aws remove

---

Azure Credentials

Configure Azure credentials for drift scanning.

Setup

controlinfra azure setup

Interactive mode:

  Azure Credentials Setup

  These credentials are used to access your Azure account for drift detection.

? Azure Subscription ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
? Azure Tenant ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
? Azure Client ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
? Azure Client Secret: ****
? Azure Environment: public
✓ Azure credentials saved

Test credentials with: controlinfra azure test

Or provide directly:

controlinfra azure setup \
  --subscription-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
  --tenant-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
  --client-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
  --client-secret your-client-secret \
  --environment public

Options

Option	Description	Default
--subscription-id	Azure Subscription ID	-
--tenant-id	Azure Tenant ID	-
--client-id	Azure Client ID	-
--client-secret	Azure Client Secret	-
--environment	public, usgovernment, german, china	public

Status

Check credential status:

controlinfra azure status

Output:

┌──────────────────────────────────────────────────────────┐
│ Azure Credentials                                         │
├──────────────────────────────────────────────────────────┤
│ Status:          Configured                               │
│ Subscription:    xxxxxxxx-****-xxxx                       │
│ Environment:     public                                   │
└──────────────────────────────────────────────────────────┘

Test

Validate credentials:

controlinfra azure test

Output:

✓ Azure credentials are configured

Credentials will be validated during the next scan.

Remove

Remove Azure credentials:

controlinfra azure remove

---

GCP Credentials

Configure GCP credentials for drift scanning.

Setup

controlinfra gcp setup

Interactive mode:

  GCP Credentials Setup

  These credentials are used to access your GCP project for drift detection.

? Path to Service Account JSON file: /path/to/service-account.json
✓ GCP credentials saved

Test credentials with: controlinfra gcp test

Or provide directly:

controlinfra gcp setup \
  --json-file /path/to/service-account.json \
  --project-id my-project-id

Options

Option	Description	Default
--json-file	Path to Service Account JSON file	-
--project-id	GCP Project ID	-
--client-email	Service Account email	-
--private-key	Service Account private key	-
--workload-identity	Use Workload Identity Federation	-

Status

Check credential status:

controlinfra gcp status

Output:

┌──────────────────────────────────────────────────────────┐
│ GCP Credentials                                           │
├──────────────────────────────────────────────────────────┤
│ Status:        Configured                                 │
│ Project:       my-project-id                              │
│ Auth Method:   service_account                            │
└──────────────────────────────────────────────────────────┘

Test

Validate credentials:

controlinfra gcp test

Output:

✓ GCP credentials are configured

Credentials will be validated during the next scan.

Remove

Remove GCP credentials:

controlinfra gcp remove

---

AI Provider (BYOK)

Use your own AI provider API keys instead of the default.

Supported Providers

Provider	Models
Anthropic	Claude 3.5 Sonnet, Claude 3 Opus
OpenAI	GPT-4, GPT-4 Turbo

Status

Check current AI provider:

controlinfra ai status

Output:

┌──────────────────────────────────────────────────────────┐
│ AI Provider                                               │
├──────────────────────────────────────────────────────────┤
│ Provider:     default                                     │
│ Custom Key:   No (using default)                          │
└──────────────────────────────────────────────────────────┘

Use your own API key with:
  controlinfra ai use anthropic --key <your-api-key>
  controlinfra ai use openai --key <your-api-key>

Use Anthropic

controlinfra ai use anthropic --key sk-ant-...

Interactive mode:

controlinfra ai use anthropic

? Enter your anthropic API key: ****
✓ API key verified
✓ anthropic configured as AI provider

AI-powered features will now use your API key.

Use OpenAI

controlinfra ai use openai --key sk-...

Verify

Check if your API key is valid:

controlinfra ai verify

Output:

✓ anthropic API key is valid

Remove (Use Default)

Revert to using the default Controlinfra AI:

controlinfra ai remove

? Remove custom AI key and use default Controlinfra AI? Yes
✓ Custom AI key removed

Now using default Controlinfra AI.

---

Environment Variables

All integrations can be configured via environment variables:

Variable	Description
CONTROLINFRA_TOKEN	Authentication token
CONTROLINFRA_API_URL	Custom API URL
AWS_ACCESS_KEY_ID	AWS access key
AWS_SECRET_ACCESS_KEY	AWS secret key
AWS_REGION	AWS region
ANTHROPIC_API_KEY	Anthropic API key
OPENAI_API_KEY	OpenAI API key
CONTROLINFRA_ORG_ID	Organization ID

Next Steps

• Quick Reference - Command overview
• Runners - Self-hosted runners