Lucidscale allows you to import architecture from supported cloud providers and generate diagrams from that data. Some import methods require creating a provider side credential which gives a licensed Lucidscale user the ability to import a cloud infrastructure in the Lucid Data Hub and create a visual representation of it in a Lucidscale document.
Lucidscale is available to Lucid Suite Enterprise accounts as an add-on purchase with the Cloud Accelerator. To learn more about the Cloud Accelerator, refer to our Cloud Accelerator overview article.
Supported credentials
- AWS: Cross-Account Role, IAM User
- Azure: AD Application
- Google Cloud (formerly GCP): Service Account
A credential is a secret or secrets used by Lucidscale on behalf of users to access their cloud infrastructure data.
A credential grants a Lucidscale user that is assigned a Creator license the ability to import a cloud infrastructure to the Lucid Data Hub and create a visual representation of it in a Lucidscale document.
Credential sharing
A Lucidscale user who has generated a credential to import a cloud infrastructure has the ability to share the credential with other users on their account. Sharing credentials will allow the recipient user to import the cloud infrastructure data accessible with a credential in the Lucid Data Hub and create a visual representation of it in a Lucidscale document.
To share credentials:
- Click Data Hub from the bottom-left of the navigation menu on the Lucid Home Page.
- Select the cloud provider you are using from the menu that appears on the left-hand side.
- Select the Credentials tab.
- A list of the cloud provider credentials you can use to import your infrastructure will be rendered.
- Check the box(es) to the left of any credentials that you’d like to share.
- Select Share credentials in the top-right corner of the page.
- In the popup modal, type the name(s), email address(es), or group(s) you want to share your dataset with.
After a credential has been shared with another user, you can revoke their access to the credential by clicking the X next to their email address in the Share Credential modal.
Credential transfer
Admin(s) can transfer your Lucidscale credentials to another user on your account should you lose your Lucidscale license. If your Lucidscale license is removed and your credentials are transferred, you will no longer be able to import your infrastructure data associated with those credentials or save new credentials.
Data source sharing
A Lucidscale user who has imported a data source into the data hub using a credential can share that data source with other users on the account. Sharing the data source allows the recipient to access the data source from the data hub and create a Lucidscale document to visually represent it.
To share data sources:
- Click Data hub from the bottom-left of the navigation menu on the Lucid Home Page.
- Select the cloud provider you are using from the menu that appears on the left-hand side.
- A list of the data sources will be visible, depending on your cloud provider:
- Accounts for AWS
- Subscriptions for Azure
- Projects for Google Cloud
- Check the box(es) to the left of any data sources that you’d like to share.
- Select Share data sources (accounts, subscriptions, or projects) in the top-right corner of the page.
- In the popup modal, type the name(s), email address(es), or group(s) you want to share your dataset with.
After a data source has been shared with another user, you can revoke their access to the data source by clicking the X next to their email address in the “Share data source” modal.
Note: If you are the recipient of a data source, you can view the data source and use it to create documents. However, you can’t modify or delete the data source.
Admin credential management FAQ
When removing a Lucidscale license from a user or deleting the user, admins have the ability to transfer the credentials, folders, and Lucidscale boards owned by the user to another user on the account. When this happens, you transfer:
- Credentials
- Folders
- Documents and their associated data sources
A credential gives a licensed Lucidscale user the ability to import cloud infrastructure to the Lucid Data Hub, and that data source can be used to create a visual representation of the infrastructure in a Lucidscale document. Lucidscale documents can be organized and stored in Folders of your choice on your Lucid Home Page.
How is ownership transferred?
Admins on Enterprise Lucid accounts have the ability to create limited-access users by removing all of a user’s assigned product licenses (Lucidchart, Lucidspark, Lucidscale). If a user assigned a Lucidscale license is converted to a limited-access user, as an admin you are required to transfer any credentials, folders, and documents owned by the user being delicensed to another user on the account. The recipient user will be granted ownership of the transferred credentials, folders, and documents.
When deleting a user assigned a Lucidscale license, transfer is not enforced. Admins can elect to either transfer credentials, folders, and documents owned by the user being deleted to another user on the account, or have them deleted with the user.
If a user being deleted or converted to limited-access owns Lucidscale credentials, we recommend that you transfer their credentials and documents to a user on the account assigned a Lucidscale Creator license.
Why is it important to transfer the credentials to the right person?
The new owner will have full access to the metadata of the cloud environment tied to the credentials. If they are assigned a Lucidscale Creator license, they could visualize the cloud infrastructure tied to the credentials in their own Lucidscale document. They can also view and edit previously created documents that have been transferred to them or shared with them. This could pose a security risk if the user who received access to the credentials within the company does not have permission to view such sensitive information.
What happens if you transfer a credential to someone without a Lucidscale license?
The new owner will not be able to interact with a cloud provider credential unless they have a Lucidscale Creator license. They will be able to view credentials from the data hub, but will not be able to visualize the cloud infrastructure tied to the credentials by creating new Lucidscale documents.
What does credential transfer mean?
It means transferring the ownership of a cloud provider credential to another user, which gives the new credential owner the ability to import a linked cloud infrastructure and create a Lucidscale document if they are assigned a Lucidscale creator license.
Once transferred, can it be transferred back?
No. De-licensing the recipient of the credential to a limited-access user is the only scenario when the ability to transfer would be triggered again.
Security
AWS
Cross-Account roles
Cross-Account roles are the preferred method from AWS for granting 3rd party access to your account. This method allows Lucidscale to securely store credentials that allow you to easily refresh your diagram.
If you elect to share your cross-account role with another user, they will be able to import from the associated account, but will not see the External ID and ARN values for the shared role. Please see these resources for more information:
- How to use an external ID when granting access to your AWS resources to a third party
- Providing access to AWS accounts owned by third parties
Enforced external ID
Following the best security practices provided by AWS, Lucid enforces that External IDs remain unique in Lucid's database. Therefore, Lucid provides a unique external ID to the user and disallows the user from entering in their own external ID.
Secure, limited access for IAM users
We request limited, “describe”-level permission for the IAM user you create. An IAM user created with these permissions cannot change settings in your AWS architecture or read data in your databases. We only use the IAM user to read the structural metadata of your AWS infrastructure. Please review our Import and manage AWS infrastructure data in Lucidscale article for information on how to create an IAM user.
No storage of access keys
Lucidscale will not store your AWS IAM credentials after performing the initial scan of your AWS infrastructure. Your credentials will be transferred to our servers using standard encryption methods. Clients may negotiate encryption protocols up to AES-256. We can store a Cross-Account role that only gives us “describe and list” access to your environment.
Azure
Azure AD application
Entra ID (formerly Azure AD) application is the preferred method from Azure for managing digital identities for both external and on-premises applications. This method allows Lucidchart to securely store credentials that allow you to easily import and refresh your diagram.
If you elect to share your Azure AD application with another user, they will be able to import from the associated subscription, but will not see the Application(client) ID, Directory(tenant) ID, or Client Secret values for the shared application. Please see these resources for more information:
Secure, limited access
We request limited, read-only access permission for the Azure AD Application you create. The permissions are defined within the custom role you tie to your application. A custom role created with these permissions cannot change settings in your Azure architecture or read data in your databases. We only use the AD Application to read the structural metadata of your Azure infrastructure. We only read from subscriptions that you grant us access to; you can control that by limiting the scope of the custom role attached to the AD application assigned to Lucidscale.
Google Cloud
Google Cloud Service account
Service account is the preferred method from Google Cloud for granting 3rd party access to your account. This method allows Lucidchart to securely store credentials that allow you to easily import and refresh your diagram. See this resources for more information: Service accounts | Cloud IAM Documentation
Secure, limited access
We request limited, read-only access permission for the Google Cloud service account you create. The permissions are defined within the custom role you tie to your service account. A custom role created with these permissions cannot change settings in your Google Cloud architecture or read data in your databases. We only use the service account to read the structural metadata of your Google Cloud infrastructure. We read only from projects that you grant us access to — you can control that by limiting the scope of the custom role attached to the service account assigned to Lucidscale.
Give feedback on this article
Have feedback about this article? Tell us about your experience here.