Lucidscale allows you to import architecture from supported cloud providers and generate diagrams from that data. Some import methods require creating a provider side credential which gives a licensed Lucidscale user the ability to import a cloud infrastructure in the Lucid Data Hub and create a visual representation of it in a Lucidscale Model.

To learn more about functionality available with a Lucidscale license, see our Lucidscale Plans article. To purchase a license, see the Upgrade your Lucid account article for instructions.

Supported credentials

AWS: Cross-Account Role, IAM User
Azure: AD Application
Google Cloud (formerly GCP): Service Account

A credential is a secret or secrets used by Lucidscale on behalf of users to access their cloud infrastructure data.

A credential grants a Lucidscale user that is assigned a Creator license the ability to import a cloud infrastructure to the Lucid Data Hub and create a visual representation of it in a Lucidscale Model.

Users

Credential sharing

A Lucidscale user who has generated a credential to import a cloud infrastructure has the ability to share the credential with other users on their account. Sharing the credential will allow the recipient user to import the cloud infrastructure data accessible with the credential in the Lucid Data Hub and create a visual representation of it in a Lucidscale Model.

To share a credential:

Click Data Hub from the bottom-left of the navigation menu on the Lucid Home Page.
Select the cloud provider you are using from the menu that appears on the left-hand side.
Toggle to the Saved Credentials tab.
A list of the cloud provider credentials you can use to import your infrastructure will be rendered. Click the three-dot menu rendered on an available credential and select Share Credential.
You can then populate the email address of a user you want to share your credential within the Share Credential modal that is rendered.
- You can also share the credential with a group or team on your account by typing the name and selecting it from the dropdown.

After a credential has been shared with another user, you can revoke their access to the credential by clicking the X next to their email address in the Share Credential modal.

Credential transfer

Admin(s) can transfer your Lucidscale credentials to another user on your account should you lose your Lucidscale license. If your Lucidscale license is removed and your credentials are transferred, you will no longer be able to import your infrastructure data associated with those credentials or save new credentials.

Admin credential management FAQ

When removing a Lucidscale license from a user or deleting the user, admins have the ability to transfer the credentials, folders, and Lucidscale boards owned by the user to another user on the account. When this happens, you transfer:

Credentials
Folders
Models and their associated data sources

A credential gives a licensed Lucidscale user the ability to import cloud infrastructure to the Lucid Data Hub, and that data source can be used to create a visual representation of the infrastructure in a Lucidscale Model. Lucidscale Models can be organized and stored in Folders of your choice on your Lucid Home Page.

How is ownership transferred?

Admins on Enterprise Lucid accounts have the ability to create limited-access users by removing all of a user’s assigned product licenses (Lucidchart, Lucidspark, Lucidscale). If a user assigned a Lucidscale license is converted to a limited-access user, as an admin you are required to transfer any credentials, folders, and Models owned by the user being delicensed to another user on the account. The recipient user will be granted ownership of the transferred credentials, folders, and Models.

When deleting a user assigned a Lucidscale license, transfer is not enforced. Admins can elect to either transfer credentials, folders, and Models owned by the user being deleted to another user on the account, or have them deleted with the user.

If a user being deleted or converted to limited-access owns Lucidscale credentials, we recommend that you transfer their credentials and Models to a user on the account assigned a Lucidscale Creator license.

Why is it important to transfer the credentials to the right person?

The new owner will have full access to the metadata of the cloud environment tied to the credentials. If they are assigned a Lucidscale Creator license, they could visualize the cloud infrastructure tied to the credentials in their own Lucidscale Model. They can also view and edit previously created Models that have been transferred to them or shared with them. This could pose a security risk if the user who received access to the credentials within the company does not have permission to view such sensitive information.

What happens if you transfer a credential to someone without a Lucidscale license?

The new owner will not be able to interact with a cloud provider credential unless they have a Lucidscale Creator license. They will be able to view credentials from the data hub, but will not be able to visualize the cloud infrastructure tied to the credentials by creating new Lucidscale Models.

What does credential transfer mean?

It means transferring the ownership of a cloud provider credential to another user, which gives the new credential owner the ability to import a linked cloud infrastructure and create a Lucidscale Model if they are assigned a Lucidscale creator license.

Once transferred, can it be transferred back?

No. De-licensing the recipient of the credential to a limited-access user is the only scenario when the ability to transfer would be triggered again.

Security

AWS

Cross-Account roles

Cross-Account roles are the preferred method from AWS for granting 3rd party access to your account. This method allows Lucidscale to securely store credentials that allow you to easily refresh your diagram.

If you elect to share your cross-account role with another user, they will be able to import from the associated account, but will not see the External ID and ARN values for the shared role. Please see these resources for more information:

Enforced external ID

Following the best security practices provided by AWS, Lucid enforces that External IDs remain unique in Lucid's database. Therefore, Lucid provides a unique external ID to the user and disallows the user from entering in their own external ID.

Secure, limited access for IAM users

We request limited, “describe”-level permission for the IAM user you create. An IAM user created with these permissions cannot change settings in your AWS architecture or read data in your databases. We only use the IAM user to read the structural metadata of your AWS infrastructure. Please review our Import and manage AWS infrastructure data in Lucidscale article for information on how to create an IAM user.

No storage of access keys

Lucidscale will not store your AWS IAM credentials after performing the initial scan of your AWS infrastructure. Your credentials will be transferred to our servers using standard encryption methods. Clients may negotiate encryption protocols up to AES-256. We can store a Cross-Account role that only gives us “describe and list” access to your environment.

Azure

Azure AD application

Entra ID (formerly Azure AD) application is the preferred method from Azure for managing digital identities for both external and on-premises applications. This method allows Lucidchart to securely store credentials that allow you to easily import and refresh your diagram.

If you elect to share your Azure AD application with another user, they will be able to import from the associated subscription, but will not see the Application(client) ID, Directory(tenant) ID, or Client Secret values for the shared application. Please see these resources for more information:

Secure, limited access

We request limited, read-only access permission for the Azure AD Application you create. The permissions are defined within the custom role you tie to your application. A custom role created with these permissions cannot change settings in your Azure architecture or read data in your databases. We only use the AD Application to read the structural metadata of your Azure infrastructure. We only read from subscriptions that you grant us access to; you can control that by limiting the scope of the custom role attached to the AD application assigned to Lucidscale.

Google Cloud

Google CLoud Service account

Service account is the preferred method from Google Cloud for granting 3rd party access to your account. This method allows Lucidchart to securely store credentials that allow you to easily import and refresh your diagram. See this resources for more information: Service accounts | Cloud IAM Documentation

Secure, limited access

We request limited, read-only access permission for the Google Cloud service account you create. The permissions are defined within the custom role you tie to your service account. A custom role created with these permissions cannot change settings in your Google Cloud architecture or read data in your databases. We only use the service account to read the structural metadata of your Google Cloud infrastructure. We read only from projects that you grant us access to — you can control that by limiting the scope of the custom role attached to the service account assigned to Lucidscale.

Give feedback on this article

Have feedback about this article? Tell us about your experience here.

Related articles