Your plainfra account
Plan, billing, and connected AWS accounts.
—
—Payment & invoices
Update your card, download invoices, or cancel your subscription.
Your plan includes — AWS account. · See plans
Each AWS account is connected via a read-only cross-account IAM role. No write permissions are ever granted to plainfra.
Add another account
We'll reuse your account's external ID and give you a CloudFormation link to deploy the read-only role in the new account.
Installing to many accounts at once? See the multi-account install guide.
Almost there
Open the link below in the target AWS account to deploy the CloudFormation role. Your external ID is already baked into the link.
The CloudFormation stack takes about a minute to deploy. Once it reads CREATE_COMPLETE, verify the connection here and we'll confirm plainfra can read the account.
Disconnect —?
This removes the connection for — from plainfra. You won't be able to query this account until it's re-added.
The IAM role in your AWS account is not deleted by this action. To remove it completely, tear down the CloudFormation stack in that account yourself.
This is your primary account. After disconnect, — will become the new primary.
Unlock full read-only for —
This account is connected with the EC2-only lite role. Run the command below in CloudShell in that AWS account; it re-deploys the same plainfra-ReadOnly stack with the full read-only template, in place. Nothing to uninstall.
Prefer the console? Open CloudFormation, select the plainfra-ReadOnly stack, choose Update, and replace the template with customer-role.yaml. Once the stack shows UPDATE_COMPLETE, click verify below.
Single sign-on
Let your team sign in with Microsoft Entra. Anyone in the security group you nominate joins plainfra automatically, no invite needed.
The group's object ID, not its display name.
Alternative to the group: the app role value your admin assigns, e.g. plainfra.user.
Team members
Give plainfra read-only visibility into the tools around your AWS environment — logs, monitoring, CI — so answers can draw on them as evidence.
An account owner or admin can connect a service.
Every service is connected with read-only credentials. plainfra never asks for, and never uses, write access.
Keys that let your own tools — a coding assistant, an agent, a script — reach plainfra's read-only tools over MCP, scoped to whatever accounts and services you allow.
Your plan includes — consumer key. See plans to add more.
Name this consumer
Give it a name you'll recognise later — the tool, the person, or the script that will use it.
Copy your key now
This key is shown once. Store it somewhere safe — plainfra cannot show it to you again. If you lose it, revoke it and create a new one.
mcp.jsonAccess for —
Choosing all is an ongoing grant, not a snapshot: this consumer will also reach accounts and services you connect later. Pick specific ones to pin it to what exists today.
No connected services yet.
Revoke —?
This key's next call fails immediately. This cannot be undone — a revoked key cannot be reactivated, only replaced with a new one.
—
Use credentials scoped to read-only access — plainfra only ever reads. Keys are stored encrypted and are never shown again after you connect.
Disconnect this service?
plainfra deletes its stored credential immediately and stops reading from this service. Nothing changes on the service side — revoke the key there too if you want it gone completely.
- Account holder
- —
- —
- Time zone
-
Used to render dates in your weekly report and chat answers.
- Report focus
-
Tick what your weekly report should emphasise. Leave all unticked for a balanced report.
- Notifications
-
Tell this device when your weekly report is ready. Set it per device, and turn it off whenever you like.
Need to change your email or delete your account? Contact us.
Password
Set a password so you can sign in without a one-time code.
Leave blank if you haven't set one yet.