---
title: Managing cloud resources
description: When you register a cloud account the Endpoint Controller periodically scans the account to discover its resources.
component: privilege
page_id: privilege:human-privilege:admin-use-cases/access-management/cloud-accounts
canonical_url: https://docs.pingidentity.com/privilege/human-privilege/admin-use-cases/access-management/cloud-accounts.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: February 16, 2026
page_aliases: ["human-privilege:admin-tasks/cloud-accounts.adoc"]
section_ids:
  targets: Targets
  configuring-targets: Configuring targets for access
  onboarding-target-resources: Onboarding target resources
  with-cloud-tags: Register using cloud provider tags
  with-admin-portal: Register using the admin portal
  resources: Resources
---

# Managing cloud resources

When you register an Amazon Web Services (AWS), Google Cloud Platform (GCP), or Azure account, the Endpoint Controller periodically scans the account to discover its resources.

These discovered cloud assets are categorized and displayed in two sections of the PingOne Privilege admin console:

* [Targets](#targets)

* [Resources](#resources)

## Targets

The **Targets** page contains resources that users sign on to, including:

* Servers, through SSH

* Windows servers, through RDP

* Databases

* Kubernetes clusters

* Kafka clusters

* Application roles

### Configuring targets for access

Target resources must be registered and configured before users can access them using the self-service portal.

This involves several key configuration steps:

* Register [target resources](#onboarding-target-resources) to make them visible and manageable.

* Configure [Gateways](../../configuration/gateways/index.html) to provide secure access paths.

* Enable [access protocols](../../configuration/access-protocols/index.html) for Linux and macOS servers.

* Set up [database access](../../configuration/cloud-accounts/database-access.html) for supported database types.

### Onboarding target resources

Register target resources with PingOne Privilege to make them available for self-service. After you register a resource, it appears in the **Targets** page.

Register target resources using:

* [Cloud provider tags](#with-cloud-tags)

* [PingOne Privilege admin console](#with-admin-portal)

#### Register using cloud provider tags

You can automatically register target resources by assigning a specific tag to resources within your AWS, GCP, or Azure accounts.

The PingOne Privilege platform discovers and manages resources with the following tag and value pair:

* **Tag**: `PingOne Privilege`

* **Value**: `Managed`

#### Register using the admin portal

To use the admin console to register individual target resources:

1. In the PingOne Privilege admin console, go to **Cloud > Targets**.

2. Find resources by:

   * Filtering resources using any of the following:

     * **Managed**: Select the **Managed** or **Un-Managed** checkboxes.

     * **Access Status**: Select the **Granted**, **Ungranted**, or **Bookmarked** checkboxes.

     * **Target Types**: Select a target type checkbox, such as **Server** or **Database**.

     * **Cloud Provider**: Select the icon for your cloud provider, such as **AWS**, **Azure**, or **GCP**.

     * **Cloud Account**: In the list next to cloud providers, select your specific cloud account for that cloud provider.

   * Using the search bar to type the specific resource name.

3. After locating the resource to register, click **More Info**.

4. On the **Resource Information** page, enable the **Managed** toggle in the upper-right corner.

## Resources

The **Resources** page displays cloud assets that don't require users to sign on, such as:

* Storage buckets

* Serverless functions

* Related platform services

Access to these resources is managed using temporary cloud provider identity and access management (IAM) roles. Once access is allowed, you can use resources through a command-line interface (CLI) or the cloud provider's web console.