TLDTrack cloud monitoring with read-only access can inspect your servers and cloud bill, but cannot modify resources, start or stop them, or delete them. Before connecting an account, check the actual permissions, the account or subscription covered, credential storage and the steps for removing access.
For an agency or web team reviewing a monitoring tool, use the connection process as part of your buying decision. Ask for the permission details before approving access, and keep a record of what you approve for each client account.
What should read-only cloud access allow?
TLDTrack connects to AWS, Azure and DigitalOcean to show server and database status, workload and costs alongside the domains they support. Its cloud monitoring is included on the Pro and Agency plans.
When comparing services, ask the supplier to separate visibility from control. Request a clear account of what the connection reads and which operations it excludes. Do not accept a broad description such as “cloud access” in place of the actual role or token scopes.
- Resources: ask which server and database details the service needs to read.
- Monitoring: ask which status checks and workload metrics it collects.
- Billing: decide whether you want cost visibility, and review the billing permissions requested.
- Control: confirm explicitly that the connection cannot change, start, stop or delete resources.
How does each cloud provider connect to TLDTrack?
Review the setup for the provider you actually use rather than treating all three connections as interchangeable. Check the role, subscription or scopes on the approval screen before completing the connection.
AWS: review the role and external ID
TLDTrack uses an AWS CloudFormation stack to create a role it can assume. The role permits read actions and uses an external ID to tie access to your account. TLDTrack does not store AWS keys for this connection.
Before approving the stack, review the proposed role and read permissions. Record which AWS account you are connecting, especially when you manage separate accounts for different clients.
Azure: check the subscription and Reader role
TLDTrack's Azure setup uses a Cloud Shell command to create a sign-in with the Reader role on your subscription. You then paste the command's output into TLDTrack, where the credentials are stored encrypted.
Check that the selected subscription is the one you intend to monitor. Keep the app registration details with your connection record so the person responsible for offboarding can identify it later.
DigitalOcean: inspect the token scopes
TLDTrack's DigitalOcean connection uses a token with read scopes for account, Droplets, databases, monitoring and billing. TLDTrack stores the token encrypted and does not display it again after entry.
Compare the requested scopes with that list before pasting the token. Record the token's purpose and owner, and confirm the provider-side revocation steps before handing the connection over to another team member.
How do you remove monitoring access?
For TLDTrack's AWS connection, deleting the CloudFormation stack removes access. For its Azure connection, deleting the app registration removes access.
Write the removal procedure into your handover notes before connecting, not when a client leaves. For DigitalOcean, ask for the exact token-revocation procedure and include it in the same record. Avoid assuming that cancelling a software subscription and revoking cloud permissions are the same step.
- Name the person responsible for removing access.
- Record the cloud account or subscription and the relevant stack, app registration or token.
- Set an offboarding check to confirm that the monitoring connection no longer has access.
Will read-only monitoring add to your cloud bill?
TLDTrack's AWS monitoring adds a small charge to your AWS bill for reading metrics and costs. TLDTrack limits Cost Explorer usage to no more than six requests per day.
Ask about provider charges separately from the monitoring subscription. Request the expected request frequency and review your own bill after connecting. For client-owned accounts, agree who will review those charges rather than treating read-only access as a promise of no additional cost.
What should you check after connecting?
TLDTrack checks what the connection can read, lists servers within a minute or two and then checks their status every five minutes.
Compare the discovered resources with your expected inventory. Check that you have connected the intended account, review any missing servers or databases, and agree who will act on monitoring alerts. For an initial evaluation, consider starting with one account before repeating the process across a client portfolio.
Before approving a connection, review TLDTrack's cloud monitoring setup and compare the provider-specific access details with your internal checklist. Resolve any questions about permissions, credentials, revocation or charges before connecting the account.
