Importing existing infrastructure
Importing Existing Infrastructure
Section titled “Importing Existing Infrastructure”Sencai is import-first — the primary use case is connecting and managing infrastructure you already have, not provisioning from scratch. Connect your existing AWS, Azure, GCP, or Hetzner accounts and Sencai discovers all your resources automatically.
What “import” means
Section titled “What “import” means”When you import infrastructure, Sencai:
- Connects to your cloud account using credentials you provide (read-only scan, no changes made)
- Scans all resources in the account — compute, networking, storage, IAM, databases, load balancers
- Presents discovered resources for your review
- Adopts the ones you select into Sencai management (tagging, monitoring, policy enforcement)
Your existing infrastructure is not modified during import. Adoption simply means Sencai starts tracking and managing the resource.
What gets imported
Section titled “What gets imported”| Resource type | AWS | Azure | GCP | Hetzner |
|---|---|---|---|---|
| Compute instances (VMs) | EC2 | Virtual Machines | Compute Engine | Cloud Servers |
| Networks / VPCs | VPC + Subnets | VNets | VPC Networks | Networks |
| NAT Gateways | NAT Gateway | NAT Gateway | Cloud NAT | — |
| Load balancers | ALB / NLB | Load Balancer | Cloud Load Balancing | Load Balancers |
| IAM roles and policies | IAM Roles | Managed Identities | Service Accounts | — |
| Object storage | S3 Buckets | Blob Storage | Cloud Storage | — |
| Managed databases | RDS | Azure SQL / Cosmos | Cloud SQL | — |
| DNS zones | Route53 | Azure DNS | Cloud DNS | — |
| Kubernetes clusters | EKS | AKS | GKE | — |
Step-by-step: importing your first account
Section titled “Step-by-step: importing your first account”Step 1: Add BYOC credentials
Section titled “Step 1: Add BYOC credentials”Go to Gravity → Settings → Cloud Credentials → Add credentials and select your provider:
| Provider | Method |
|---|---|
| AWS | IAM role (cross-account assume-role) or access key |
| Azure | Service principal (App Registration) with Reader role |
| GCP | Service account JSON key with Viewer permissions |
| Hetzner | API token (read + write) |
| DigitalOcean | Personal access token |
Credentials are encrypted at rest with AES-256-GCM and never logged or exposed in plaintext.
Step 2: Trigger a full scan
Section titled “Step 2: Trigger a full scan”After adding credentials, Sencai automatically runs an initial scan. To trigger manually:
- Go to Gravity → Instances → Import
- Select the credential set
- Click Scan Now
Scan progress is shown in real time. A full scan across a medium AWS account (100–200 resources) typically takes 2–5 minutes.
Step 3: Review discovered resources
Section titled “Step 3: Review discovered resources”After scanning, go to Cloud Instances → Discovered to see all found resources.
Each resource shows:
- Provider, region, type, and name
- Current state (running, stopped, etc.)
- Cost estimate (where available)
- Policy compliance status (pre-checked against your active policies)
- Whether it’s already adopted into Sencai
Step 4: Adopt resources
Section titled “Step 4: Adopt resources”Select the resources you want to bring under Sencai management:
- Select all to adopt everything discovered
- Select by type to adopt only e.g. all EC2 instances
- Select individually to cherry-pick
Click Adopt Selected. Adopted resources immediately:
- Appear in your Cloud Instances list
- Are evaluated against your compliance policies
- Start accumulating audit trail entries for any changes
- Can be tagged, monitored, and managed from Sencai
Resources you don’t adopt remain visible in Discovered (not managed) — you can adopt them at any time.
Multi-account import
Section titled “Multi-account import”You can connect multiple cloud accounts simultaneously:
- Add multiple BYOC credential sets under the same organization
- Each credential set can cover a different AWS account, Azure subscription, or GCP project
- Run scans independently or trigger a full organization-wide scan
- All discovered resources appear in a unified inventory, labeled by their source account
For multi-account setups: add a credential set for each account, then run scan per credential set (or use “Scan all”). Cross-account cost analysis is available in the FinOps section.
Tracking scan jobs
Section titled “Tracking scan jobs”Each scan creates a job you can track:
| Status | Meaning |
|---|---|
| Queued | Waiting for worker capacity |
| Running | Actively scanning the account |
| Completed | Scan finished, results available |
| Partial | Some regions/resource types failed (check job details) |
| Failed | Scan could not complete — usually a credential issue |
Click a job to see per-region breakdown and any errors encountered.
Re-scanning
Section titled “Re-scanning”When enabled by your administrator, Sencai re-scans connected accounts once daily (default schedule: 03:00 UTC). Automatic re-scanning is opt-in — check with your Sencai admin if you don’t see periodic re-scans. Detected changes (new resources, terminated resources, config drift) are surfaced in Inventory → Changes.
You can always trigger a manual re-scan at any time from Gravity → Settings → Cloud Credentials → [credential set] → Scan Now, regardless of whether automatic re-scanning is enabled.
Import vs provisioning
Section titled “Import vs provisioning”| Import | Provisioning | |
|---|---|---|
| Use case | Existing infrastructure | New resources |
| Starting point | Connect BYOC credentials | Choose provider + size |
| Speed | Scan 2–5 min, then instant | 3–15 min (provider API) |
| What Sencai does | Discovers and tracks | Creates and tracks |
Most teams start with import, then use provisioning for new environments.
After import: what you can do
Section titled “After import: what you can do”Once resources are adopted:
- Tag them — Apply Sencai tags for cost allocation, compliance, and filtering
- Monitor them — Fleet agent can be installed on any imported VM for deep OS-level monitoring
- Manage them — Stop, resize, or terminate from Sencai (requires write permissions in BYOC credentials)
- Apply policies — Tag governance and compliance policies apply automatically
- View costs — Cost data is pulled from cloud provider billing APIs and shown per resource
Troubleshooting
Section titled “Troubleshooting”Q: Scan shows 0 resources found
A: Check that the credentials have sufficient permissions. For AWS, the minimum policy is ReadOnlyAccess. If scanning a specific region only, ensure you selected the correct region.
Q: Import scan failed with “AccessDenied”
A: The IAM user/role does not have permission to list resources of a specific type. Review the credentials and attached IAM policies.
Q: Some resources appear but others are missing
A: Certain resource types require additional IAM permissions beyond basic read-only. Check the job details for specific permission errors per resource type.
Q: I adopted resources by mistake
A: Go to Cloud Instances, select the resource, and click Remove from management. This removes Sencai tracking but does not delete the resource from your cloud provider.
Q: Can I re-scan after adding new resources to my cloud account?
A: Yes. Click Scan Now on the credentials entry at any time to run an incremental scan. New resources discovered since the last scan appear in Pending adoption.
Q: Can I go the other way — get Terraform out of Sencai for instances I manage here?
A: Yes — see Exporting to Terraform, the mirror operation to import.