Skip to main content
Beta Feature - The env zero Context Layer is in beta and is enabled per organization. To enable it, contact env zero support.
The env zero Context Layer connects your env zero organization to a CloudQuery workspace. CloudQuery syncs your cloud providers and your env zero organization, and raises insights on what it finds, such as security, cost, and end-of-life issues. env zero shows each insight next to the project, environment, and resource it affects.

​
Prerequisites

  • To connect, update, or remove the Context Layer, you need the Edit Organization Settings permission.
  • To view insights, you need the View Organization permission, which every default organization role includes.

​
Connect the Context Layer

There are two ways to connect: let env zero create a new Context Layer workspace, or connect a CloudQuery workspace you already have with an API key. If your email already has a CloudQuery account, use the API key.

​
Create a new workspace

1

Open Connected Platforms

Go to Organization Settings > Integrations. Under Connected Platforms, find the env zero Context Layer card and click Connect.
2

Accept the terms

Select I agree to the CloudQuery Terms and Conditions and click Connect. env zero creates a Context Layer account for your email address.
3

Wait for setup

Setup runs four steps: Creating your workspace, Connecting the Context Layer, Connecting env zero, and Launching the first sync. If you close the dialog, the card keeps updating on its own.
4

Set a password (optional)

To sign in to the Context Layer app directly, set a password of at least 8 characters. You can skip this and set it later from the card.
5

Connect a cloud provider

On the card, click Connect a cloud provider (or Add provider). This opens your CloudQuery workspace, where you add your cloud accounts. Insights on cloud resources appear in env zero after CloudQuery syncs them.
During setup, env zero creates a read-only organization admin user named Env0CloudQuerySource and gives its API key to CloudQuery, so CloudQuery can sync your env zero projects, environments, and deployments.

​
Connect an existing CloudQuery workspace

1

Create a CloudQuery API key

In your CloudQuery workspace, create an API key. See CloudQuery API keys.
2

Enter the key in env zero

Go to Organization Settings > Integrations. On the env zero Context Layer card, click Connect with an API key, then enter:
  • Platform URL: your workspace URL, for example https://your-tenant.us.platform.cloudquery.io. It must be a public https URL.
  • API Key: the key from the previous step.
3

Save

Click Connect. env zero checks the key against your workspace before saving it, and stores it encrypted.
env zero matches insights to projects and environments using the env zero data your CloudQuery workspace syncs. When you connect with an API key, add the env zero source integration to your CloudQuery workspace with an env zero API key. Without it, no insights appear in env zero.

​
Update or remove the connection

  • To replace the API key, click Update the API key on the card.
  • To disconnect, click Remove and confirm. Your Context Layer workspace and its data are kept in CloudQuery. After you remove a connection, you can only reconnect it with an API key.

​
Where insights appear

Insights have four severities: Critical, High, Medium, and Low. Counts are the number of distinct insights, not the number of affected resources. If the Context Layer is enabled but not connected, the Projects page, the environments list, and the environment page show a Connect CloudQuery prompt. Users without the Edit Organization Settings permission see Contact an admin to configure instead.

​
The Insights tab

The Insights tab groups insights into three sections:
  • Environment insights: raised on the env zero environment itself, for example missing drift detection. See Environment insights.
  • Drifted resources: raised on cloud resources that this environment manages and that have drifted.
  • Not drifted resources: raised on the environment’s other cloud resources.
Each row shows the insight’s title, severity, category, source, and number of affected resources. Click a row to list the affected resources with their name, type, account, cloud, and region. Click See details to open the insight’s Evidence and Mitigation, and click See more in CloudQuery to open the insight in your CloudQuery workspace. env zero reads insights from CloudQuery when you open a page, so they reflect CloudQuery’s last sync. Insights on archived environments are not shown.

​
Environment insights

CloudQuery raises these insights from your env zero data. In CloudQuery, their titles start with “env zero”, for example “env zero Environments Without Drift Detection”. env zero shows them without that prefix.

​
Troubleshooting