> ## Documentation Index
> Fetch the complete documentation index at: https://docs.envzero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# env zero Context Layer

> Connect a CloudQuery workspace to env zero to see CloudQuery insights by severity on your projects, environments, and resources.

<Note>
  **Beta Feature** - The env zero Context Layer is in beta and is enabled per organization. To enable it, contact [env zero support](/guides/community-and-resources/support-and-help/support).
</Note>

The env zero Context Layer connects your env zero organization to a CloudQuery workspace. CloudQuery syncs your cloud providers and your env zero organization, and raises insights on what it finds, such as security, cost, and end-of-life issues. env zero shows each insight next to the project, environment, and resource it affects.

## Prerequisites

<Warning>
  * To connect, update, or remove the Context Layer, you need the **Edit Organization Settings** permission.
  * To view insights, you need the **View Organization** permission, which every default organization role includes.
</Warning>

## Connect the Context Layer

There are two ways to connect: let env zero create a new Context Layer workspace, or connect a CloudQuery workspace you already have with an API key. If your email already has a CloudQuery account, use the API key.

### Create a new workspace

<Steps>
  <Step title="Open Connected Platforms">
    Go to **Organization Settings** > **Integrations**. Under **Connected Platforms**, find the **env zero Context Layer** card and click **Connect**.
  </Step>

  <Step title="Accept the terms">
    Select **I agree to the CloudQuery Terms and Conditions** and click **Connect**. env zero creates a Context Layer account for your email address.
  </Step>

  <Step title="Wait for setup">
    Setup runs four steps: **Creating your workspace**, **Connecting the Context Layer**, **Connecting env zero**, and **Launching the first sync**. If you close the dialog, the card keeps updating on its own.
  </Step>

  <Step title="Set a password (optional)">
    To sign in to the Context Layer app directly, set a password of at least 8 characters. You can skip this and set it later from the card.
  </Step>

  <Step title="Connect a cloud provider">
    On the card, click **Connect a cloud provider** (or **Add provider**). This opens your CloudQuery workspace, where you add your cloud accounts. Insights on cloud resources appear in env zero after CloudQuery syncs them.
  </Step>
</Steps>

During setup, env zero creates a read-only organization admin user named `Env0CloudQuerySource` and gives its API key to CloudQuery, so CloudQuery can sync your env zero projects, environments, and deployments.

### Connect an existing CloudQuery workspace

<Steps>
  <Step title="Create a CloudQuery API key">
    In your CloudQuery workspace, create an API key. See [CloudQuery API keys](https://www.cloudquery.io/docs/platform/production-deployment/api-keys).
  </Step>

  <Step title="Enter the key in env zero">
    Go to **Organization Settings** > **Integrations**. On the **env zero Context Layer** card, click **Connect with an API key**, then enter:

    * **Platform URL**: your workspace URL, for example `https://your-tenant.us.platform.cloudquery.io`. It must be a public `https` URL.
    * **API Key**: the key from the previous step.
  </Step>

  <Step title="Save">
    Click **Connect**. env zero checks the key against your workspace before saving it, and stores it encrypted.
  </Step>
</Steps>

<Warning>
  env zero matches insights to projects and environments using the env zero data your CloudQuery workspace syncs. When you connect with an API key, add the [env zero source integration](https://www.cloudquery.io/hub/plugins/source/cloudquery/envzero/latest/docs) to your CloudQuery workspace with an [env zero API key](/guides/admin-guide/user-role-and-team-management/api-keys). Without it, no insights appear in env zero.
</Warning>

### Update or remove the connection

* To replace the API key, click **Update the API key** on the card.
* To disconnect, click **Remove** and confirm. Your Context Layer workspace and its data are kept in CloudQuery. After you remove a connection, you can only reconnect it with an API key.

## Where insights appear

Insights have four severities: **Critical**, **High**, **Medium**, and **Low**. Counts are the number of distinct insights, not the number of affected resources.

| Location | What you see |
| - | - |
| **Projects** page, **Insights** column | Insight counts per severity, including all sub-projects. Expand a parent project to see which sub-projects the insights come from. |
| A project's environments list | Insight counts per severity for each environment. Click the counts to open the environment's **Insights** tab. |
| Environment page, **Insights** tab | The tab badge shows the total count, colored by the highest severity. |
| Environment page, **Resources** tab | Insight counts on each resource. Expand a resource to list its insights with their severity, category, and source. |

If the Context Layer is enabled but not connected, the **Projects** page, the environments list, and the environment page show a **Connect CloudQuery** prompt. Users without the **Edit Organization Settings** permission see **Contact an admin to configure** instead.

### The Insights tab

The **Insights** tab groups insights into three sections:

* **Environment insights**: raised on the env zero environment itself, for example missing drift detection. See [Environment insights](#environment-insights).
* **Drifted resources**: raised on cloud resources that this environment manages and that have drifted.
* **Not drifted resources**: raised on the environment's other cloud resources.

Each row shows the insight's title, severity, category, source, and number of affected resources. Click a row to list the affected resources with their name, type, account, cloud, and region. Click **See details** to open the insight's **Evidence** and **Mitigation**, and click **See more in CloudQuery** to open the insight in your CloudQuery workspace.

env zero reads insights from CloudQuery when you open a page, so they reflect CloudQuery's last sync. Insights on archived environments are not shown.

## Environment insights

CloudQuery raises these insights from your env zero data. In CloudQuery, their titles start with "env zero", for example "env zero Environments Without Drift Detection". env zero shows them without that prefix.

| Insight | Severity | Category | Raised when |
| - | - | - | - |
| Drifted Without Remediation | High | Operations | Every drift detection run for more than 14 days found drift, with no clean run in between. |
| With a Departed Owner | High | Security | The environment was created by a user who is no longer an active member of the organization. Environments created with an API key are excluded. |
| Without Drift Detection | Medium | Operations | [Drift detection](/guides/admin-guide/environments/drift-detection) is disabled. |
| Without an Approval Gate | Medium | Security | **Approve plan automatically** is on, and no [approval policy](/guides/policies-governance/approval-policies) is assigned to the environment's project or template. |
| Deployment Failure Hotspots | Medium | Operations | The environment ran at least 5 deployments in the last 30 days, and more than 40% of them failed or timed out. |
| With No Recent Successful Deployment | Medium | Operations | No deploy succeeded in the last 90 days. Destroys, drift detection runs, and tasks don't count. |
| Built From One-Off Templates | Low | Operations | The environment was created from a single-use template instead of a shared one. |
| Past Their TTL | Low | Operations | The environment's [TTL](/guides/policies-governance/policy-ttl) has passed, or it is marked for automatic destroy, and it is still running. A lock is a common cause. |

## Troubleshooting

| Message | Cause and fix |
| - | - |
| `The CloudQuery tenant rejected the API key` | The API key is wrong, expired, or revoked. Create a new key in CloudQuery. |
| `Could not reach a CloudQuery tenant at <URL>` or `<URL> is not a CloudQuery tenant` | The **Platform URL** is wrong. Copy it from your browser while signed in to your CloudQuery workspace. |
| `<URL> resolves to a private address` | The **Platform URL** must be publicly reachable. |
| `This email already has a CloudQuery account, so we can't create a new one.` | Use [Connect an existing CloudQuery workspace](#connect-an-existing-cloudquery-workspace). |
| `CloudQuery rejected the stored credentials. Reconnect it in your organization settings.` | The saved key stopped working. Click **Update the API key** on the card. |
| `CloudQuery is not connected for this organization.` | [Connect the Context Layer](#connect-the-context-layer). |
| `Insights need dashboard access. Ask an organization admin for it.` | You need the **View Organization** permission. |
| `There are currently no insights to show.` | CloudQuery has no data linking this environment's resources to env zero yet. Check that your workspace syncs both your env zero organization and the cloud accounts this environment deploys to. |
| `No insights found for this environment.` | CloudQuery raised no insights on this environment or its resources. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.