FPT Cloud

Connect FPT Cloud to let CloudThinker agents inspect the VMs, disks, networks, backups, tags, and activity in your VPCs, and change them through your Approvals. The connection uses one personal access token and reaches every VPC that the token’s user can see, so you don’t enter a VPC or an organization.

Prerequisites

An FPT Cloud account that signs in to console.fptcloud.com with FPT ID or your organization’s SSO.
At least one VPC assigned to that user. An organization admin assigns VPCs in IAM.

The token carries the permissions of the user who creates it, in every VPC that user can see. A dedicated FPT Cloud user for CloudThinker keeps that scope small and stops the connection depending on one person’s account. An organization admin sets it up in IAM:

Create the user.
Assign only the VPCs you want to share.
Give it the read-only role from Required permissions.
Sign in as that user to create the token in Setup.

Setup

Create a personal access token

Click Create.
Enter a Name, such as cloudthinker.
Select an Expiration.
Click Create, then copy the full token value.

FPT Cloud shows the token value only once. If you lose it, delete the token and create a new one.When the token expires, the connection switches to Error. To swap in a new token, follow Rotate a credential.

Add the connection in CloudThinker

Open More → Workspace settings → Connections, select FPT Cloud, and enter:

Alias: a short name such as production. The field starts with a suggested alias, fptcloud-1 for your first connection, then fptcloud-2, and so on.
Description: what this connection is for. It defaults to the provider name.
FPT Cloud personal access token: the token you copied.

Click Connect.Success state: the connection shows Connecting and Verifying, then a Connected status with a message such as FPT Cloud connection verified. VPCs: 3.

Connection details

Field	Required	What to enter
Alias	No	Name for this connection, in lowercase letters, digits, and hyphens (up to 63 characters). Use a different alias for each FPT Cloud connection.
Description	No	What the connection is for. Defaults to FPT Cloud.
FPT Cloud personal access token	Yes	The token from the FPT Cloud Token page. Letters, digits, `.`, `_`, and `-` only, with no spaces or line breaks.

You can add more than one FPT Cloud connection to a workspace. One token already reaches every organization and VPC its user can see, so add a second connection only when you need a different user’s scope, for example a production user and a non-production user. Each needs its own alias. When several are attached, name the alias in your question, such as Using the production connection, list stopped VMs.

Required permissions

A token is not bound to a VPC or an organization. It carries the user’s permissions across the FPT Cloud API.

You want agents to	The token’s user needs
Pass the connection test	Sign-in access and at least one assigned VPC
Read inventory	Access to each VPC you want inspected
Make approved changes	The matching permission codes in the table below

For read-only use, give the token’s user a role in IAM → Roles that holds only read codes: instance:List, instance:Detail, instance:ListSnapshot, storage:List, and network:List. The built-in ORG Super Admin and VPC Super Admin roles grant full administrative rights. Add write codes only for the changes you want agents to make:

Change	FPT Cloud permission code
Create a VM	`instance:Create`
Power a VM on or off	`instance:StartAndStop`
Delete a VM	`instance:Terminate`
Create or delete a snapshot	`instance:CreateSnapshot`, `instance:DeleteSnapshot`
Resize, attach, detach, or delete a disk	`storage:Resize`, `storage:Attach`, `storage:Detach`, `storage:Delete`
Create or delete a network	`network:Create`, `network:Delete`

The codes above are the only ones agents can check before acting. These actions have no code agents can check:

Reads: tags, activity, and backups.
Changes: reboot, rename, clone, NICs, and schedules.

For these, FPT Cloud checks the user’s role only when the call runs, so a missing permission shows up as a permission error at that point. If that happens, ask your organization admin to widen the role.

To see what the token holds before you widen it, ask: Which FPT Cloud permissions does my token have in the production VPC? Agents check the codes through FPT Cloud IAM.

Agent capabilities

Capability	What agents can do
VPC discovery	List the VPCs the token can see, with organization, region, and platform (OpenStack or VMware)
Find a resource	Look up an IP address or a name across every organization and VPC the token can see
Account-wide scans	Find stopped VMs, VMs with a public IP, and unattached disks or public IPs across all VPCs in one pass
VMs	Inventory and detail, flavors, images, storage policies, NICs, and flavors a VM can resize to
Networks	Subnets, NICs, floating IPs, load balancer backends, and the names of the security groups attached to each VM (not their rules)
Storage and backup	Disks, volumes, snapshots, snapshot schedules, backup coverage, and restore points
Tags	Tags, tag coverage, untagged resources, and tag policies
Activity	Who changed a resource and when, from the VPC activity log
Cost estimates	List-price estimates from FPT Cloud’s unit prices for vCPU, RAM, and disk
Approved changes	Create, power, reboot, rename, resize, clone, or delete a VM, and manage its disks, NICs, snapshots, schedules, and tags

Every change goes through Approvals first, and agents name the exact VM ID and name they will touch. When the token can see several VPCs, the agent asks which one to use instead of guessing.

Agents can’t create Kubernetes clusters or databases, can’t read security group rules or ports, and have no historical CPU or memory usage to right-size from. Cost figures are list-price estimates, not invoice amounts: vCPU, RAM GB, and disk GB times the unit prices in FPT Cloud’s service catalog for the VPC, at 720 hours a month. FPT Cloud’s catalog states no currency, so the figures carry none. Confirm the currency in your FPT Cloud price list before you share the numbers.If FPT Cloud accepts a change but a fresh read hasn’t confirmed the result yet, the agent reports the change as pending. Ask it to check the VM’s current state before you retry, so the change doesn’t run twice.

Verify the connection

List the VPCs my FPT Cloud token can see, with the number of VMs in each

Expect each VPC with its organization, region, platform, and VM count.

Example prompts

Which FPT Cloud VMs have a public IP, and which security groups are attached to them?
List unattached disks and public IPs across all my VPCs with their estimated monthly list price
Reboot the VM web-01 in the production VPC, and show me the exact VM ID first

Troubleshooting

FPT Cloud personal access token is required

The token field is empty, or the pasted value has a space, a line break, or another unsupported character. Copy the full token again, then test the connection.

FPT Cloud rejected the personal access token

The token expired, was deleted, or was not copied in full. On the FPT Cloud Token page, check that the token is Active. If not, create a new token and update the connection.

FPT Cloud token lacks permission to list its VPCs

FPT Cloud refused to list the user’s VPCs. Ask your organization admin to check the user’s role in IAM, then test again.

FPT Cloud token has no assigned VPC

The token’s user has no VPC. Ask an organization admin to assign one in IAM, or create the token from a user who has one.

FPT Cloud rate limit reached, or FPT Cloud is temporarily unavailable

FPT Cloud is limiting requests or returned a server error. Wait a few minutes, then test the connection again.

FPT Cloud could not be reached from the executor

CloudThinker could not open a connection to FPT Cloud. Wait a few minutes, then test the connection again.

Alias '...' is invalid. Must be lowercase alphanumeric with hyphens, starting with a letter or digit, max 63 chars.

Use only lowercase letters, digits, and hyphens, start with a letter or digit, and keep it to 63 characters, such as fpt-production.

Alias '...' is already used by your fptcloud connection.

Another FPT Cloud connection in this workspace has that alias. Pick a different one.

Security

Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

Set a short expiration: pick the shortest Expiration that fits, and create a new token before the old one expires.
Delete the token to revoke access: deleting it on the FPT Cloud Token page stops all access through this connection.

Connections

See every service you can connect and how connection status works.

Approvals

Decide which FPT Cloud changes run, wait for a person, or are refused.

Connections

Customize

Approvals

Workspace settings

Admin Settings

Artifacts and sharing

Prerequisites

Setup

Connection details

Required permissions

Agent capabilities

Verify the connection

Example prompts

Troubleshooting

Security

Connections

Approvals

​Prerequisites

​Setup

​Connection details

​Required permissions

​Agent capabilities

​Verify the connection

​Example prompts

​Troubleshooting

​Security

​Related

Connections

Approvals

Prerequisites

Setup

Connection details

Required permissions

Agent capabilities

Verify the connection

Example prompts

Troubleshooting

Security

Related