> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kubox.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# kubox cloud verify

Ask whether a connected account still works, in both directions

### Synopsis

Reads the trust policy in your account AND asks the plane to assume the
role.

Both, because either alone passes the case the other catches. AWS silently
IGNORES an external ID presented to a policy that does not require one, so a
role missing the condition assumes perfectly and is assumable by anyone; and
a document that reads correctly can still be one AWS will not accept yet.

```
kubox cloud verify <name> [flags]
```

### Options

```
      --account-id string      the account being connected; the connection's own when unset, and refused if these credentials belong elsewhere
      --artifact-key string    KMS alias, ARN or awskms:// provider URL sealing credentials Kubox stores for this account; must be a different key; alias/kubox-artifacts when unset
      --connection string      the connection to complete, by the id the console showed or by its name; the positional name when unset
      --creator-role string    name for the role Kubox assumes to build in this account (default "KuboxClusterCreator")
  -h, --help                   help for verify
      --hosted-zone string     Route53 zone the build role may publish records in, scoped to it alone; omit it and the connection publishes no DNS
      --plan                   render the transaction this would perform, and perform none of it; works with -o json
      --profile string         the AWS profile to use; overrides AWS_PROFILE, so you choose the profile the connection was set up under
      --region string          region clusters in this account are built in; the connection's own when unset
      --sealer-role string     name for the tenant-local role runs seal this account's credentials through (ADR-0002) (default "KuboxTenantArtifactSealer")
      --stack-key string       KMS alias, ARN or awskms:// provider URL encrypting this account's Pulumi checkpoints; alias/kubox-stacks when unset
      --state-backend string   where this account's Pulumi state lives, as s3://bucket/prefix; derived from the connection when unset
      --unsealer-role string   name for the tenant-local role that opens this account's sealed credentials (default "KuboxTenantArtifactUnsealer")
```

### Global options

See [global options](/cli-reference/kubox#global-options).

### SEE ALSO

* [kubox cloud](/cli-reference/kubox_cloud)	 - Connect and manage the cloud accounts Kubox builds into