In Calm, the cloud locations an application can use are determined by the combination of (1) the Accounts that are added to the Project and (2) the substrates defined inside the blueprint.

If the Project contains more than one cloud Account and the blueprint contains substrates for several providers, Calm distributes the application components across every provider that is both in the Project and referenced in the blueprint. Therefore, the most common—and most direct—reason a deployment that was supposed to stay on AWS is landing on other clouds is that both the Project definition and the blueprint were built to include multiple providers.

A. Password change only breaks the Account connection; it does not alter placement logic.

B. Policies enforce quotas / approval but do not decide which provider is used.

C. Roles govern RBAC; they cannot override the provider list defined in the Project + blueprint.

1. Nutanix Calm Administration Guide v3.6, “Projects – Adding Accounts,” pp. 24-26: “…when a project contains several Accounts, any blueprint that includes matching substrates will deploy components to those providers.”

2. Nutanix Calm Blueprint Design Guide, Section “Multi-cloud Substrates,” para 2: “Calm determines runtime placement from the intersection of Project Accounts and blueprint substrates; if both reference multiple providers, components may span clouds.”

3. Nutanix Calm 3.6 Online Help, topic “Launching an Application,” Step 4: “…select a Project. All Accounts attached to that Project are candidates for deployment provided the blueprint has matching substrates.”