diff --git a/modules/ROOT/attachments/cloud-controlplane-api.yaml b/modules/ROOT/attachments/cloud-controlplane-api.yaml
index f8cccede6..a072cac7d 100644
--- a/modules/ROOT/attachments/cloud-controlplane-api.yaml
+++ b/modules/ROOT/attachments/cloud-controlplane-api.yaml
@@ -258,61 +258,6 @@ components:
         - CLOUD_PROVIDER_GCP
         - CLOUD_PROVIDER_AZURE
       type: string
-    CloudStorage:
-      properties:
-        aws:
-          $ref: '#/components/schemas/CloudStorage.AWS'
-        azure:
-          $ref: '#/components/schemas/CloudStorage.Azure'
-        gcp:
-          $ref: '#/components/schemas/CloudStorage.GCP'
-      type: object
-    CloudStorage.AWS:
-      properties:
-        arn:
-          type: string
-      type: object
-    CloudStorage.Azure:
-      properties:
-        allowed_ips:
-          description: |-
-            List of public IP or IP ranges in CIDR Format.
-
-            - Only IPv4 addresses are allowed.
-            - Private IP address ranges as defined in RFC 1918 are not allowed.
-            - Small address ranges using "/31" or "/32" prefix sizes are not
-            supported. These ranges should be configured using individual IP
-            address rules without prefix specified.
-            - allowed_ips have no effect on requests originating from the same
-            Azure region as the storage account. Use allowed_subnet_ids to allow
-            same-region requests. Services deployed in the same region as the
-            storage account use private Azure IP addresses for communication. Thus,
-            you cannot allow access to specific Azure services based on their
-            public outbound IP address range.
-          items:
-            type: string
-          type: array
-        allowed_subnet_ids:
-          description: |-
-            A list of virtual network subnet IDs that are allowed to access the
-            storage account.
-          items:
-            type: string
-          type: array
-        container_name:
-          type: string
-        resource_group_name:
-          type: string
-        storage_account_name:
-          type: string
-        subscription_id:
-          type: string
-      type: object
-    CloudStorage.GCP:
-      properties:
-        name:
-          type: string
-      type: object
     Cluster:
       description: Resource describing a Cluster.
       properties:
@@ -336,7 +281,7 @@ components:
             See the official [GCP VPC](https://cloud.google.com/vpc/docs/add-remove-network-tags) for more details on network tags.
           type: object
         cloud_storage:
-          $ref: '#/components/schemas/CloudStorage'
+          $ref: '#/components/schemas/Cluster.CloudStorage'
         cluster_configuration:
           $ref: '#/components/schemas/Cluster.ClusterConfiguration'
         connection_type:
@@ -426,6 +371,61 @@ components:
           type: array
       title: Cluster
       type: object
+    Cluster.CloudStorage:
+      properties:
+        aws:
+          $ref: '#/components/schemas/Cluster.CloudStorage.AWS'
+        azure:
+          $ref: '#/components/schemas/Cluster.CloudStorage.Azure'
+        gcp:
+          $ref: '#/components/schemas/Cluster.CloudStorage.GCP'
+      type: object
+    Cluster.CloudStorage.AWS:
+      properties:
+        arn:
+          type: string
+      type: object
+    Cluster.CloudStorage.Azure:
+      properties:
+        allowed_ips:
+          description: |-
+            List of public IP or IP ranges in CIDR Format.
+
+            - Only IPv4 addresses are allowed.
+            - Private IP address ranges as defined in RFC 1918 are not allowed.
+            - Small address ranges using "/31" or "/32" prefix sizes are not
+            supported. These ranges should be configured using individual IP
+            address rules without prefix specified.
+            - allowed_ips have no effect on requests originating from the same
+            Azure region as the storage account. Use allowed_subnet_ids to allow
+            same-region requests. Services deployed in the same region as the
+            storage account use private Azure IP addresses for communication. Thus,
+            you cannot allow access to specific Azure services based on their
+            public outbound IP address range.
+          items:
+            type: string
+          type: array
+        allowed_subnet_ids:
+          description: |-
+            A list of virtual network subnet IDs that are allowed to access the
+            storage account.
+          items:
+            type: string
+          type: array
+        container_name:
+          type: string
+        resource_group_name:
+          type: string
+        storage_account_name:
+          type: string
+        subscription_id:
+          type: string
+      type: object
+    Cluster.CloudStorage.GCP:
+      properties:
+        name:
+          type: string
+      type: object
     Cluster.ClusterConfiguration:
       properties:
         computed_properties:
@@ -511,6 +511,8 @@ components:
             Note: If a tag is GCP network tag, its value will be ignored.
             See the official [GCP VPC](https://cloud.google.com/vpc/docs/add-remove-network-tags) for more details on network tags.
           type: object
+        cloud_storage:
+          $ref: '#/components/schemas/ClusterCreate.CloudStorage'
         cluster_configuration:
           $ref: '#/components/schemas/ClusterCreate.ClusterConfiguration'
         connection_type:
@@ -579,6 +581,47 @@ components:
         - zones
       title: ClusterCreate
       type: object
+    ClusterCreate.CloudStorage:
+      properties:
+        aws:
+          $ref: '#/components/schemas/ClusterCreate.CloudStorage.AWS'
+        azure:
+          $ref: '#/components/schemas/ClusterCreate.CloudStorage.Azure'
+        gcp:
+          $ref: '#/components/schemas/ClusterCreate.CloudStorage.GCP'
+      type: object
+    ClusterCreate.CloudStorage.AWS:
+      type: object
+    ClusterCreate.CloudStorage.Azure:
+      properties:
+        allowed_ips:
+          description: |-
+            List of public IP or IP ranges in CIDR Format.
+
+            - Only IPv4 addresses are allowed.
+            - Private IP address ranges as defined in RFC 1918 are not allowed.
+            - Small address ranges using "/31" or "/32" prefix sizes are not
+            supported. These ranges should be configured using individual IP
+            address rules without prefix specified.
+            - allowed_ips have no effect on requests originating from the same
+            Azure region as the storage account. Use allowed_subnet_ids to allow
+            same-region requests. Services deployed in the same region as the
+            storage account use private Azure IP addresses for communication. Thus,
+            you cannot allow access to specific Azure services based on their
+            public outbound IP address range.
+          items:
+            type: string
+          type: array
+        allowed_subnet_ids:
+          description: |-
+            A list of virtual network subnet ids that are allowed to access the
+            storage account.
+          items:
+            type: string
+          type: array
+      type: object
+    ClusterCreate.CloudStorage.GCP:
+      type: object
     ClusterCreate.ClusterConfiguration:
       properties:
         custom_properties:
@@ -604,6 +647,8 @@ components:
             Note: The value of a network tag will be ignored.
             See the official [GCP VPC](https://cloud.google.com/vpc/docs/add-remove-network-tags) for more details on network tags.
           type: object
+        cloud_storage:
+          $ref: '#/components/schemas/ClusterUpdate.CloudStorage'
         cluster_configuration:
           $ref: '#/components/schemas/ClusterUpdate.ClusterConfiguration'
         customer_managed_resources:
@@ -641,6 +686,47 @@ components:
         - id
       title: ClusterUpdate
       type: object
+    ClusterUpdate.CloudStorage:
+      properties:
+        aws:
+          $ref: '#/components/schemas/ClusterUpdate.CloudStorage.AWS'
+        azure:
+          $ref: '#/components/schemas/ClusterUpdate.CloudStorage.Azure'
+        gcp:
+          $ref: '#/components/schemas/ClusterUpdate.CloudStorage.GCP'
+      type: object
+    ClusterUpdate.CloudStorage.AWS:
+      type: object
+    ClusterUpdate.CloudStorage.Azure:
+      properties:
+        allowed_ips:
+          description: |-
+            List of public IP or IP ranges in CIDR Format.
+
+            - Only IPv4 addresses are allowed.
+            - Private IP address ranges as defined in RFC 1918 are not allowed.
+            - Small address ranges using "/31" or "/32" prefix sizes are not
+            supported. These ranges should be configured using individual IP
+            address rules without prefix specified.
+            - allowed_ips have no effect on requests originating from the same
+            Azure region as the storage account. Use allowed_subnet_ids to allow
+            same-region requests. Services deployed in the same region as the
+            storage account use private Azure IP addresses for communication. Thus,
+            you cannot allow access to specific Azure services based on their
+            public outbound IP address range.
+          items:
+            type: string
+          type: array
+        allowed_subnet_ids:
+          description: |-
+            A list of virtual network subnet ids that are allowed to access the
+            storage account.
+          items:
+            type: string
+          type: array
+      type: object
+    ClusterUpdate.CloudStorage.GCP:
+      type: object
     ClusterUpdate.ClusterConfiguration:
       properties:
         custom_properties:
@@ -3215,6 +3301,8 @@ paths:
                     Note: The value of a network tag will be ignored.
                     See the official [GCP VPC](https://cloud.google.com/vpc/docs/add-remove-network-tags) for more details on network tags.
                   type: object
+                cloud_storage:
+                  $ref: '#/components/schemas/ClusterUpdate.CloudStorage'
                 cluster_configuration:
                   $ref: '#/components/schemas/ClusterUpdate.ClusterConfiguration'
                 customer_managed_resources:
diff --git a/modules/ROOT/attachments/cloud-dataplane-api.yaml b/modules/ROOT/attachments/cloud-dataplane-api.yaml
index 8b2caa3e5..5c79d8392 100644
--- a/modules/ROOT/attachments/cloud-dataplane-api.yaml
+++ b/modules/ROOT/attachments/cloud-dataplane-api.yaml
@@ -1178,7 +1178,7 @@ components:
           type: object
         url:
           description: |-
-            URL to connect to the pipeline, for example, using http_server.
+            URL to connect to the pipeline, e.g. via http_server.
             May be empty if no http_server is used.
           type: string
       required:
@@ -1227,7 +1227,7 @@ components:
         tags:
           additionalProperties:
             type: string
-          description: Optional list of tags to attach to a pipeline.
+          description: Optional lList of tags to attach to a pipeline.
           type: object
       required:
         - display_name