Cloud permissions required to collect the base system Cloud Configuration Governance configuration keys

The Cloud Configuration Governance requires appropriate cloud permissions to collect the base system configuration keys from the cloud. Therefore, you must set the appropriate permissions in the cloud to suit the needs of your organization.

Note: Starting with Cloud Configuration Governance version 1.3.7, the base system contents are moved to the CCG Content Pack. Install the CCG Content Pack to access the base system Cloud Configuration Governance contents.

Amazon Web Services (AWS) datacenter

Cloud Configuration Governance uses the following items to collect the configuration key for the AWS datacenter configuration keys:

• Resource collector: Cloud Service Account
• Cloud API used: Action: DescribeRegions
• Cloud permission: ec2: DescribeRegions

AWS Identity and Access Management (IAM) users

Cloud Configuration Governance uses the following items to collect the configuration key for the AWS IAM user configuration keys:

• Resource collector: AWS IAM User Data Collector
• Cloud API used:
  • Action: GetCredentialReport and GenerateCredentialReport
  • Service: AWS IAM service
• Cloud permission: Iam:GetCredentialReport and Iam:GenerateCredentialReport

AWS object storage

Cloud Configuration Governance uses the following items to collect the configuration key for the AWS IAM user configuration keys:

• Configuration collector: AWS S3 Encryption Metric Collector
• Resource collector: AWS S3 Resource Collector
• Cloud API used: Action: ListBuckets and GetBucketEncryption on S3 service
• Cloud permission: s3:ListBucket and s3:GetEncryptionConfiguration

• Configuration collector: AWS S3 ACL Permission Metric Collector
• Resource collector: AWS S3 Resource Collector
• Cloud API used: Action: GetBucketAcl
• Cloud permission: s3:GetBucketAcl

AWS virtual machine instance

Cloud Configuration Governance uses the following items to collect the configuration key for the AWS virtual machine instance configuration keys:

• Resource collector: AWS VM Data Collector
• Cloud API used: Action: DescribeInstances and AWS EC2 resource
• Cloud permission: ec2:DescribeInstances

AWS profile with minimal permissions

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:GenerateCredentialReport",
                "s3:GetEncryptionConfiguration",
                "ec2:DescribeInstances",
                "s3:ListBucketVersions",
                "ec2:DescribeRegions",
                "s3:ListBucket",
                "iam:GetCredentialReport"
            ],
            "Resource": "*"
        }
    ]
}

Microsoft Azure virtual machine instance

Cloud Configuration Governance uses the following items to collect the Azure virtual machine instance configuration keys:

• Resource collector: Azure VM Data Collector
• Cloud API used: Microsoft.ResourceGraph/resources
• Cloud permission: Microsoft.ResourceGraph/resources

• Resource collector: Azure VM Data Collector
• Configuration collector: Azure VM Metric Collector
• Cloud API used: Microsoft.ResourceGraph/resources
• Cloud permission: Microsoft.ResourceGraph/resources

• Resource collector: Azure VM Data Collector
• Configuration collector: Azure VM Monitoring Metric Collector
• Cloud API used: Microsoft.Compute/virtualMachines/{vmName}/instanceView
• Cloud permission: Microsoft.Compute/virtualMachines/{vmName}/instanceView

Note: Use scope=https://graph.microsoft.com/.default andscope=https://management.azure.com/.default to fetch the oAuth token for the Azure resources.

Azure profile with minimal permissions

{
    "properties": {
        "roleName": "CCGAzureMinimalPermission",
        "description": "Grants access to scan compute resources from azure subscription",
        "assignableScopes": [
            "/subscriptions/${subscription_id}"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.ResourceGraph/resources/read",
                    "Microsoft.Compute/virtualMachines/instanceView/read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

Parent Topic:Cloud Configuration Governance reference