Cloud Accounts
Cloud Defense monitors the cloud accounts you add to it. Each account is a connection to one AWS account, Azure subscription, or GCP project. For AWS and Azure, Cloud Defense discovers the account's resources into Inventory and runs posture monitoring checks against them; for AWS it also runs threat detectors on the events the account forwards. For GCP, it receives the project's audit log events and your organization's Security Command Center findings.
Accounts live under Settings (the gear icon) > Cloud Accounts. Adding one takes two steps: create the account record, then provision it by creating a role or identity in your cloud that Cloud Defense can use. You always own that role or identity; it exists in your account and you can review or remove it at any time.
Fields common to every provider
| Field | What it's for |
|---|---|
| Cloud Provider | AWS, Azure, or GCP. The account ID field is labeled for the provider you pick |
| Name | How the account is listed in Cloud Defense |
| Project | The Cloud Defense project the account belongs to |
| Account Environment | A label such as Production or Staging, used for filtering and in alert rules. You can change it at any time |
| Cloud Defense Access | How much the role or identity you create is allowed to do. See Access levels |
Access levels
You choose the access level when you create the account. It decides which permissions the provisioning step grants, and it can't be changed afterward; to change it, create a new account.
| Access level | What Cloud Defense can do | Available for |
|---|---|---|
| Read Only | Read resource configuration to assess posture and suggest remediations. It can't change anything | Every provider |
| Read/Write | Read Only, plus apply the remediation actions listed on the Check Actions page. The write permissions are limited to what those actions need | AWS |
| Events Only | Nothing in the account itself. Events are forwarded, but resources aren't discovered into Inventory. Shown only for clients using FireMon Authorization Control | AWS |
After provisioning
AWS and Azure accounts are discovered as soon as they're provisioned, and again every day.
| What to check | Where to look |
|---|---|
| The account is provisioned | The Provision page shows This account has been provisioned. On the Cloud Accounts list, an account that still needs it shows an icon with the tooltip This account still needs to be provisioned |
| Discovery is healthy | The Cloud Accounts list shows no red warning icon on the account and no One or more of your accounts require attention. banner. The Provision page has no Resource Errors; if it does, expand Error Details for the region, resource type, error, and date of each failure |
| The resources themselves | Inventory, filtered by the account |
| Findings | Posture Monitoring, once the first checks have run against the discovered resources |
| Events | Events lists what the account forwards: CloudTrail events for AWS, audit logs and Security Command Center findings for GCP. Threat detectors run on the AWS events |
Providers
- AWS: a CloudFormation stack, for one account or an AWS Organization, or Terraform creates the role
- Azure: one Azure CLI command creates a managed identity with a read-only role, and every subscription in a tenant can be added at once
- GCP: two Terraform templates forward the project's audit logs and your organization's Security Command Center findings