Set up Cloud Discovery access

Nils · ‎06-25-2024

TL;DR-Sweepy-Icon (1).png
This page explains how to set up your Microsoft Azure, Amazon Web Services (AWS) and Google Cloud Platform (GCP) environments for Lansweeper's Cloud Discovery.

Before scanning your cloud provider, you’ll first need to set up your infrastructure to allow Cloud Discovery to access your environment. Depending on your cloud provider, these steps may differ, but setting up authentication to your cloud environment is crucial.

On this page, we'll go over the steps needed to set up your Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) environments.

Set up Microsoft Azure

Integrating Azure with Auth0 for Workload Identity Federation involves several steps, ensuring a secure and seamless authentication process without traditional credentials. This setup allows our scanning application to authenticate with Azure services using tokens from Auth0, leveraging federated identities.

Register a new application

You’ll first need to register a new application in the Azure portal. You can find detailed instructions in Quickstart: Register an app in the Microsoft identity platform.

After registering the app, copy the Application (client) ID and the Directory (tenant) ID and save them for later.

Add a Microsoft Graph API permission

Next, you’ll need to grant the correct permissions to the newly created app registration. You can find detailed instructions on adding permissions in Quickstart: Configure an app to access a web API.

In the list of permissions, select Directory.Read.All and grant it admin consent.

Configure Federated credentials

Federated credentials are what enable workload identity federation for software workloads. You can find detailed information about Federated credentials in Create a trust relationship between an app and an external identity provider.

To configure Federated credentials for Lansweeper Discovery:

In Federated credential scenario, select Other issuer.
In the Issuer field, enter https://dev-734bjlip.eu.auth0.com/.
In the Subject identifier field, enter D9vGk9gXUNtrwWdifIe0BWC865gu8oHd@clients.
In the Audience field, enter https://cloud-scanning-api (no trailing space or “/” character).

Assign permissions to access Azure resources

To allow your app registration to read resources under a specific subscription, you must assign the necessary role to your new application. Repeat this process for every subscription you wish to scan. You can find detailed instructions on assigning roles in Assign Azure roles using the Azure portal.

The Reader role should be an appropriate role for Lansweeper Discovery.

Create an Azure key vault

The final step in setting up Azure for Lansweeper Discovery is creating an Azure key vault. You can find detailed instructions on creating a key vault in Quickstart - Create an Azure Key Vault with the Azure portal.

After creating a default key vault, you need to configure the permissions:

Select Vault access policy instead of Azure role-based access control.
Create an access policy with all secret permissions for your account.
Add a secret named LansweeperSiteID to your key vault, entering your Lansweeper Site ID in the Secret Value field.

To find your Site ID, go to Configuration > Site settings in your Lansweeper Site.
Grant your app registration access to the secret.

After configuring the Azure key vault, copy the Vault URI and save it for later.

Set up Amazon Web Services (AWS)

Integrating AWS with Auth0 for Workload Identity Federation involves several steps, ensuring a secure and seamless authentication process without traditional credentials. This setup allows our scanning application to authenticate with AWS services using tokens from Auth0, leveraging federated identities.

Create an OIDC provider

You’ll first need to create an OpenID Connect (OIDC) provider. You can find detailed instructions in Create an OpenID Connect (OIDC) identity provider in IAM.

To configure the OIDC provider for Lansweeper Discovery:

In the Provider URL field, enter https://dev-734bjlip.eu.auth0.com/.
Make sure to include "/" at the end of the URI.
In the Audience field, enter D9vGk9gXUNtrwWdifIe0BWC865gu8oHd.

Create and configure a custom policy

Next, you’ll need to create and configure a custom policy. You can find detailed instructions on IAM policies in Creating IAM policies.

In the Policy editor, add the following JSON:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"organizations:ListAccounts",
				"organizations:ListAccountsForParent",
				"sts:GetCallerIdentity",
				"iam:GetRole",
				"organizations:DescribeOrganization"
			],
			"Resource": "*",
			"Condition": {
				"StringEquals": {
					"aws:PrincipalTag/siteId": ["<YOUR SITE ID>"]
				}
			}
		}
	]
}

To scan several sites with one policy, rewrite the Condition to:

"StringEquals": {
  "aws:PrincipalTag/siteId": ["site id #1", "site id #2"]
}

For a full list of actions performed by our scanning application, expand the following list:

Spoiler

[
"resource-groups:Get*",
  "resource-groups:List*",
  "resource-groups:Search*",
  "ssm:Describe*",
  "ssm:Get*",
  "ssm:List*",
  "codepipeline:Get*",
  "codepipeline:List*",
  "elasticbeanstalk:Describe*",
  "elasticbeanstalk:List*",
  "appfabric:Get*",
  "appfabric:List*",
  "dms:Describe*",
  "dms:List*",
  "ds:Describe*",
  "ds:Get*",
  "ds:List*",
  "route53-recovery-readiness:Get*",
  "route53-recovery-readiness:List*",
  "iam:Get*",
  "iam:List*",
  "autoscaling:Describe*",
  "autoscaling:Get*",
  "securityhub:Describe*",
  "securityhub:Get*",
  "securityhub:List*",
  "network-firewall:Describe*",
  "network-firewall:List*",
  "sqs:Get*",
  "sqs:List*",
  "launchwizard:Describe*",
  "launchwizard:Get*",
  "launchwizard:List*",
  "compute-optimizer:Describe*",
  "compute-optimizer:Get*",
  "dlm:Get*",
  "savingsplans:Describe*",
  "savingsplans:List*",
  "sagemaker-groundtruth-synthetic:Get*",
  "sagemaker-groundtruth-synthetic:List*",
  "emr-serverless:Get*",
  "emr-serverless:List*",
  "route53domains:Get*",
  "route53domains:List*",
  "ses:Describe*",
  "ses:Get*",
  "ses:List*",
  "codeartifact:Describe*",
  "codeartifact:Get*",
  "codeartifact:List*",
  "networkmanager:Describe*",
  "networkmanager:Get*",
  "networkmanager:List*",
  "athena:Get*",
  "athena:List*",
  "iot:Describe*",
  "iot:Get*",
  "iot:List*",
  "appsync:Get*",
  "appsync:List*",
  "ce:Describe*",
  "ce:Get*",
  "ce:List*",
  "cloudtrail:Describe*",
  "cloudtrail:Get*",
  "cloudtrail:List*",
  "kinesis:Describe*",
  "kinesis:Get*",
  "kinesis:List*",
  "iotwireless:Get*",
  "iotwireless:List*",
  "sdb:Get*",
  "sdb:List*",
  "application-autoscaling:Describe*",
  "application-autoscaling:List*",
  "glacier:Describe*",
  "glacier:Get*",
  "glacier:List*",
  "lambda:Get*",
  "lambda:List*",
  "s3:Describe*",
  "s3:Get*",
  "s3:List*",
  "trustedadvisor:Describe*",
  "apprunner:Describe*",
  "apprunner:List*",
  "iotevents:Describe*",
  "iotevents:List*",
  "sagemaker:Describe*",
  "sagemaker:Get*",
  "sagemaker:List*",
  "sagemaker:Search*",
  "clouddirectory:Get*",
  "clouddirectory:List*",
  "iotroborunner:Get*",
  "iotroborunner:List*",
  "account:Get*",
  "account:List*",
  "rds:Describe*",
  "rds:List*",
  "serverlessrepo:Get*",
  "serverlessrepo:List*",
  "serverlessrepo:Search*",
  "lakeformation:Describe*",
  "lakeformation:Get*",
  "lakeformation:List*",
  "lakeformation:Search*",
  "appstream:Describe*",
  "appstream:List*",
  "glue:Get*",
  "glue:List*",
  "glue:Search*",
  "elastic-inference:Describe*",
  "elastic-inference:List*",
  "logs:Describe*",
  "logs:Get*",
  "logs:List*",
  "iotanalytics:Describe*",
  "iotanalytics:Get*",
  "iotanalytics:List*",
  "ecr:Describe*",
  "ecr:Get*",
  "ecr:List*",
  "kafka:Describe*",
  "kafka:Get*",
  "kafka:List*",
  "scheduler:Get*",
  "scheduler:List*",
  "codedeploy:Get*",
  "codedeploy:List*",
  "servicediscovery:Get*",
  "servicediscovery:List*",
  "kms:Describe*",
  "kms:Get*",
  "kms:List*",
  "ecr-public:Describe*",
  "ecr-public:Get*",
  "ecr-public:List*",
  "workspaces-web:Get*",
  "workspaces-web:List*",
  "elasticfilesystem:Describe*",
  "elasticfilesystem:List*",
  "route53-recovery-control-config:Describe*",
  "route53-recovery-control-config:Get*",
  "route53-recovery-control-config:List*",
  "batch:Describe*",
  "batch:List*",
  "events:Describe*",
  "events:List*",
  "waf-regional:Get*",
  "waf-regional:List*",
  "workspaces:Describe*",
  "redshift:Describe*",
  "redshift:Get*",
  "organizations:Describe*",
  "organizations:List*",
  "emr-containers:Describe*",
  "emr-containers:List*",
  "kafkaconnect:Describe*",
  "kafkaconnect:List*",
  "datapipeline:Describe*",
  "datapipeline:Get*",
  "datapipeline:List*",
  "dynamodb:Describe*",
  "dynamodb:Get*",
  "dynamodb:List*",
  "sts:Get*",
  "lightsail:Get*",
  "s3-object-lambda:Get*",
  "s3-object-lambda:List*",
  "cloudfront-keyvaluestore:Describe*",
  "cloudfront-keyvaluestore:Get*",
  "cloudfront-keyvaluestore:List*",
  "firehose:Describe*",
  "firehose:List*",
  "codebuild:Describe*",
  "codebuild:List*",
  "notifications:Get*",
  "notifications:List*",
  "cloudfront:Describe*",
  "cloudfront:Get*",
  "cloudfront:List*",
  "cloudformation:Describe*",
  "cloudformation:Get*",
  "cloudformation:List*",
  "autoscaling-plans:Describe*",
  "autoscaling-plans:Get*",
  "backup:Describe*",
  "backup:Get*",
  "backup:List*",
  "kinesisvideo:Describe*",
  "kinesisvideo:Get*",
  "kinesisvideo:List*",
  "eks:Describe*",
  "eks:List*",
  "pipes:Describe*",
  "pipes:List*",
  "ec2messages:Get*",
  "mq:Describe*",
  "mq:List*",
  "identitystore-auth:List*",
  "tag:Describe*",
  "tag:Get*",
  "config:Describe*",
  "config:Get*",
  "config:List*",
  "es:Describe*",
  "es:Get*",
  "lookoutvision:List*",
  "sns:Get*",
  "sns:List*",
  "cloudsearch:Describe*",
  "cloudsearch:List*",
  "secretsmanager:Describe*",
  "secretsmanager:Get*",
  "secretsmanager:List*",
  "notifications-contacts:Get*",
  "notifications-contacts:List*",
  "elasticloadbalancing:Describe*",
  "cloudwatch:Describe*",
  "cloudwatch:Get*",
  "cloudwatch:List*",
  "elasticmapreduce:Describe*",
  "elasticmapreduce:Get*",
  "elasticmapreduce:List*",
  "waf:Get*",
  "waf:List*",
  "elasticache:Describe*",
  "elasticache:List*",
  "route53-recovery-cluster:Get*",
  "route53-recovery-cluster:List*",
  "swf:Describe*",
  "swf:Get*",
  "swf:List*",
  "ec2:Describe*",
  "ec2:Get*",
  "ec2:List*",
  "ec2:Search*",
  "transfer:Describe*",
  "transfer:List*",
  "iot1click:Describe*",
  "iot1click:Get*",
  "iot1click:List*",
  "wafv2:Describe*",
  "wafv2:Get*",
  "wafv2:List*",
  "ecs:Describe*",
  "ecs:List*",
  "kinesisanalytics:Describe*",
  "kinesisanalytics:Get*",
  "kinesisanalytics:List*",
  "route53:Get*",
  "route53:List*",
  "route53resolver:Get*",
  "route53resolver:List*",
]

[ "resource-groups:Get*", "resource-groups:List*", "resource-groups:Search*", "ssm:Describe*", "ssm:Get*", "ssm:List*", "codepipeline:Get*", "codepipeline:List*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "appfabric:Get*", "appfabric:List*", "dms:Describe*", "dms:List*", "ds:Describe*", "ds:Get*", "ds:List*", "route53-recovery-readiness:Get*", "route53-recovery-readiness:List*", "iam:Get*", "iam:List*", "autoscaling:Describe*", "autoscaling:Get*", "securityhub:Describe*", "securityhub:Get*", "securityhub:List*", "network-firewall:Describe*", "network-firewall:List*", "sqs:Get*", "sqs:List*", "launchwizard:Describe*", "launchwizard:Get*", "launchwizard:List*", "compute-optimizer:Describe*", "compute-optimizer:Get*", "dlm:Get*", "savingsplans:Describe*", "savingsplans:List*", "sagemaker-groundtruth-synthetic:Get*", "sagemaker-groundtruth-synthetic:List*", "emr-serverless:Get*", "emr-serverless:List*", "route53domains:Get*", "route53domains:List*", "ses:Describe*", "ses:Get*", "ses:List*", "codeartifact:Describe*", "codeartifact:Get*", "codeartifact:List*", "networkmanager:Describe*", "networkmanager:Get*", "networkmanager:List*", "athena:Get*", "athena:List*", "iot:Describe*", "iot:Get*", "iot:List*", "appsync:Get*", "appsync:List*", "ce:Describe*", "ce:Get*", "ce:List*", "cloudtrail:Describe*", "cloudtrail:Get*", "cloudtrail:List*", "kinesis:Describe*", "kinesis:Get*", "kinesis:List*", "iotwireless:Get*", "iotwireless:List*", "sdb:Get*", "sdb:List*", "application-autoscaling:Describe*", "application-autoscaling:List*", "glacier:Describe*", "glacier:Get*", "glacier:List*", "lambda:Get*", "lambda:List*", "s3:Describe*", "s3:Get*", "s3:List*", "trustedadvisor:Describe*", "apprunner:Describe*", "apprunner:List*", "iotevents:Describe*", "iotevents:List*", "sagemaker:Describe*", "sagemaker:Get*", "sagemaker:List*", "sagemaker:Search*", "clouddirectory:Get*", "clouddirectory:List*", "iotroborunner:Get*", "iotroborunner:List*", "account:Get*", "account:List*", "rds:Describe*", "rds:List*", "serverlessrepo:Get*", "serverlessrepo:List*", "serverlessrepo:Search*", "lakeformation:Describe*", "lakeformation:Get*", "lakeformation:List*", "lakeformation:Search*", "appstream:Describe*", "appstream:List*", "glue:Get*", "glue:List*", "glue:Search*", "elastic-inference:Describe*", "elastic-inference:List*", "logs:Describe*", "logs:Get*", "logs:List*", "iotanalytics:Describe*", "iotanalytics:Get*", "iotanalytics:List*", "ecr:Describe*", "ecr:Get*", "ecr:List*", "kafka:Describe*", "kafka:Get*", "kafka:List*", "scheduler:Get*", "scheduler:List*", "codedeploy:Get*", "codedeploy:List*", "servicediscovery:Get*", "servicediscovery:List*", "kms:Describe*", "kms:Get*", "kms:List*", "ecr-public:Describe*", "ecr-public:Get*", "ecr-public:List*", "workspaces-web:Get*", "workspaces-web:List*", "elasticfilesystem:Describe*", "elasticfilesystem:List*", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:Get*", "route53-recovery-control-config:List*", "batch:Describe*", "batch:List*", "events:Describe*", "events:List*", "waf-regional:Get*", "waf-regional:List*", "workspaces:Describe*", "redshift:Describe*", "redshift:Get*", "organizations:Describe*", "organizations:List*", "emr-containers:Describe*", "emr-containers:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "datapipeline:Describe*", "datapipeline:Get*", "datapipeline:List*", "dynamodb:Describe*", "dynamodb:Get*", "dynamodb:List*", "sts:Get*", "lightsail:Get*", "s3-object-lambda:Get*", "s3-object-lambda:List*", "cloudfront-keyvaluestore:Describe*", "cloudfront-keyvaluestore:Get*", "cloudfront-keyvaluestore:List*", "firehose:Describe*", "firehose:List*", "codebuild:Describe*", "codebuild:List*", "notifications:Get*", "notifications:List*", "cloudfront:Describe*", "cloudfront:Get*", "cloudfront:List*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "autoscaling-plans:Describe*", "autoscaling-plans:Get*", "backup:Describe*", "backup:Get*", "backup:List*", "kinesisvideo:Describe*", "kinesisvideo:Get*", "kinesisvideo:List*", "eks:Describe*", "eks:List*", "pipes:Describe*", "pipes:List*", "ec2messages:Get*", "mq:Describe*", "mq:List*", "identitystore-auth:List*", "tag:Describe*", "tag:Get*", "config:Describe*", "config:Get*", "config:List*", "es:Describe*", "es:Get*", "lookoutvision:List*", "sns:Get*", "sns:List*", "cloudsearch:Describe*", "cloudsearch:List*", "secretsmanager:Describe*", "secretsmanager:Get*", "secretsmanager:List*", "notifications-contacts:Get*", "notifications-contacts:List*", "elasticloadbalancing:Describe*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:List*", "elasticmapreduce:Describe*", "elasticmapreduce:Get*", "elasticmapreduce:List*", "waf:Get*", "waf:List*", "elasticache:Describe*", "elasticache:List*", "route53-recovery-cluster:Get*", "route53-recovery-cluster:List*", "swf:Describe*", "swf:Get*", "swf:List*", "ec2:Describe*", "ec2:Get*", "ec2:List*", "ec2:Search*", "transfer:Describe*", "transfer:List*", "iot1click:Describe*", "iot1click:Get*", "iot1click:List*", "wafv2:Describe*", "wafv2:Get*", "wafv2:List*", "ecs:Describe*", "ecs:List*", "kinesisanalytics:Describe*", "kinesisanalytics:Get*", "kinesisanalytics:List*", "route53:Get*", "route53:List*", "route53resolver:Get*", "route53resolver:List*", ]

Create a new role and trust entity

The final step in setting up AWS for Lansweeper Discovery is creating a role and trust entity. You can find detailed instructions in Creating a role using custom trust policies (console).

To configure the role for Lansweeper Discovery:

Select Web identity as the type of trusted entity.
In the Identity provider field, enter https://dev-734bjlip.eu.auth0.com/.
In the Audience field, enter D9vGk9gXUNtrwWdifIe0BWC865gu8oHd.
Make sure to select the custom policy you created earlier.
In Trust relationships, select Edit trust policy.

Add a new action named sts:TagSession similar to:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "<OIDC Provider ARN>"
            },
            "Action": [
                "sts:AssumeRoleWithWebIdentity",
                "sts:TagSession"
            ],
            "Condition": {
                "StringEquals": {
                    "dev-734bjlip.eu.auth0.com/:aud": "D9vGk9gXUNtrwWdifIe0BWC865gu8oHd"
                }
            }
        }
    ]
}

After creating the role, copy the Role ARN and save it for later.

Set up Google Cloud Platform (GCP)

Integrating GCP with Auth0 for Workload Identity Federation involves several steps, ensuring a secure and seamless authentication process without traditional credentials. This setup allows our scanning application to authenticate with GCP services using tokens from Auth0, leveraging federated identities.

Create a Workload Identity Pool

You’ll first need to create a Workload Identity Pool. You can find detailed instructions on creating Workload Identity Pools in Manage workload identity pools and providers.

To configure the Workload Identity Pool for Lansweeper Discovery:

Select the OpenID Connect (OIDC) provider.
In the Issuer URL field, enter https://dev-734bjlip.eu.auth0.com/.
In the Allowed audiences field, enter https://cloud-scanning-api.
For attributes, map google.subject to assertion.sub.
Add a second attribute mapping, and map attribute.site_id to assertion.site_id.
Finally, add the following attribute condition: attribute.site_id == '<your-site-id>'

To allow several Lansweeper Sites to scan your GCP assets with the same credentials, include the OR-operator “||” to your attribute condition.

After creating the Workload Identity Pool, copy the pool ID and save it for later.

Create a service account

Next, you’ll need to create a service account that grants permissions to the application. You can find detailed instructions in Create service accounts.

The Viewer role should be an appropriate role for Lansweeper Discovery. After creating the service account, copy the account email address and save it for later.

Configure roles

Your service account needs access to your organization and folders. You can find detailed instructions on granting the appropriate roles in Manage access to projects, folders, and organizations.

The service account will need the Folder Viewer and Organization Viewer roles.

Configure access to Workload Identity Pool

The Workload Identity Pool needs to be configured to allow impersonation of the service account by the federated identity. You can find detailed instructions in Manage workload identity pools and providers.

In the Attribute name field, select subject and enter D9vGk9gXUNtrwWdifIe0BWC865gu8oHd@clients.

Multiple GCP projects

If you want to scan multiple GCP projects, you will have to grant the Viewer role to the service account you created for every project you want to scan. You can find detailed instructions on granting the appropriate roles in Manage access to projects, folders, and organizations.