Skip to content
Ctadel
Menu

Six clouds, one level of coverage

Scaleway, OVHcloud and OUTSCALE are integrated with the same modules, the same graph and the same attack path rules as AWS, Azure and Google Cloud. The table summarises the access requested per cloud; the details follow.

Coverage per cloud
CloudAccess requestedWhat is inventoried
ScalewayAPI key of a dedicated IAM application, with the read-only policies AllProductsReadOnly, IAMReadOnly and OrganizationReadOnly. The organisation and its projects are walked.Instances, Elastic Metal, volumes and snapshots, Object Storage buckets, managed databases, Kapsule, serverless containers and functions, IAM (applications, policies, keys), Key Manager, Secret Manager, load balancers, VPC and gateways, security groups, flexible IPs, domains, container registry.
OVHcloudAPI application with a consumer key limited to GET calls on the paths /me, /cloud/project, /dedicated/server, /domain, /ip and /iam. Optional S3 key pair to read buckets.Public Cloud instances, dedicated servers, volumes and snapshots, buckets, managed databases, Managed Kubernetes, IAM, KMS, SSH keys, networks, DNS, registry, functions.
3DS OUTSCALEDedicated EIM user with a read-only policy (api:Read* and read access to OOS object storage), one entry per region.Virtual machines, OMI images, BSU volumes, security groups, networks, LBU load balancers, OKS, OOS buckets, EIM (users, policies, keys), VPN and DirectLink.
Amazon Web ServicesIAM role created by our CloudFormation template, with the managed policies SecurityAudit and ViewOnlyAccess, an ExternalId and an adjustable session duration; or an access key. The accounts of an organisation can be discovered and added in bulk.EC2, EBS and snapshots, S3, IAM (users, groups, roles, policies, credential report), RDS and clusters, EKS, ECS, ECR, Lambda and its layers, CloudTrail, CloudWatch, KMS, Secrets Manager, GuardDuty, Security Hub, WAF, Shield, CloudFront, API Gateway, SageMaker, Bedrock, DynamoDB, OpenSearch, Glue, EMR, Athena, Cognito, Backup, Route 53, VPC and peerings.
Microsoft AzureService principal (tenant, client, secret) with read access to the subscription.Virtual machines, disks and snapshots, storage accounts, Key Vault and Managed HSM, AKS, SQL, flexible PostgreSQL, Cosmos DB, Entra ID (users, service principals, role assignments), Defender, activity log, Monitor, networks and NSGs, Azure Firewall, Application Gateway, Front Door, API Management, Functions, App Service, Azure OpenAI and cognitive services, Synapse, Data Factory, HDInsight, Recovery Services.
Google CloudService account key, or keyless identity federation (external_account). Optional organisation identifier.Compute Engine, Cloud Storage, IAM and policies, GKE, Cloud SQL, BigQuery, Cloud Functions, Vertex AI, Cloud KMS, Logging, Monitoring, Cloud Armor, Security Command Center, organisation, Pub/Sub, Dataproc, Dataflow, Composer, Artifact Registry, Cloud Build, Memorystore, network firewall.

Detection on audit logs exists for the six clouds in the code and remains under internal validation.

Scaleway

This cloud’s pageConnection guide

Access requested
API key of a dedicated IAM application, with the read-only policies AllProductsReadOnly, IAMReadOnly and OrganizationReadOnly. The organisation and its projects are walked.
What is inventoried
Instances, Elastic Metal, volumes and snapshots, Object Storage buckets, managed databases, Kapsule, serverless containers and functions, IAM (applications, policies, keys), Key Manager, Secret Manager, load balancers, VPC and gateways, security groups, flexible IPs, domains, container registry.

OVHcloud

This cloud’s pageConnection guide

Access requested
API application with a consumer key limited to GET calls on the paths /me, /cloud/project, /dedicated/server, /domain, /ip and /iam. Optional S3 key pair to read buckets.
What is inventoried
Public Cloud instances, dedicated servers, volumes and snapshots, buckets, managed databases, Managed Kubernetes, IAM, KMS, SSH keys, networks, DNS, registry, functions.

3DS OUTSCALE

This cloud’s pageConnection guide

Access requested
Dedicated EIM user with a read-only policy (api:Read* and read access to OOS object storage), one entry per region.
What is inventoried
Virtual machines, OMI images, BSU volumes, security groups, networks, LBU load balancers, OKS, OOS buckets, EIM (users, policies, keys), VPN and DirectLink.

The cloudgouv-eu-west-1 region, qualified SecNumCloud, is inspected like the other regions.

Amazon Web Services

This cloud’s pageConnection guide

Access requested
IAM role created by our CloudFormation template, with the managed policies SecurityAudit and ViewOnlyAccess, an ExternalId and an adjustable session duration; or an access key. The accounts of an organisation can be discovered and added in bulk.
What is inventoried
EC2, EBS and snapshots, S3, IAM (users, groups, roles, policies, credential report), RDS and clusters, EKS, ECS, ECR, Lambda and its layers, CloudTrail, CloudWatch, KMS, Secrets Manager, GuardDuty, Security Hub, WAF, Shield, CloudFront, API Gateway, SageMaker, Bedrock, DynamoDB, OpenSearch, Glue, EMR, Athena, Cognito, Backup, Route 53, VPC and peerings.

Microsoft Azure

This cloud’s pageConnection guide

Access requested
Service principal (tenant, client, secret) with read access to the subscription.
What is inventoried
Virtual machines, disks and snapshots, storage accounts, Key Vault and Managed HSM, AKS, SQL, flexible PostgreSQL, Cosmos DB, Entra ID (users, service principals, role assignments), Defender, activity log, Monitor, networks and NSGs, Azure Firewall, Application Gateway, Front Door, API Management, Functions, App Service, Azure OpenAI and cognitive services, Synapse, Data Factory, HDInsight, Recovery Services.

Google Cloud

This cloud’s pageConnection guide

Access requested
Service account key, or keyless identity federation (external_account). Optional organisation identifier.
What is inventoried
Compute Engine, Cloud Storage, IAM and policies, GKE, Cloud SQL, BigQuery, Cloud Functions, Vertex AI, Cloud KMS, Logging, Monitoring, Cloud Armor, Security Command Center, organisation, Pub/Sub, Dataproc, Dataflow, Composer, Artifact Registry, Cloud Build, Memorystore, network firewall.

What the six clouds share

Every inventoried resource enters the same graph, with the same model of relationships: an account, a project, a network, an identity, a piece of data. Attack path rules and identity analysis therefore apply the same way everywhere, and an identity present in several clouds is recognised as such.

The disk and database copies needed by the Hosts, Vulnerabilities and Data modules happen inside your account, with separate write permissions you may choose not to grant. In that case those modules are simply absent for that account, and nothing else changes.

Ready to see Ctadel on your clouds?

The public demonstration runs on fictitious data. For an instance on your own accounts, request a demonstration.

Request a demonstrationGuided tour