Scanner settings

Reading disks creates a short-lived machine in your cloud account (see Agentless). By default, that machine gets a public address and the Ctadel instance reaches it over SSH. The "Disk scanner network (optional)" section of each account lets you place it in a chosen subnet, without a public address, or drive it through AWS Systems Manager. This page describes these settings and what is created in your account.

Where the section is

Open "Settings", "Integrations" tab, "Cloud Providers" sub-tab, then "Add account" or the edit dialog of an existing account. The section is collapsed as long as nothing is set and shows "Default"; once a field is filled in, it shows "Custom". Its introduction reads: "Where the temporary VM that reads this account's disks runs. Leave empty to use the stack's defaults (public address, SSH, subnet chosen by the cloud)."

The settings belong to each cloud account and hold no secret. The section appears only for AWS, OUTSCALE and Google Cloud; the fields differ by cloud.

Field	AWS	OUTSCALE	Google Cloud
"Subnet per region or zone"	Yes	Yes	No
"Public address"	Yes	Yes	Yes
"Connection" (SSH or SSM), "Instance profile (SSM)", "Artifact bucket (SSM, optional)"	Yes	No	No

An account with settings of its own borrows nothing from the instance's defaults: a subnet, a profile or a bucket belong to one account only. Fields left empty take the defaults (public address, SSH, subnet chosen by the cloud).

The fields

Subnet per region or zone

One line per location: "Region or zone" (eu-west-3 or eu-west-3a on AWS, eu-west-2a on OUTSCALE) and "Subnet ID" (subnet- followed by 8 or 17 hexadecimal characters). At scan time, the volume's zone is looked up first, then its region; a location without a line lets the cloud choose. The same region or zone cannot appear twice, and each line must be complete.

Public address

"Default (public)", "Public address" or "Private address only". With a private address, the Ctadel instance reaches the machine through its internal address: a network path between the instance and your VPC is needed (peering, VPN, Direct Connect), unless SSM is used. The interface says so: "A private address or a private subnet requires a network path between the Ctadel stack and that VPC (peering, VPN, Direct Connect), unless SSM is used." On OUTSCALE, a private address requires at least one subnet. On Google Cloud, the network and subnetwork are the instance's; only the external address choice is set per account.

Connection, instance profile and artifact bucket (AWS)

"Default (SSH)", "SSH" or "AWS Systems Manager (SSM)". With SSM, the machine is driven by Systems Manager Run Command: it needs neither a public address, nor an inbound rule, nor a private path to the instance; its agent calls the ssm, ssmmessages and ec2messages endpoints, public or through VPC endpoints.

• "Instance profile (SSM)": name or ARN of an instance profile holding AmazonSSMManagedInstanceCore. Required with SSM; the scan is refused before anything is created when the profile is missing. Ctadel's CloudFormation template creates it with the EnableSSMTransport=true option, which also grants iam:PassRole and ssm:SendCommand to the scanning role.
• "Artifact bucket (SSM, optional)": an S3 bucket of your account where the scanner and its rules are staged, read through a presigned URL from the machine, then deleted at the end of the scan. Without a bucket, the scanner is sent through the SSM commands themselves: it works, but the upload is slow.

Values are checked as you type and again by the server before saving; an invalid setting is refused with the matching message, for example "The SSM connection requires an instance profile."

How the instance reaches the machine

Over SSH, the security group (AWS, OUTSCALE) or firewall rule (Google Cloud) created for the scan opens port 22 to the Ctadel instance's egress range only, never to the Internet. That range is either fixed by Ctadel when the instance is configured or discovered automatically; if it cannot be determined, the scan fails rather than opening the port. Under SSM nothing comes in: the agent calls out.

For each scan, a fresh login key pair and a fresh SSH host key are generated. The machine receives them through its user data at boot, and the Ctadel instance accepts no other host key: anything sitting between the instance and the machine cannot pose as the scanner.

What is created and then deleted in your account

Cloud	Resources created for one scan
AWS	A snapshot, a volume, an imported key pair, a security group, an Ubuntu 22.04 instance; with SSM and an artifact bucket, objects in that bucket
OUTSCALE	A snapshot, a volume, a key pair, a security group, a virtual machine
Google Cloud	A snapshot, a disk, a firewall rule, an instance
Azure	A ctadel-scan-<region> resource group with its virtual network, created once per region when missing; then, per scan, a snapshot, a disk, a network security group, a virtual machine
Scaleway	A snapshot, a volume, a security group, an instance
OVHcloud	A snapshot, a volume, an instance; no key is registered through the cloud API

Everything is deleted at the end of the scan, in reverse order of creation, on success as on failure, cancellation or an unexpected stop of the scan. Resources are marked: tag ctadel-managed=true and name ctadel-scanner-ephemeral on AWS and OUTSCALE, label ctadel-managed=true on Google Cloud and Azure, tags ctadel-scanner and ephemeral on Scaleway, names prefixed ctadel-snap-, ctadel-vol- and ctadel-scanner- on OVHcloud. A sweep, at most once an hour per account, removes resources so marked for more than two hours that an abrupt stop would have left behind. These resources are billed to you by your cloud for as long as they exist. The permissions needed are described in Permissions requested.

Limits

• Per-account settings exist only for AWS, OUTSCALE and Google Cloud. On Azure, the machine boots in the ctadel-scan-<region> resource group; on Scaleway and OVHcloud, in the project; these locations cannot be set in the interface.
• The SSM transport exists on AWS only.
• On Google Cloud, the scanner's network and subnetwork are fixed for the whole instance by Ctadel; an account cannot choose its own.
• A private address without SSM assumes a network path between the Ctadel instance and your VPC; Ctadel does not create it. Without that path, the alternative is not to grant the disk-copy permissions (snapshots, volumes, ephemeral machines; EnableDiskScanning set to false in the AWS template): the rest of the inventory keeps working, without vulnerabilities, secrets, data or HCR on machine disks.
• The scanner machine installs its analysis tools from public repositories and checks Internet access before listing packages; in a subnet without egress, the disk's vulnerabilities are not evaluated.
• Settings apply to the next scan; a scan in progress keeps its placement.
• There is no connectivity test from the interface: an unreachable subnet shows up as a failed scan.