Getting started with Ctadel
What Ctadel is, how your instance is delivered, and the steps to a first inventory.
Ctadel inspects your cloud accounts through their APIs, links what it finds in a graph and presents findings ranked by severity. This section takes you from the creation of your account to the first finding you read.
What you receive
Your Ctadel instance has its own server, a <customer>.ctadel.eu subdomain, its own databases and its own encryption keys. Nothing is shared with another customer. The instance is created by the Ctadel team; you receive the sign-in address and a first administrator account.
The instance holds the web application, the collectors for the six supported clouds (Scaleway, OVHcloud, OUTSCALE, AWS, Azure, Google Cloud) and the scanners that read disks, buckets, databases and Kubernetes clusters. No agent is installed on your side.
What you need
| Need | Detail |
|---|---|
| An administrator account | Created with the instance. Sign-in with a password of at least twelve characters, then a one-time code received by email. |
| API access to each cloud account | A role, a service principal, a service account or an API key depending on the cloud. Read permissions are enough for the inventory and the configuration. The content analyses of disks and databases create snapshots, copies and temporary machines in your account: they need create and delete permissions on top, which you grant or withhold. The page for each cloud gives the exact permissions. |
| Optional: access to Kubernetes clusters | Obtained through the cloud API for a managed cluster, or through a kubeconfig you provide. On EKS, a dedicated read group is recommended instead of the administrator access the template grants by default; on AKS, Ctadel uses the cluster's admin kubeconfig. |
| Optional: access to Git repositories | A GitHub App or a GitLab OAuth application, installed on the repositories to scan. |
The steps
- Create your account and invite your team.
- Connect a first cloud account and choose which content analyses to allow.
- Let the first inventory run; its duration depends on the number of resources.
- Read a finding and understand its severity, its status and the proposed fix.
Later inventories are scheduled automatically; you can also start one on demand from the application.
Pages in this section
- Create an account and invite your team
The first administrator account, sign-in with a password and an emailed code, invitations, roles and preferences.
- Connect a cloud account
Where to add an account, what each cloud asks for, what Ctadel writes and does not write, and how credentials are stored.
- Connect an AWS account
The IAM role created by CloudFormation template or an access key, the content analysis options, AWS Organizations and what Ctadel reads.
- Connect an Azure subscription
The service principal to create, the Reader role and the extra permissions per analysis, Entra ID and what Ctadel reads.
- Connect a Google Cloud project or organisation
The service account key or identity federation, the roles to grant, organisation mode and what Ctadel reads.
- Connect a Scaleway project
The API key and the IAM policies to attach to it, the organisation and projects, content analyses and what Ctadel reads.
- Connect an OVHcloud project
The API application and the consumer key limited to the needed routes, the optional S3 pair for buckets, and what Ctadel reads.
- Connect an OUTSCALE account
The EIM user, its read policy, the permissions to add for content analyses, one entry per region and what Ctadel reads.
- Connect a Kubernetes cluster
Clusters discovered through a cloud account, clusters connected with a kubeconfig, and the exact permissions to grant the scanner.
- Connect a Git repository
The GitHub App or the GitLab OAuth application, what happens on every push and pull request, and the .ctadel.yaml file.
- First inventory
What starts when you register an account, the phases of a full scan, how to follow it in the application, and what the disk copy writes in your account.
- Reading a finding
The anatomy of a finding in the list and in the detail panel, filters, ignoring with a reason and a duration, and automatic closure.