Connect a cloud account
Where to add an account, what each cloud asks for, what Ctadel writes and does not write, and how credentials are stored.
This page explains how a cloud account is added to Ctadel, what is common to the six clouds and where to find the details specific to each.
Where to add an account
Open "Settings", tab "Integrations", sub-tab "Cloud Providers". The page lists the "Connected accounts" and then the "Catalogue", which offers Scaleway, Amazon Web Services, Microsoft Azure, OVHcloud, 3DS OUTSCALE and Google Cloud Platform. The "Add account" button opens the "Add account" dialog for the chosen cloud.
The "Update" permission of the "Settings" domain is required; the "Global Admin" role has it.
Each account gets a free-form "Label" (for example "Scaleway — Production") and a scope identifier in the "Account ID / Project ID" field: a Scaleway project, an AWS account, an Azure subscription, a Google Cloud project, an OVHcloud project or an OUTSCALE account.
What each cloud asks for
| Cloud | Credential requested | Checked on entry |
|---|---|---|
| AWS | A role to assume ("Role ARN" and "External ID"), created by the CloudFormation template we provide; or an "Access key". | Yes: the role is assumed, then the organisation's accounts are listed. |
| Azure | A service principal: "Tenant ID", "Client ID (App ID)", "Client Secret", "Subscription ID". | Yes: a token is requested, then the visible subscriptions are listed. |
| Google Cloud | A "Service Account Key (JSON)", either a service account key or a workload identity federation file; optional "Organization ID". | Partly: only the project id in the file is read, with no API call. |
| Scaleway | An API key: "Access Key" and "Secret Key". | Yes: the organisation's projects are listed. |
| OVHcloud | An API application: "Application Key", "Application Secret", "Consumer Key"; an optional "Object Storage S3 access key" pair to read bucket contents. | No: the credentials are checked at the first scan. |
| OUTSCALE | The access key of an EIM user: "Access Key", "Secret Key", and the "Region"; one entry per region to scan. | No: the account id is checked at the first scan. |
Read permissions for the inventory, write permissions for content analyses
The inventory collectors never write to your cloud: they call describe and list APIs. The permissions to grant for this inventory are given on each cloud's page.
Four analyses read the content of your resources rather than just their configuration. Two of them create resources in your account: Ctadel's access is read-only only if you do not grant them. Each needs extra permissions that you grant or withhold independently of the others:
| Analysis | What Ctadel does | What you lose without it |
|---|---|---|
| Virtual machine disks | A snapshot of the volume, a copy, then a temporary scanner machine that reads the copy inside your account. Disk content never leaves your perimeter. Write permissions: creating and deleting snapshots, volumes, instances, key pairs and security groups, with deletion limited to Ctadel-tagged resources. | Vulnerabilities, secrets, sensitive data and host compliance found on disks. |
| Databases | A temporary copy restored from a snapshot, read, then deleted. The production instance is never modified. Write permissions: creating snapshots, restoring and modifying a temporary instance, with deletion limited to Ctadel-tagged resources. | Classification of the data inside databases; their posture (public access, encryption, backups) is still read. |
| Buckets | Reading objects in place, and decrypting them when a key you manage protects them. No write. | Secrets and sensitive data inside objects; bucket posture is still read. |
| Kubernetes | Registering Ctadel as an identity of the cluster. On EKS, this automatic registration associates the cluster administrator policy; creating the access yourself with the ctadel-scanner group limits the permissions to reading (see Connect a Kubernetes cluster). | Nothing, if you create the access yourself. |
The temporary resources created for these analyses carry a Ctadel tag. On the account's next scan, the disk scanner removes those older than two hours that an interruption left behind; this sweep only happens during a scan, when Ctadel holds the account's credentials. On AWS, these four analyses are the EnableDiskScanning, EnableDatabaseScanning, EnableBucketScanning and EnableKubernetesAccess parameters of the template; the other clouds express them as separate roles or credentials, described on their page.
How credentials are stored
An account's credentials are encrypted with AES-256-GCM before they are written to Ctadel's database, with a key specific to your instance, generated when it is created. They are decrypted only to be handed to the collectors when a scan starts. The interface never shows them again: in the "Edit account" dialog, secret fields read "(unchanged if empty)".
For an AWS account declared with a role, no permanent secret is kept: at the start of each scan, Ctadel assumes the role with the external ID and receives temporary credentials. The requested session lasts twelve hours, or one hour if the role does not allow more. Deleting the role in your account cuts the access.
Discovery and bulk creation
The "Discover Subscriptions" (Azure) or "Discover" (other clouds) button queries the cloud with the entered credentials. On Scaleway, Azure and AWS this is also the validity check: a refused key returns the cloud's error instead of an empty list.
On AWS, if the role lives in an organisation's management account and may list its accounts, discovery returns every active account; the "Add the N accounts" button creates them all at once, each with a role of the same name in the member account. Without that permission, discovery falls back to the current account.
On Google Cloud, OVHcloud and OUTSCALE, discovery makes no call: it returns the id read from the file or typed in the form.
Projects and folders
Each cloud account is a project in Ctadel's sense: the scope a role can be limited to and the scope pages filter on. A newly created account is filed in the system folder for unfiled accounts; you can then move it in the "Folders" tree of the same tab. See Projects and folders.
After creation
A first scan is triggered on creation. The account appears under "Connected accounts" with its state: "Pending", "Syncing...", then "Connected", "Partial scan" (some collectors failed; the last error shows on hover) or "Error". Later scans follow the instance schedule; see First inventory.
From the same list you can edit the account, disable it (a disabled account is no longer scanned) or delete it after "Confirm".
For AWS, OUTSCALE and Google Cloud, the dialog contains a "Disk scanner network (optional)" section: subnet, private address, transport. It is described in Scanner settings.
Pages per cloud
Limitations
- OVHcloud and OUTSCALE credentials are not checked on entry; an error only shows at the first scan, in the account's state.
- On Google Cloud, discovery does not list an organisation's projects; organisation mode goes through the "Organization ID" field, described on the cloud's page.
- There is no button to rerun or test a single account from this list; a full scan is started from the "General" tab, "Scan now".