Connect an OUTSCALE account
The EIM user, its read policy, the permissions to add for content analyses, one entry per region and what Ctadel reads.
This page describes the EIM user to create so that a 3DS OUTSCALE account is inventoried, the policy to link to it, and what the collector reads.
What you need
The OUTSCALE API is regional: every call targets api.<region>.outscale.com. One Ctadel account therefore corresponds to one OUTSCALE account in one region; create one entry per region to analyse.
| Region | Use |
|---|---|
eu-west-2 | Paris. Default value. |
cloudgouv-eu-west-1 | SecNumCloud-qualified region. |
us-east-2, us-west-1, ap-northeast-1 | Other regions. |
You need the account id (twelve digits, in Cockpit under "Account") and an EIM access key.
Creating the user and its policy
- In Cockpit or with
osc-cli, create an EIM userctadel-scannerwithout console access. - Create a managed policy from the
outscale-readonly-policy.jsondocument handed to you by the Ctadel team and link it to the user:
osc-cli api CreatePolicy --PolicyName CtadelReadOnly --Document "$(cat outscale-readonly-policy.json)"
osc-cli api LinkPolicy --PolicyOrn <POLICY_ORN> --UserName ctadel-scanner- Create an access key, with an expiry date if you wish, and note the secret: it is never returned again.
osc-cli api CreateAccessKey --UserName ctadel-scanner --ExpirationDate <ISO_8601_DATE>The policy grants only the api:Read* actions of the OUTSCALE API and seven OOS bucket configuration reads: oos:ListAllMyBuckets, oos:GetBucketLocation, oos:GetBucketAcl, oos:GetBucketVersioning, oos:GetBucketEncryption, oos:GetBucketLogging and oos:GetBucketPolicy. Check the OOS action names against the EIM reference of your version.
Content analyses
| Analysis | Permissions to add | What Ctadel does |
|---|---|---|
| Virtual machine disks | api:CreateSnapshot, CreateVolume, LinkVolume, UnlinkVolume, CreateVms, DeleteVms, CreateKeypair, DeleteKeypair, CreateSecurityGroup, CreateSecurityGroupRule, DeleteSecurityGroup, CreatePublicIp, LinkPublicIp, UnlinkPublicIp, DeletePublicIp, DeleteVolume, DeleteSnapshot, CreateTags. | A snapshot of the BSU volume, a volume recreated in the same subregion, a temporary Ubuntu machine with a throwaway keypair and a security group open on port 22 to the egress address of your Ctadel instance only, a public address unless placed privately; then everything is deleted. Every temporary resource carries the ctadel-managed tag and a ctadel-scanner name. |
| OOS bucket content | Object reads (oos:GetObject, oos:ListBucket), absent from the provided policy. | Objects are read on oos.<region>.outscale.com with the same access key. |
| OKS cluster objects | Covered by the access key: the OKS API authenticates with the same key. | Each cluster's kubeconfig is obtained with GET /clusters/<id>/kubeconfig on api.<region>.oks.outscale.com, then the cluster objects are read. |
The placement of the scanner machine (subnet per subregion, private address) is set per account in the "Disk scanner network (optional)" section of the dialog; see Scanner settings.
Declaring the account in Ctadel
- Open "Settings", tab "Integrations", sub-tab "Cloud Providers", then "Add account" on the 3DS OUTSCALE row.
- Enter a "Label" and the account id under "Account ID / Project ID".
- Choose the "Region".
- Enter the "Access Key" and the "Secret Key".
- Click "Create". Repeat for each region.
Credentials are not checked on entry. At the first scan, the collector calls ReadAccounts: if the key belongs to an account other than the one entered, the scan stops with the error "the access key belongs to account X, not Y"; if the id was left empty, it is filled from the key.
What the collector reads
| Family | Resources read |
|---|---|
| Identities | EIM users, groups and policies (document analysed), access keys with their age and expiry, API access policy and rules. |
| Compute | Virtual machines, OMI images (public or cross-account sharing, age). |
| Network | Nets, subnets and their route to the Internet, internet services and NAT services, peerings, security groups and their rules, LBU load balancers and server certificates, VPN connections (tunnel state, routes), DirectLink (BGP key of interfaces). |
| Storage | BSU volumes and snapshots (public sharing), OOS buckets (public ACL, versioning, encryption, logging). |
| Kubernetes | OKS clusters. |
If reading one resource family fails, the others are inventoried; the resources of that family already known stay in the inventory and are not treated as deleted.
Limitations
- One entry covers one region; an account present in several regions needs as many entries.
- Ctadel analyses no databases on OUTSCALE.
- The provided policy does not allow reading bucket content; add object reads if you want it.
- EIM exposes no per-user MFA state: Ctadel does not evaluate it on OUTSCALE.
- A policy whose document or links cannot be read, or a bucket for which a call fails, is skipped for the current scan.
- A deleted or deleting VPN connection, which the API still lists for a while, is not inventoried.
- If the scan runs with the root account's keys, they are inventoried on a root user; prefer the dedicated EIM user.
- Detection on API logs (
ReadApiLogs) is under internal validation, not available to customers.