Skip to main content

Connect a cloud account

apPosture ships control catalogs for eight providers, but live agentless collection is supported for AWS, GCP and Azure. The other providers (Oracle OCI, Alibaba Cloud, DigitalOcean, Render, Supabase) are evaluated from a pasted snapshot or the built-in demo.

Everything apPosture needs is read-only. Grant a viewer / security-reader identity and nothing more.

Credentials by provider​

ProviderWhat to supplySuggested read-only role
AWSAccess key ID + secret access key (optional session token). Or ambient mode - store no keys and use the host's default credential chain (env / instance role / ~/.aws).SecurityAudit / ReadOnlyAccess
GCPA service-account JSON key + the project id. Identified by the key's client_email.Viewer / Security Reviewer
AzureService principal: tenant id, client id, client secret + subscription.Reader / Security Reader

Secrets are Fernet-encrypted at rest and never returned to the browser; the access key id is treated as a non-secret identifier and shown masked.

Add a managed account​

  1. Open /cloud-posture and choose New scan → Connect, or add it from Admin → Integrations → Cloud Accounts (CSPM).
  2. Pick the provider and enter its credentials.
  3. apPosture verifies them before saving - AWS via STS get-caller-identity, GCP via Resource Manager projects.get, Azure via listing resource groups. Rejected credentials block the save with a clear reason.
  4. Saved accounts appear in the account table with their latest score; re-scan any of them on demand.
No credentials? Start with a snapshot

Choose New scan → Snapshot JSON and paste the output of your own read-only describe / list calls, or Demo to explore the report with sample data. Both run the full control catalog - the demo is clearly labelled so it is never mistaken for real data.

One-off scans vs saved accounts​

  • New scan with live credentials or a snapshot runs once; live credentials are used for that scan only and are never stored.
  • A saved managed account keeps its encrypted secret so you can re-scan it (and it is picked up by continuous re-scanning of stale accounts).

AWS Organizations​

From a management or delegated-admin account, Scan organization enumerates the active member accounts, assumes a read-only role (default OrganizationAccountAccessRole) in each, and runs the standard collector and evaluator across the whole org. Per-account failures are recorded, not fatal, and you get a roll-up of discovered / scanned / failed / average score.

Permissions​

Viewing posture needs view_findings; connecting or scanning an account needs the manage_cloud or run_scans role. A scoped (non-admin) user only sees and scans their own accounts.