You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/how-to/aiml-aws-onboard.md
+32-7Lines changed: 32 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,14 +5,11 @@ description: Step-by-step instructions for onboarding an AWS cloud account and A
5
5
6
6
# AWS AI/ML Cloud Onboarding
7
7
8
-
In this section we can find the steps to onboard an AWS cloud account to the AccuKnox SaaS platform.
9
-
10
-
!!! info "AI/ML Prerequisites for AWS Cloud Accounts"
11
-
**Please review the [AI/ML Prerequisites for AWS](https://help.accuknox.com/how-to/cspm-prereq-aws/#aiml-security-prerequisites-for-aws-cloud-accounts) before proceeding with the onboarding process.**
8
+
In this section we can find the steps to onboard an AWS cloud account with AI/ML asset scanning to the AccuKnox SaaS platform.
12
9
13
10
## **AWS IAM User Creation**
14
11
15
-
Follow these steps to provide a user with appropriate read access:
12
+
Follow these steps to create an IAM user with the permissions required for AI/ML asset scanning:
16
13
17
14
**Step 1:** Navigate to IAM → Users and click on Add Users
18
15
@@ -34,7 +31,35 @@ c. Search "SecurityAudit", Filter by Type: "AWS managed - job function" and sele
34
31
35
32
36
33
37
-
**Step 4:** Finish creating the user. Click on the newly created user and create the Access key and Secret Key from the Security Credentials tab to be used in the AccuKnox panel
34
+
**Step 4:** Go to **Add Permissions > Create inline policy** and attach the following policy to grant access to AI/ML services:
35
+
36
+
```json
37
+
{
38
+
"Version": "2012-10-17",
39
+
"Statement": [
40
+
{
41
+
"Sid": "AccuKnoxAIMLPermissions",
42
+
"Effect": "Allow",
43
+
"Action": [
44
+
"bedrock:InvokeModel",
45
+
"bedrock:InvokeAgent",
46
+
"sagemaker:InvokeEndpoint",
47
+
"sagemaker:ListTags",
48
+
"bedrock-agentcore:InvokeAgentRuntime",
49
+
"bedrock-agentcore:StopRuntimeSession",
50
+
"aws-marketplace:Subscribe",
51
+
"aws-marketplace:ViewSubscriptions"
52
+
],
53
+
"Resource": "*"
54
+
}
55
+
]
56
+
}
57
+
```
58
+
59
+
!!! note
60
+
`aws-marketplace:Subscribe` and `aws-marketplace:ViewSubscriptions` are required for invoking certain models (e.g., Claude Opus 4.5) that are distributed through AWS Marketplace.
61
+
62
+
**Step 5:** Finish creating the user. Click on the newly created user and create the Access key and Secret Key from the Security Credentials tab to be used in the AccuKnox panel
38
63
39
64
40
65
@@ -58,7 +83,7 @@ In this example we are onboarding AWS account using the Access Keys method.
58
83
59
84
60
85
61
-
**Step 5:** After giving labels and Tag in the Next Screen Provide the AWS account’s Access Key and Secret Access Key ID and Select the Region of the AWS account. **Ensure to check the box "AI/ML Assets" to enable AI/ML asset discovery** and monitoring. Finally, click on the "Add Account" button to complete the onboarding process.
86
+
**Step 5:** After giving labels and tag, provide the AWS account’s Access Key and Secret Access Key ID and select the region. **Check the "AI/ML Assets" box**to enable AI/ML asset discovery and monitoring. Click "Add Account" to complete onboarding.
Copy file name to clipboardExpand all lines: docs/how-to/aiml-azure-onboard.md
+45-15Lines changed: 45 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,9 +7,6 @@ description: Step-by-step instructions for onboarding an Azure cloud account and
7
7
8
8
In this section we can find the steps to onboard an Azure cloud account to the AccuKnox SaaS platform.
9
9
10
-
!!! info "AI/ML Prerequisites for Azure Cloud Accounts"
11
-
**Please review the [AI/ML Prerequisites for Azure](https://help.accuknox.com/how-to/cspm-prereq-azure/#aiml-security-prerequisites-for-azure-cloud-accounts) before proceeding with the onboarding process.**
12
-
13
10
## **Rapid Onboarding (via Azure)**
14
11
15
12
For Azure Onboarding it is required to register an App and grant Security read access to that App from the Azure portal.
@@ -42,11 +39,17 @@ For Azure Onboarding it is required to register an App and grant Security read a
42
39
43
40
44
41
45
-
**Step 8:** Next, select Application Permissions and then search for Directory.Read.All and click on Add permissions
42
+
**Step 8:** Select Application Permissions and add each of the following permissions:
43
+
44
+
-`Directory.Read.All`
45
+
-`Application.Read.All`
46
+
-`AuditLog.Read.All`
47
+
-`AuditLogsQuery-CRM.Read.All`
48
+
-`AuditLogsQuery.Read.All`
46
49
47
50
48
51
49
-
**Step 9:** Select ‘Grant Admin Consent’ for Default Directory and click on ‘Yes’
52
+
**Step 9:** Select ‘Grant Admin Consent’ for Default Directory and click on ‘Yes’. Confirm all permissions show a Granted status.
50
53
51
54
52
55
@@ -63,22 +66,49 @@ For Azure Onboarding it is required to register an App and grant Security read a
It will look similar to this (use the above listed permissions):
72
81
73
82
74
-
**Step 13:** Next, we need to apply the Reader role.
75
-
83
+
**Step 13:** Apply the following built-in roles to the registered application: **Reader**, **Cognitive Services OpenAI User**, **Cognitive Services User**, and **Storage Blob Data Reader**.
84
+
85
+
For each role:
76
86
77
-
1. Go to the **Azure Portal** → **Subscriptions** (or **Resource Groups**) → select your target scope.
87
+
1. Go to **Azure Portal** → **Subscriptions** (or **Resource Groups**) → select your target scope.
78
88
2. Open **Access control (IAM)** → click **Add > Add role assignment**.
79
-
3. In the **Role** tab, select **Reader**, then click **Next**.
80
-
4. Under **Members**, choose the user, service principal, or group → **Review + assign** to apply the Reader role.
89
+
3. In the **Role** tab, search for and select the role, then click **Next**.
90
+
91
+
*Example: selecting the Reader role*
92
+
93
+
94
+
95
+
*Example: selecting the Storage Blob Data Reader role*
96
+
97
+
98
+
99
+
4. In the **Members** tab, click **Select members** and search for the application you registered.
100
+
101
+
102
+
103
+
5. Select the application (e.g., AccuKnox Azure CSPM Org Scanner) and click **Review + assign**.
104
+
105
+
106
+
107
+
Repeat this process for all four roles.
108
+
81
109
110
+
!!! tip "Using Copilot Studio?"
111
+
If you're integrating with Microsoft Copilot Studio (CP Studio), complete the [Copilot Studio integration steps](https://help.accuknox.com/integrations/copilot-studio/) before proceeding to the AccuKnox SaaS UI onboarding below.
82
112
83
113
## **From AccuKnox SaaS UI**
84
114
@@ -96,7 +126,7 @@ Configuring your Azure cloud account is complete. Now we need to onboard the clo
96
126
97
127
98
128
99
-
**Step 4:** Enter the details that we saved earlier during the steps for app registration and subscription id from subscriptions in azure portal and click on connect. **Ensure to check the box "AI/ML Assets"** to enable AI/ML asset discovery and monitoring.
129
+
**Step 4:** Enter the details saved during app registration (Application ID, Directory ID, Secret Value) and the Subscription ID from the Azure portal. **Check the "AI/ML Assets" box** to enable AI/ML asset discovery and monitoring. Click Connect.
Copy file name to clipboardExpand all lines: docs/how-to/aiml-gcp-onboard.md
+44-28Lines changed: 44 additions & 28 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,96 +5,112 @@ description: Step-by-step instructions for onboarding a GCP cloud account and AI
5
5
6
6
# GCP AI/ML Cloud Onboarding
7
7
8
-
!!! info "AI/ML Prerequisites for GCP Cloud Accounts"
9
-
**Please review the [AI/ML Prerequisites for GCP](https://help.accuknox.com/how-to/cspm-prereq-gcp/#aiml-security-prerequisites-for-gcp-cloud-accounts) before proceeding with the onboarding process.**
10
-
11
-
Here, we will see the steps to onboard a GCP cloud account to the AccuKnox SaaS platform.
8
+
Here, we will see the steps to onboard a GCP cloud account with AI/ML asset scanning to the AccuKnox SaaS platform.
12
9
13
10
!!! note
14
-
Ensure the following API Libraries are enabled in your GCP account before onboarding to AccuKnox SaaS:
11
+
Make sure the following API libraries are enabled in your GCP account before proceeding:
15
12
16
13
1. Compute Engine API
17
14
2. Identity and Access Management (IAM) API
18
15
3. Cloud Resource Manager API
19
16
4. Cloud Functions API
20
17
5. KMS API
21
-
6. Kubernetes API
18
+
6. Kubernetes Engine API
22
19
7. Cloud SQL Admin API
20
+
8.**Vertex AI API** (required for AI/ML asset discovery)
21
+
22
+
GCP onboarding requires IAM Service Account access. You will create two custom roles and a service account with all required permissions.
23
23
24
-
For GCP there is a requirement for IAM Service Account Access.
24
+
## Create Custom Role: Storage Access
25
25
26
-
**Step 1:**Log into your Google Cloud console and navigate to IAM & Admin choose “Roles“ and Click “Create Role“
26
+
**Step 1:** Log into your Google Cloud console and navigate to IAM & Admin, choose "Roles" and click "Create Role".
27
27
28
28
29
29
30
-
**Step 2:**Name the “Role” and Click “Add Permission”
30
+
**Step 2:** Name the role and click "Add Permission".
31
31
32
32
33
33
34
-
**Step 3:**Use the Service: storage filter then value as “storage.buckets.getIamPolicy“
34
+
**Step 3:** Use the Servicefilter set to "storage" and search for "storage.buckets.getIamPolicy".
35
35
36
36
37
37
38
-
**Step 4:**Choose the permission and Click “Add“ then Click Create in the same page.
38
+
**Step 4:**Select the permission, click "Add", then click "Create".
39
39
40
40
41
41
42
-
**Step 5:** In the Navigation Panel, navigate to IAM Admin > Service Accounts.
42
+
## Create Custom Role: Vertex AI Access
43
+
44
+
**Step 5:** Follow the same process (Steps 1–4) to create a second custom role.
45
+
46
+
- Name it something identifiable, such as "AccuKnox-AIML-Role".
47
+
- Add only the permission: `aiplatform.endpoints.predict`
48
+
49
+
This grants the ability to invoke Vertex AI endpoints without granting permissions to manage or deploy them.
50
+
51
+
## Create and Configure Service Account
52
+
53
+
**Step 6:** In the Navigation Panel, navigate to IAM Admin > Service Accounts.
43
54
44
55
45
56
46
-
**Step 6:** Click on "Create Service Account"
57
+
**Step 7:** Click "Create Service Account".
47
58
48
59
49
60
50
-
**Step 7:** Enter any name that you want on Service Account Name.
61
+
**Step 8:** Enter a name for the Service Account.
51
62
52
-
**Step 8:** Click on Continue.
63
+
**Step 9:** Click "Continue".
53
64
54
65
55
66
56
-
**Step 9:**Select the role: Project > Viewer and click Add another Role.
67
+
**Step 10:**Add all of the following roles. Select the first role, then use "Add Another Role" for each additional one:
57
68
58
-
69
+
-**Project > Viewer**
70
+
-**Security Reviewer**
71
+
-**Vertex AI Viewer**
72
+
-**Storage Object Viewer**
73
+
-**Storage Bucket Viewer**
74
+
- Your custom **storage role** (created in Step 4)
75
+
- Your custom **Vertex AI role** (created in Step 5)
59
76
60
-
**Step 10:** Click “Add Another Role” Choose “Custom“ Select the created Custom Role.
77
+
61
78
62
79
63
80
64
-
**Step 11:** Click on “Continue“ and ”Done”
81
+
**Step 11:** Click "Continue" and "Done".
65
82
66
83
67
84
68
-
**Step 12:**Go to the created Service Account, click on that Service Account navigate to the “Keys“ section.
85
+
**Step 12:**Click on the newly created Service Account and navigate to the "Keys" section.
69
86
70
87
71
88
72
-
**Step 13:** Click the “Add key“ button and “Create new key “ . Chosen Key type should be JSON format.
89
+
**Step 13:** Click "Add key" then "Create new key". Select JSON as the key type.
73
90
74
91
75
92
76
-
**Step 14:** Click the “Create“ button it will automatically download the JSON key.
93
+
**Step 14:** Click "Create". The JSON key downloads automatically.
77
94
78
95
## From AccuKnox SaaS UI
79
96
80
-
**Step 1:** Go to the AccuKnox SaaS. Navigate to the “Settings” → “Cloud Accounts” then “Add Account”.
97
+
**Step 1:** Go to AccuKnox SaaS. Navigate to "Settings" → "Cloud Accounts" and click "Add Account".
81
98
82
99
83
100
84
-
**Step 2:**Click the “GCP Platform”
101
+
**Step 2:**Select "GCP Platform".
85
102
86
103
87
104
88
-
**Step 3:**Create New Label and Add the Label for identifying the assets inside this account and add a Tag optionally.
105
+
**Step 3:** Create a new label to identify assets in this account. Optionally add a tag.
89
106
90
107
91
108
92
-
**Step 4:** Enter the “Project ID“, “Client Email”(The Service Account mail ID) and “Private Key” from the downloaded File.
93
-
Copy paste the entire downloaded file into the ”Private Key” field . **Ensure to check the box "AI/ML Assets"** to enable AI/ML asset discovery and monitoring. Then Click “Connect“
109
+
**Step 4:** Enter the "Project ID", "Client Email" (Service Account email), and "Private Key". Paste the entire contents of the downloaded JSON file into the "Private Key" field. **Check the "AI/ML Assets" box** to enable AI/ML asset discovery and monitoring. Click "Connect".
94
110
95
111
96
112
97
-
The cloud account has been onboarded successfully
113
+
The cloud account has been onboarded successfully.
0 commit comments