Quick Start

Tutorial: Create your first cloud inventory

In this tutorial, you will create a cloud Segment and run a scan so AlloyScan can populate cloud-resource Inventory.

You can use the same flow for AWS, Azure, or Google Cloud. The credential fields and resource types differ by provider.

Preview: Cloud Segments are Preview features. Resource coverage and wizard fields can change between releases.

Before you begin

  • You have an AlloyScan account with the Administrator role on a Site.
  • Cloud Segments are enabled on your deployment.
  • For local execution, an Audit Service is installed and active. For AWS or Azure local execution, its host has the required cloud modules or is allowed to install them.
  • You have the matching cloud credential:
  • AWS — Access key ID and Secret access key.
  • Azure — Tenant ID, Client ID, and Client secret.
  • Google — Project ID, client email, and private key, or JSON key file.

Step 1 - Choose the cloud provider

  1. Open Network > Segments.
  2. Click + New segment.
  3. On the Segment type page, select AWS, Azure, or Google.

Step 2 - Choose execution placement

  1. Click Next.
  2. Under Execution placement, keep AlloyScan cloud worker to scan and audit without a local Audit Service. To use local execution, select Local Audit service and choose an active service.

Step 3 - Select cloud resources

In the provider-specific step, review the generated segment name and select the resource types you want to scan.

Provider Available resources
AWS Database instances, EC2 instances, Images, Key pairs, Load balancers, Network interfaces, S3 buckets, Security groups, Subnets, Virtual private clouds, Zones
Azure Application Gateways, Load balancers, Network interfaces, Public IPs, Resource Groups, Security groups, Subscriptions, Virtual machine instances, Virtual Networks, Volumes
Google Cloud Platform Big Tables, Images, Load balancers, Public IPs, Security groups, Subnets, Virtual machine instances, Virtual private clouds, Volumes

Step 4 - Add or select credentials

  1. In Audit credentials, select an existing matching cloud credential.
  2. Or create a new one:
Provider Credential fields
AWS Title, Access key ID, Secret access key
Azure Title, Tenant ID, Client ID, Client secret
Google Title, Project ID, client email, private key, or JSON key file

Cloud execution uses cloud credentials stored encrypted in AlloyScan. Local execution uses the Audit Service's credential pool. Existing local credentials are not transferred automatically.

Step 5 - Choose a scan schedule

Choose a recurring scan schedule, or continue without a schedule for a first manual run. For cloud execution, Cloud start window (minutes) allows the scan to start within the specified window after its scheduled time (default 240 minutes).

For a first setup, it is often simpler to continue without a schedule, run one manual scan, verify the results, and add the schedule after the cloud scope is correct.

Step 6 - Run the first cloud scan

  1. Save the Segment.
  2. Open the new Segment from Network > Segments.
  3. Click Scan.
  4. Wait for the Scan Results grid to populate.

Step 7 - Verify cloud Inventory

Open Inventory and check the matching cloud section.

Expected resource families include:

Provider Examples
AWS EC2 instances, AMIs, Subnets, Zones, RDS, Key pairs, Network interfaces, Load balancers, S3 buckets, VPCs, Security groups
Azure Virtual machines, Application gateways, Load balancers, Network interfaces, Public IPs, Resource groups, Security groups, Subscriptions, Virtual networks, Volumes
Google VM instances, Bigtable resources, Images, Load balancers, Public IPs, Security groups, Subnets, VPCs, Volumes

What you have accomplished

You created a cloud Segment, authenticated AlloyScan to the provider, ran a scan, and verified that cloud resources appear in Inventory.

From here, you can:

  • add a scan schedule for the cloud Segment
  • enable Change tracking for cloud asset categories where needed
  • review Analytics charts and Inventory exports for the discovered cloud resources