Cloud accounts

Connect your cloud accounts to see what runs in them and how it performs. Tracix discovers resources in AWS, Azure and Google Cloud and lists them in Cloud assets, and collects metrics from Amazon CloudWatch and Azure Monitor. Each connection is an integration from the catalog.

What you can connect

Cloud audit and security logs, such as AWS CloudTrail, VPC Flow Logs and GuardDuty, Azure Activity Log and Google Cloud Audit Logs, and cloud security posture scans are separate integrations in the Security category. See Security.

Agentless or on your collectors

When you connect a cloud integration, you choose under Collection where it runs:

• Agentless: your workspace's cloud gateway, which Tracix runs, collects it. There is nothing to install, and the gateway uses the credentials you give the integration.
• Agent-based: your own collectors collect it. Pick a policy, or create one, under Where to add this integration.

Agentless is the default for cloud integrations. Choose agent-based when the credentials only work from inside your cloud, such as an Azure managed identity.

Connect AWS

1. 1

   Open the connect steps

   In your workspace, open Collectors › Integrations, select Connect account and choose AWS · Auto-discovery to discover resources, or AWS for CloudWatch metrics and logs. Keep Agentless selected.

2. 2

   Copy the principal and External ID

   Leave Credentials at Cross-account IAM role (recommended). The form shows Trust this Tracix principal and an External ID. Tracix issues the External ID for your workspace, from its deployment ID, and sets it on every save: it never changes, and a connection can't use another workspace's. If the principal shows as provisioning, it isn't ready in your workspace yet; you can use a static access key meanwhile.

3. 3

   Create the role in your AWS account

   In IAM, create a role that the Tracix principal may assume, on condition that it passes your External ID:

   jsonCopy

   {
   "Version": "2012-10-17",
   "Statement": [
     {
       "Effect": "Allow",
       "Principal": { "AWS": "<Tracix principal from the form>" },
       "Action": "sts:AssumeRole",
       "Condition": { "StringEquals": { "sts:ExternalId": "<External ID from the form>" } }
     }
   ]
   }

   Attach permissions for what the integration reads: the AWS managed CloudWatchReadOnlyAccess policy for AWS, plus read access to CloudWatch Logs if you collect logs, such as CloudWatchLogsReadOnlyAccess. For AWS · Auto-discovery, grant read-only access to the services you discover, such as the AWS managed ReadOnlyAccess policy.

4. 4

   Give Tracix the role

   Paste the role's ARN into Your role ARN, then Review and Connect.

The gateway assumes your role through the Tracix principal, passing your External ID, and reads only what the role allows. To use a static key instead, set Credentials to Static access key and enter an Access key ID and Secret access key, plus a Session token for temporary credentials. A role is better: Tracix then holds no secret of yours. Saved keys are write-only.

AWS settings

The AWS integration reads up to 500 metrics per namespace.

Connect Azure

1. 1

   Create a service principal

   In your Microsoft Entra ID (Azure AD) tenant, register an application, create a client secret for it, and give it the Reader role on the subscriptions you want to see.

2. 2

   Add the integration

   Open Collectors › Integrations, select Connect account and choose Azure · Auto-discovery, Azure or both.

3. 3

   Enter the credentials

   For Azure · Auto-discovery, enter the Directory (tenant) ID, Application (client) ID and Client secret. List Subscription IDs one per line, or leave it empty to scan every subscription the application can read. For Azure, enter one Subscription ID per connection and set Authentication to Service principal with the same IDs and secret.

4. 4

   Connect

   Select Review, then Connect.

The Azure integration's other choice, Managed identity, works only when the integration runs agent-based on a collector in Azure that has a managed identity. Limit what it collects with Resource types and, under the advanced settings, Resource groups. Leave Resource types empty to collect every type it finds.

Connect Google Cloud

1. 1

   Create a service account

   In your Google Cloud project, create a service account with the Viewer role and download a JSON key for it.

2. 2

   Add the integration

   Open Collectors › Integrations, select Connect account and choose GCP · Auto-discovery.

3. 3

   Enter the key

   Under Service account JSON, upload the key file or paste its contents. List Project IDs one per line, or leave it empty to scan every project the account can read. Then Review and Connect.

See your cloud resources

Open Infrastructure › Cloud. Cloud assets has one card per environment, meaning an AWS account, Azure subscription or Google Cloud project, with its regions, its resource count and when it was last scanned.

Open an environment to see its resources four ways: Infrastructure, Security, List and Containers. The Security view lists security groups and firewall rules. In List, the Monitored column shows which resources are also hosts or clusters Tracix monitors. Use Export PDF to share a view.

CloudWatch and Azure Monitor metrics are available in Insights › Metrics Explorer, where you can chart them and add them to dashboards. CloudWatch Logs are in Insights › Log Explorer, in the aws.cloudwatch dataset.

Change or remove a connection

Open Collectors › Integrations and select the connected tile to edit its settings, disable it or delete it. A connection can have several instances, for example one per AWS region; the edit form lists them under the integration's name.

Removing a discovery integration stops its scans. The resources it found stay in Cloud assets as they were at the last scan.

Next steps