Salesforce Docs Portal

Prepare Cloud and Virtualization Targets for Discovery

Build a current inventory of cloud and virtual infrastructure by preparing provider accounts and VMware vCenter for discovery. Grant read-only access to the resources in scope, verify the required HTTPS connectivity, and capture the authentication details that you use to create discovery credentials and targets.

Required Editions

Available in: Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service that have Discovery enabled.
User Permissions Needed
To manage Discovery: IT Service Asset Discovery
To prepare a cloud or virtualization target: Access to create credentials and assign read-only access in the target environment

Review the fields and supported resources for the target category that you plan to use. For more information about target categories and probe types, see Configuration Fields for Target Categories and Probe Types.

Prepare the Discovery Application host before you configure a VMware vCenter target. For more information about Discovery Application host requirements, see Prepare the Discovery Application Host for Agentless Scans.

Salesforce connects directly to AWS and Azure provider APIs over HTTPS during cloud discovery. The Discovery Application host connects to VMware vCenter Server over HTTPS during vCenter discovery. Cloud API scans collect platform-level resource data. To collect operating system details from cloud virtual machines, prepare the machines for an agentless or agent-based host scan.

  1. Identify the accounts, subscriptions, or vCenter inventory that you want to include in discovery.
  2. Prepare AWS for discovery.
    1. Create or identify a dedicated AWS Identity and Access Management (IAM) user.
      AWS discovery currently supports an IAM user access key ID and secret access key for authentication. IAM roles and assume-role authentication aren't supported.
    2. Assign the required read-only permissions to the IAM user.

      Create an inline policy that contains these permissions:

      {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "ec2:DescribeInstances",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeTags",
        "ec2:DescribeVolumes",
        "ec2:DescribeImages",
        "ec2:DescribeImageAttribute",
        "ec2:DescribeSnapshots",
        "ec2:DescribeRouteTables",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeNetworkAcls",
        "ec2:DescribeNatGateways",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeTargetGroups",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:DescribeRules",
        "elasticloadbalancing:DescribeTargetHealth",
        "elasticloadbalancing:DescribeTags",
        "autoscaling:DescribeLaunchConfigurations",
        "autoscaling:DescribeAutoScalingGroups",
        "autoscaling:DescribePolicies",
        "rds:DescribeDBInstances",
        "rds:DescribeDBClusters",
        "rds:ListTagsForResource",
        "s3:ListAllMyBuckets",
        "s3:GetBucketAcl",
        "dynamodb:ListTables",
        "dynamodb:DescribeTable",
        "dynamodb:ListTagsOfResource",
        "ecr:DescribeRepositories",
        "ecr:DescribeImages",
        "ecr:DescribeImageScanFindings",
        "iam:GetUser"
      ],
      "Resource": "*"
    }
  ]
}

      These read-only discovery actions don't support resource-level scoping, so the policy uses "Resource": "*". This scope doesn't grant write access.

    3. If the IAM user has a permissions boundary, verify that it permits the required discovery actions.

      Use one of these options according to your organization's security policy:

      • Update the boundary to permit the specific read-only actions in the discovery policy. This option follows the principle of least privilege.
      • Use the AWS-managed ReadOnlyAccess policy as the permissions boundary if your organization permits a broader read-only grant.
    4. Create an access key for the IAM user, and record the access key ID and secret access key for the discovery credential.
      Store and rotate the access key according to your organization's credential-handling policy.
  3. Prepare Azure for discovery.
    1. Register an application in Microsoft Entra ID.
    2. Add a client secret to the application.
    3. Assign the built-in Reader role to the application's service principal at the subscription or management-group scope that contains the resources to discover.
      The Reader role provides read-only access to the Azure resources included in Azure cloud discovery.
    4. Record the application ID as the client ID, the directory ID as the tenant ID, and the client secret value for the discovery credential.
  4. Prepare VMware vCenter for discovery.
    1. Create or identify VMware vSphere credentials with read-only access to the vCenter inventory.
    2. Allow HTTPS traffic over TCP port 443 from the Discovery Application host to VMware vCenter Server.
  5. Verify the prepared access for each target environment.
    • For AWS and Azure, verify that the credentials authenticate with the provider API and can list a representative resource in the intended scope.
    • For VMware vCenter, verify that the Discovery Application host reaches VMware vCenter Server over TCP port 443 and that the credentials can access the vCenter inventory.
  6. Store the authentication details according to your organization's credential-handling policy.

The cloud accounts and VMware vCenter environment are ready for discovery scans of the resources that you include in each target.

Create the discovery credentials for the prepared environments. For more information about discovery credentials, see Create Discovery Credentials for Secure Scanning.

Create a discovery target for each prepared environment. For more information about discovery targets, see Create a Discovery Target.