One-off / ad-hoc scan:

• You only need to have Reader access with your user to the Subscription(s) you want to scan. ARGOS will ask you to sign in and ARGOS will use your access to create a temporary connection to Azure.

Service Providers / continuous scans:

• ARGOS requires an Azure AD Application to authenticate to a customer's Azure cloud. You can create one in a few simple steps:
• https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal
• Once you created the Application, go to "API Permissions" and apply the "Organization.Read.All" permissions of "Application" type (not "delegated"). This requires you to grant admin consent for that permission. This permission is used to read basic information about the Azure AD tenant. In the end it will look like this:
  
• Once that is created ARGOS requires at least Reader permissions to each Azure subscription you want to monitor.
• Follow these steps to assign Reader permissions to the Azure AD application from above:
• https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal#add-a-role-assignment

If you want to use ARGOS's remediation feature, then ARGOS also requires the appropriate "write" permissions to the Azure subscription.

ARGOS requires an AWS IAM Role to be created in every AWS account you want ARGOS to monitor.

Follow these steps here to create a role:

• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html#roles-creatingrole-user-console

In your "My Account" page you can find all required information to create the roles, including the ARGOS AWS Account ID and ExternalId for the IAM role's trust policy. The process behind these information is described in this AWS article.

The role requires access to at least the following IAM policies:

• ViewOnlyAccess
• SecurityAudit

Alternatively, check out the link here to find a very specific IAM policy already prepared for you with precisely the permissions required.

If remediation is used from within ARGOS then the IAM role needs access to make required changes. The policies in this case depend on the services being remediated.

In your "My Account" page you can now add an AWS account specifying the following information.

• AWS Account ID(s)
• AWS IAM Role name
• AWS regions to be monitored

ARGOS requires a GCP Service Account to authenticate against an organisation's GCP projects.

Please follow these simple steps to create a GCP Service Account:

• https://cloud.google.com/iam/docs/creating-managing-service-accounts

ARGOS will ask you to upload the Service Account key file that you can download following this process:

• https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys

At a minimum ARGOS requires the Cloud Asset Viewer and Security Center Service Agent (Project) roles in order to execute the real time inventory and security scanning.

These permissions can be assigned at the Project and / or Folder level.

If you want to use ARGOS's remediation feature we will require you to grant ARGOS the appropriate "write" permissions.

In your "My Account" page you can now add the GCP Projects specifying above information.