Targeting resources to evaluate

Including resources from another account

To scan resources in another IBM Cloud, you can use the Security and Compliance Center UI to add a target before creating your scope.

1. Create a trusted profile that provides the following access.

   Required permissions for your trusted profile

   Service	Role
   All Account Management services	Viewer Service Configuration Reader
   Kubernetes Service	Reader Viewer Administrator Service Configuration Reader
   All Identity and Access enabled services	Reader Viewer Service Configuration Reader

   The Kubernetes Service access policy is required to run the Red Hat OpenShift Compliance Operator (OSCO) scan when an attachment is created.

2. Add a target account.

   1. From the Security and Compliance Center navigation, click Settings.
   2. In the Targets section, click Add.
   3. Specify a unique name for your target account.
   4. Specify the ID of the account.
   5. Specify the ID of the trusted profile that you created in step 1.
   6. Click Add.

When you create a scope, the account that you added as a target is shown as an option.

Including SaaS services in your scope

Some resources require more access in order for Security and Compliance Center to view all of the configurations associated with it. To evaluate SaaS services, you must add the account in which they reside as a target account. Then, provide an IAM API key that has the required permissions for Security and Compliance Center to be able to perform the evaluation.

Currently, only Watson Machine Learning services require these steps. Additionally, the AI Security Guardrails 2.0 profile is the only profile that's configured for SaaS products.

1. If you don't already have one, create an instance of Secrets Manager.

2. In the IAM UI, make the following configurations.

   1. Go to Manage > Access (IAM) > Service IDs and create a service ID with the Viewer Role on your SaaS service.

   2. From the service ID, create an API key.

   3. Go to Manage > Access (IAM) > Authorizations and create an authorization between Security and Compliance Center and Secrets Manager with the following values.

      • Source: The account ID of the account that contains the Security and Compliance Center instance that you want to use to evaluate.
      • Service: Security and Compliance Center.
      • Resources: The API key that you created in Step 2.
      • Target: Secrets Manager.
      • Resources: The instance ID.
      • Role: SecretsReader.

   4. Create a trusted profile that provides the following access.

      Required permissions for your trusted profile

      Service	Role
      All Account Management services	Viewer Service Configuration Reader
      Kubernetes Service	Reader Viewer Administrator Service Configuration Reader
      All Identity and Access enabled services	Reader Viewer Service Configuration Reader

3. In your instance of Secrets Manager, create an arbitrary or IAM credentials secret to store the API key that you previously created.

   If you are using an arbitrary secret, save the API key as the secret value. If you choose to use an IAM credentials secret, use the service ID that is associated with the API key that you created.

   The secret must remain unlocked for Security and Compliance Center to be able to access and read it.

4. Create a Target.

   1. From the Security and Compliance Center navigation, click Settings.
   2. In the Targets section, click Add.
   3. Specify a unique name for your target account.
   4. Specify the ID of the account.
   5. Specify the ID of the trusted profile that you created in step 1.
   6. Click Add.

5. Assign credentials for your target account.

   1. In the Settings > Targets section, expand the row of your target account.

   2. Click Assign credentials.

   3. On the Select credentials tab, make the following selections. Then, click Next.

      1. Select the instance of Secrets Manager that you want to work with.
      2. Select the secret group that the secret is part of.
      3. Select the type of secret that you created.
      4. Select your secret.

      Alternatively, you can use the Locate by CRN tab to find your secret.

   4. Select the services that you want to evaluate and click Add icon (+) to add them. Then, click Assign.

By completing these steps, you've added the required credentials and your SaaS services will be an option when you create a scope. To start evaluating your resources, you must create an attachment after creating your scope.