Asset sources
An asset source connects a workspace to a cloud. There are six kinds, and every one connects without keys.
Each cloud has two kinds of asset source: one for a whole organization and one for a single account. An organization or tenant holds many accounts (AWS accounts, GCP projects or Azure subscriptions); a single-account asset source holds exactly one.
| Kind | Covers | Credential |
|---|---|---|
| AWS Organization | Every account in the organization | IAM roles with an External ID: a setup role in the management account, and a discovery role in every account |
| AWS account | The account itself | A discovery role with an External ID, from a one-click CloudFormation stack generated for you |
| GCP organization Beta | Every project in the organization | Roles on the organization for your workspace's principal set, which our collector signs in to through workload identity federation, with no key |
| GCP project Beta | The project itself | The same principal set, with roles on the project |
| Azure tenant Beta | Every subscription in the tenant | A managed identity in your tenant, from an ARM template generated for you, whose federated credentials trust only your workspace: no secret, no app |
| Azure subscription Beta | The subscription itself | The same kind of managed identity, from a template that also grants it Reader on the subscription |
No keys, no secrets
AssetHermit never asks for access keys, service account keys or client secrets. Each workspace has its own collector roles in AWS, and every credential you set up trusts only those roles:
- AWS: your IAM roles trust the workspace's asset collector role, and only with their External ID.
- GCP: the collectors exchange their AWS identity for a Google token through workload identity federation.
- Azure: a managed identity in your tenant, from a template we generate, whose federated credentials trust only your workspace. There is no client secret and no app to consent to.
We store only role ARNs, principal set identifiers and tenant IDs. Collectors reach your cloud from fixed IP addresses, which you can allowlist.
Scope
For an organization or tenant, every account is included by default, and new ones are picked up on the next run. You can leave out an OU, folder or management group, or a single account. Every region is included too, and you can list the regions to collect or leave some out, for the whole asset source or for one account. Set the scope while connecting, so the first sync already follows it, or later on the asset source's page. AssetHermit never calls an account or region you've left out.
An account belongs to at most one asset source in a workspace, so you can't connect an account that a connected organization already covers.
Permission checks
When you connect an asset source, and on every sync, AssetHermit checks each permission it needs and names any that's missing, with the fix. A sync that can't read an account still publishes the rest, and keeps that account's assets as they were, marked stale.
Connecting an AWS account or Organization can start with a small stack that only lets AssetHermit read what the account is, so it fills in the organization's details for you, before you update it to the full template.
Keeping templates current
The CloudFormation and ARM templates you deploy are generated for each connection, from what that connection needs. When a release of AssetHermit needs more, such as a new read for a new resource type, the asset source's Permissions tab says the template is out of date, shows what changed, and links to the update.
Costs
Asset sources collect assets only. Cost data comes from cost sources, which you connect on their own, since a cloud's billing rarely matches how you connect its accounts.
Amazon Web Services
| Detail | AWS Organization | AWS account |
|---|---|---|
| Identified by | Organization ID | AWS account ID |
| Set up in your cloud | One CloudFormation stack in the management account, generated for you; its StackSet puts the discovery role in every account, new ones too | A CloudFormation stack in the account |
| Asset permissions | Setup role: organizations:Describe* and organizations:List*. Discovery role, in each account: ViewOnlyAccess and a few reads it leaves out | ViewOnlyAccess and a few reads it leaves out |
Google Cloud
Google Cloud is in beta, on request. Ask for access from the Help menu in the app: it opens a support request.
| Detail | GCP organization | GCP project |
|---|---|---|
| Identified by | Organization number | Project ID |
| Set up in your cloud | Enable the Cloud Asset API on one project, whose quota the calls use | Enable the Cloud Asset API on the project |
| Asset permissions | roles/cloudasset.viewer and roles/browser on the organization, roles/serviceusage.serviceUsageConsumer on that project; roles/monitoring.viewer for usage metrics, optional | roles/cloudasset.viewer, roles/browser and roles/serviceusage.serviceUsageConsumer on the project; roles/monitoring.viewer for usage metrics, optional |
Microsoft Azure
Azure is in beta, on request. Ask for access from the Help menu in the app: it opens a support request.
| Detail | Azure tenant | Azure subscription |
|---|---|---|
| Identified by | Tenant ID | Subscription ID |
| Set up in your cloud | Deploy the template into any resource group, then grant the identity Reader on the root management group | Deploy the template into a resource group of the subscription |
| Asset permissions | Reader on the tenant root management group | Reader on the subscription |