Connect a cloud account (CSPM)

786 Cyber can scan your cloud accounts for misconfiguration (public storage, disabled logging, missing MFA, over‑permissive access) and score the findings alongside the rest of your estate. The scanner is Prowler, running CIS and ISO checks.

Provider	What you grant	Status
AWS	A read‑only IAM role, created in one click with Launch Stack ↗	Live
Google Cloud	Two read‑only roles for 786 Cyber’s scanner, granted with a script we generate	Live
Azure	A service principal with Reader + Security Reader	Scanning not available yet. See Azure

Three things are true for every provider, because being asked to grant access to your own cloud reasonably makes people cautious:

Read‑only. 786 Cyber can look at configuration. It can never change or delete anything.
One‑time, per account. You do this once per AWS account or Google Cloud project, not per scan.
Revocable. Remove the role or the grant and access ends.

Where to find it

There are two ways in, and both open the same Cloud Security (CSPM) panel:

Technology & Threats → Cloud Security lists every cloud account in your organisation. Pick one to connect it, check its status or run a scan. If you have no cloud accounts yet, the page is tagged Not configured and offers Add a cloud asset →.
Environment & People → Assets, open a cloud asset, and scroll to its Cloud Security (CSPM) panel.

Before you start

The cloud account must exist as a cloud asset in your Asset Directory. One asset per AWS account or Google Cloud project.
Cloud scanning is plan‑metered: your plan includes a set number of cloud accounts. The panel shows how many you’ve used (for example 1/5 cloud targets enabled), and Enable cloud scan tells you clearly if you’ve reached the limit. See Team & settings for your plan.

The same five steps, every provider

Whatever the provider, the panel works in this order:

Choose the provider and fill in its details, then Save.
Grant access in your cloud, using what the panel gives you (a stack, a script, or instructions).
Test connection. This is required: the scanning controls only appear once the account shows Connected.
Enable cloud scan. This counts the account towards your plan.
Run cloud scan, then Download report ↓ when it finishes.

What “Connected” means today. Test connection checks that the details you entered are complete and correctly formed, then marks the account Connected. It does not yet confirm that 786 Cyber can actually read your cloud; the first scan does that. If a grant is missing or wrong, the scan fails and says why. It is never reported as a clean result.

Connecting AWS

In 786 Cyber

Open the cloud account’s Cloud Security (CSPM) panel, choose AWS and click Save. This generates a unique ExternalId for your organisation, shown in the panel. It’s a shared secret that ensures only your organisation’s connection can use the role.
Click Launch Stack ↗. AWS CloudFormation opens in a new tab with the template and your ExternalId already filled in. There’s nothing to download or upload.

Prefer to do it by hand, or need a specific region? Use Get CloudFormation ↓ instead. It downloads the same template (786cyber-cspm-role.yaml); upload it under CloudFormation → Create stack → Upload a template file. The rest of the steps are identical.

In your AWS console

The Quick create stack page opens in the London (eu-west-2) region with everything pre‑filled. The role is global, so the region doesn’t affect what it can see; it’s only where the small stack lives.
Scroll to the bottom, tick “I acknowledge that AWS CloudFormation might create IAM resources with custom names”, then click Create stack.

This checkbox is required, and it’s the most common place people get stuck. The role has a fixed name, so AWS asks you to acknowledge it. If you can’t create the stack, this is almost always why.

Wait a minute or two for the stack to reach CREATE_COMPLETE.

Back in 786 Cyber

Open the stack’s Outputs tab and copy the RoleArn value. It looks like arn:aws:iam::<your-account-id>:role/786cyber-readonly.
Paste it into IAM Role ARN in the panel and click Update.
Click Test connection. The badge changes to Connected and the Misconfiguration scanning section appears.
Click Enable cloud scan, then Run cloud scan. An AWS scan covers every region and usually takes a few minutes. The button shows Scanning… and locks while it runs, so you can’t start a duplicate.

What the AWS role grants

Two AWS‑managed, read‑only policies: SecurityAudit and ViewOnlyAccess.
The trust is limited to 786 Cyber’s scanner identity and requires your ExternalId. Both must match, or AWS refuses the connection.
No write and no delete. 786 Cyber reads configuration metadata (is MFA on, is logging enabled, is this bucket public), not the contents of your buckets, databases or workloads.
To revoke: delete the CloudFormation stack. Access ends immediately.

Connecting Google Cloud

You grant 786 Cyber’s scanner service account two read‑only roles on your project. There’s no key to create and nothing to paste back.

In 786 Cyber

Open the cloud account’s Cloud Security (CSPM) panel and choose GCP.
Enter your Project ID: the ID, not the display name (for example acme-production, as shown in the Google Cloud console’s project picker).
Granted Service Account is optional and is only a note for your records; the scanner always uses the account in the grant script. Click Save.

Click Get grant script ↓. It downloads 786cyber-cspm-grant.sh, which contains two commands already set to your project and to 786 Cyber’s scanner service account:

gcloud projects add-iam-policy-binding <your-project-id> \
  --member="serviceAccount:<786 Cyber scanner>" --role="roles/viewer"
gcloud projects add-iam-policy-binding <your-project-id> \
  --member="serviceAccount:<786 Cyber scanner>" --role="roles/iam.securityReviewer"

Use the commands from your downloaded script; they have the exact service account address filled in.

In Google Cloud

Open Cloud Shell in the Google Cloud console (or any terminal signed in with gcloud) and run the two commands.

You need permission to change the project’s IAM policy: the Owner or Project IAM Admin role. If a command fails with PERMISSION_DENIED, ask whoever administers the project to run it.

You can check the result under IAM & Admin → IAM: the scanner’s service account should be listed with Viewer and Security Reviewer.

Back in 786 Cyber

Click Test connection. The badge changes to Connected and the Misconfiguration scanning section appears.
Click Enable cloud scan, then Run cloud scan.

What the Google Cloud grant gives

Viewer (roles/viewer) is Google’s basic read‑only role for the project. Security Reviewer (roles/iam.securityReviewer) lets the scanner read IAM policies, which Viewer alone doesn’t show.
No write and no delete. Neither role can change, create or delete anything in your project.
The grant is to one project. Repeat it for each project you want scanned, each as its own cloud asset.
To revoke: remove the two role bindings for the scanner’s service account under IAM & Admin → IAM (or with gcloud projects remove-iam-policy-binding). Access ends immediately.

Azure

You can save an Azure connection today, but you can’t scan an Azure subscription yet.

The panel asks for a Tenant ID, Subscription ID and App (Client) ID for a service principal you register in Microsoft Entra ID with Reader and Security Reader on the subscription. Scanning also needs that service principal’s client secret, and the panel has nowhere to enter it yet. Until it does, an Azure scan can’t sign in.

If you want to be ready, you can register the app and save the three IDs now. Don’t create a client secret until we tell you where to put it. We’ll update this page when Azure scanning opens.

Results

Findings land in the Cloud Posture lane on your Posture dashboard, each scored for severity and prioritised alongside everything else. Until you connect a provider, that lane is tagged Not configured rather than showing a blank or zero score.
The panel shows the last scan’s result: Last scan: N findings with the date, or Last scan failed: [reason] — no results were recorded.
Download report ↓ produces a branded PDF you can share with an auditor or the board.
A scan that fails is always reported as failed, with the reason. An unscanned account is never shown as a clean one.

Turning it off

Disable (next to Misconfiguration scanning) stops scans for that account and frees it from your plan count. The connection stays saved.
Disconnect removes the connection details from 786 Cyber. It does not remove the role or grant in your cloud; do that yourself (delete the AWS stack, or remove the Google Cloud bindings) to end access completely.

Common questions

Do I have to do this for every scan? No. Once per AWS account or Google Cloud project; every later scan reuses the grant.
I have several accounts or projects. Each is its own cloud asset and its own connection. Technology & Threats → Cloud Security lists them all.
Which AWS region should the stack go in? It doesn’t matter. IAM roles are global, and the scan covers all regions.
It says Connected, but the scan failed. Connected means the details are complete, not that access works yet (see above). Check the reason in the panel. The usual causes: the AWS stack wasn’t created or the wrong RoleArn was pasted, or the Google Cloud grant commands weren’t run on that project.
The scan says the runtime isn’t available. Our scanner couldn’t start. Try again shortly, and contact support@786cyber.net if it persists.
Can 786 Cyber change anything in my cloud? No. Every grant above is read‑only.
Is this continuous monitoring? No. Scans run on demand, when you or your team start them.