Connect AWS, Azure or GCP

Before you start

• This is an IT task. It assumes you can sign in to your AWS, Azure or Google Cloud console and create a read-only identity there (an IAM identity, an app registration or a service account). If you do not look after your company’s cloud accounts yourself, do this together with the person who does.
• Cloud Mapping is part of the Advanced plan.
• Your Zonitix role must let you manage Identity Hooks. To see the maps afterwards, you need a role that can view cloud infrastructure. In the built-in set, administrators have that permission, and so do members of the “Security & Compliance” group. The “security_analyst” and “cloud_architect” roles have it too; no group carries them, so an administrator gives one to a person by hand, as Roles, groups and permissions shows.
• Someone who can create a read-only identity in the cloud account you want to map.

In your cloud: create a read-only identity

1. 1

   Step 1: AWS

   Create an IAM identity for Zonitix and attach the AWS-managed “ReadOnlyAccess” policy (or “SecurityAudit”). If you write your own policy, it must still allow listing and reading IAM, or the map’s identity picture is incomplete.

   For an IAM user, create an access key under IAMUsersSecurity credentialsCreate access key. The secret is shown only once, so copy it then.

2. 2

   Step 2: Azure

   In the Azure Portal, go to Microsoft Entra IDApp registrations, click “New registration” and register an app. From its Overview page, copy the “Application (client) ID” and “Directory (tenant) ID”. Under “Certificates & secrets”, click “New client secret” and copy its Value (not its ID).

   Under “API permissions”, add the Microsoft Graph application permissions “User.Read.All” and “Group.Read.All” and grant admin consent. Then give the app the “Reader” role on the subscription you want to map.

   Optional, for the map’s identity risks: “RoleManagement.Read.Directory”, “AuditLog.Read.All” and “Application.Read.All”. Without them those checks stay blank.

3. 3

   Step 3: Google Cloud (GCP)

   In the Google Cloud Console, select the project and note its Project ID. Under IAM & AdminService Accounts, create a service account and give it the “Viewer” and “Security Reviewer” roles on the project. Then open KeysAdd KeyCreate new key, choose JSON and download the file.

In Zonitix: connect it

1. 4

   Step 4: Add the cloud as an Identity Hook

   Go to Access GovernanceIdentity Hooks, click “NEW INTEGRATION”, and pick “AWS IAM”, “Azure AD” or “Google Cloud (GCP)” from the Integration Marketplace. A setup window opens with five steps: Connect, Capabilities, Mapping, Validate, Done.

2. 5

   Step 5: Enter the credentials

   Give it a “Hook Identity Name”, then fill in the connection fields:

   AWS: “Access key ID”, “Secret access key” and “Default region” (pick the region your resources are in). “Role ARN (recommended)” and “External ID (recommended)” let Zonitix assume a role instead; contact Zonitix support before using a role, so the role trusts the right identity. With a role set, the map is read through the role and the keys you enter make the assume-role call; the identity-risk scan, key deactivation and AWS user provisioning still sign with those keys directly, so the key’s own IAM identity needs the permissions for them.

   Azure: “Directory (tenant) ID”, “Application (client) ID”, “Client secret”, and the subscription ID of the subscription to map. Enter the subscription ID if the app can see more than one subscription; otherwise only the first one Azure returns is mapped.

   GCP: “Project ID”, “Default region”, and paste the whole downloaded file into “Service account JSON”.

   Credentials are stored encrypted. Click “Next”.

3. 6

   Step 6: Turn on resource mapping

   On the Capabilities step, switch on “Map cloud resources”. The “Synchronization Interval” on this step is for directory sync, not the map. Click “Next”, leave the Mapping step as it is, and click “Save & validate”.

4. 7

   Step 7: Run the checks

   Click “Run checks”. For AWS and Azure, Zonitix tests “Authenticate” and “Read users” (both must pass), then “Read groups” and “Map cloud resources”. For GCP it tests sign-in only. Click “Finish” (or “Finish anyway” if only optional checks failed).

   On the Done step, check it says “AUTOMATED BACKGROUND SYNC: ACTIVE”. It switches on by itself the first time the checks pass; without it the map is never refreshed on a schedule. Click “Done”.

Scan and read the map

1. 8

   Step 8: Run the first scan

   Open Cloud InfrastructureAWS Resource Map (or Azure or GCP Resource Map). The section appears once a verified hook exists. The first visit starts the scan and shows a progress bar (for AWS, “Initializing Cloud Discovery”). AWS scans every region, so the first scan can take a minute.

2. 9

   Step 9: Set how often it re-scans

   Go to Security & ComplianceSecurity SettingsCloud Mapping. Each cloud has its own block (“AWS Resource Map”, “Azure Resource Map”, “GCP Resource Map”) with its own “Sync Frequency”: “Every 1 Hour”, “Every 4 Hours”, “Daily (Default)” or “Weekly”. Zonitix checks every hour and re-scans a cloud once its last scan is older than the frequency you chose for that cloud.

   To re-scan any map now, click “Force Infrastructure Refresh” on the map.

   Each block shows “ACTIVE” when a verified hook exists for that cloud and “NO ACTIVE HOOK” when none does. There is no switch to turn a map on: connecting the cloud (steps 4 to 7) is what activates it, and “Sync Frequency” appears only once it is active.
3. 10

   Step 10: Read the map

   The header shows “Last synced”. The map opens on “Priorities”, the resources most at risk. A resource where several risks stack up is tagged “TOXIC”. “Inventory” lists everything found; “Network”, “Compute” and “Identity” break it down; “Topology” and “Graph” draw the relationships; “Findings”, “Conflicts” and “Attack Paths” show problems; “Changes” shows what changed since the previous scan, or between any two saved snapshots. “Identity Risks” opens the identity checks, and “View Sync Logs” shows what each scan did.

4. 11

   Step 11: Optional: ask the AI assistant

   “Priorities” has four AI helpers. They run on the AI model inside your own instance, so nothing about your cloud is sent to an outside AI service. They are advice to check, not findings: they never change the list or a severity.

   • Type a question in the box that reads “Ask in plain English”, for example “public S3 buckets”, and click “Ask AI” to filter the resources.
   • Click “Explain with AI” on a priority for a plain-language explanation of that risk.
   • Click “Summarize with AI” for a short list of what to fix first.
   • Click “Find toxic combos (AI)” to look for dangerous combinations beyond the attack paths already listed.

What you should see

If something goes wrong

No Cloud Infrastructure section in the sidebar.

It appears only once a hook for that cloud has passed its checks, and only for roles that can view cloud infrastructure. Re-run the checks from the hook’s row in Identity Hooks.

AWS: Read users fails with an access-denied message.

The keys work but the identity cannot list IAM users. Attach ReadOnlyAccess, or add the action AWS names in the message to your policy, then click Re-run checks.

Azure: "No subscriptions found for this Azure tenant."

The app has no role on any subscription. Give it the Reader role on the subscription, then refresh the map.

Azure: "Subscription … is configured on this hook but is not accessible to the app registration."

The subscription ID is wrong or the app has no Reader role on it. The message lists the subscriptions the app can see; correct the ID or grant the role.

"AI is turned off by your administrator."

The AI helpers on Priorities are switched off for your whole instance, or your role is not allowed to use AI. The rest of the map works without them. An administrator can change this under Security Settings, then AI Model.

AWS: "Showing the last successful scan — the most recent refresh failed: …"

The map is showing older data. Read the reason, fix the access in your cloud, then click Retry.

Still stuck? See When something goes wrong, or Contact Zonitix support.

Where next

• Act on an identity risk in your cloud account
• Run a Security Lab scan
• Get started with the Compliance Hub