How-to guides

• 1: Dashboard Check
• 2: Diagnosis Result Management
• 3: Setting up the Cloud

1 - Dashboard Check

Users can check the diagnostic results of the Config Inspection service at a glance on the dashboard through the Samsung Cloud Platform Console.

Check Dashboard

On the dashboard page, you can check the diagnosis status and history of Config Inspection, etc.

To check the dashboard, follow the next procedure.

1. 모든 서비스 > Security > Config Inspection menu is clicked. It moves to the Service Home page of Config Inspection.
2. On the Service Home page, click the Dashboard menu. It moves to the Dashboard page.
3. Dashboard page where you can check the summary information of the diagnosis result.
   • Dashboard page, you can check the dashboard information based on the period or diagnosis name at the top.

• Period: You can check the summary information of the diagnosis results by setting a period within 6 months based on this month.

• Diagnosis Name: If you select all, you can summarize the entire diagnosis result, and if you select a diagnosis account, you can check the detailed history of the diagnosis result.

  • Download button allows you to download the information displayed on the dashboard page as a PDF file.

  Division	Detailed Description
  Security Level (Total)	The average value of the latest diagnosis results of all diagnosis targets is displayed The latest diagnosis results are listed Diagnosis score calculation formula = Total - (Fail + Error + Check)) / Total x 100
  Diagnostic Status by Period	Displays diagnostic status by target during the search period Diagnosis Completed: Displays recent diagnosis completion records Diagnosis Error: Displays recent diagnosis error records, and moves to the detailed diagnosis result page when selecting a diagnosis name
  Summary of diagnostic results by period (all)	Displays summary information of diagnostic results (all) during the search period Selecting a diagnosis name from the list moves to the diagnostic result details page

  Table. Detailed description of dashboard items for overall diagnosis results

  Classification	Detailed Description
  Security Level	The last diagnosis result score of the selected diagnosis account is displayed The latest diagnosis result is displayed in the list
  Periodic diagnosis result summary	Display a summary of the diagnosis results of the last diagnosis account during the search period
  Vulnerability Status by Period	Displays the vulnerability diagnosis results of the diagnosis account during the search period in a graph Displays detailed information of vulnerable items in the diagnosis results when selecting a graph
  Fig. Detailed description of dashboard items for diagnostic results by diagnostic account

2 - Diagnosis Result Management

You can check the Config Inspection diagnosis request results on the diagnosis result page and change the diagnosis results.

Checking Diagnosis Results

On the diagnosis result page, you can check the results of the diagnosis request.

Checking the Diagnosis Result List

To check the diagnosis result list, follow these steps:

1. Click All Services > Security > Config Inspection. You will be taken to the Service Home page of Config Inspection.
2. On the Service Home page, click Diagnosis Result. You will be taken to the Diagnosis Result List page.
3. On the Diagnosis Result List page, check the summary information of the diagnosis results.

   Category	Detailed Description
   Diagnosis Name	Resource Name
   Diagnosis Account	Console information that is the target of diagnosis
   Checklist	A collection of diagnosis items that serve as the basis for the diagnosis result
   PASS	The number of items in the checklist with a diagnosis result of PASS (normal)
   FAIL	The number of items in the checklist with a diagnosis result of FAIL (vulnerable)
   CHECK	The number of items in the checklist with a diagnosis result of CHECK (requires verification)
   ERROR	The number of items in the checklist with a diagnosis result of ERROR (diagnosis not possible)
   N/A	The number of items in the checklist with a diagnosis result of N/A (not applicable)
   Total	The total number of items in the checklist
   Diagnosis Result	The result of the diagnosis request Completed: The diagnosis request was completed normally Error: The diagnosis request was not completed normally, and the error status items cannot be checked in detail
   Diagnosis Time	The time the diagnosis request was made

   Table. Diagnosis Result List Items

Checking Detailed Diagnosis Result Information

To check the detailed information of the diagnosis result, follow these steps:

1. Click All Services > Security > Config Inspection. You will be taken to the Service Home page of Config Inspection.

2. On the Service Home page, click Diagnosis Result. You will be taken to the Diagnosis Result List page.

   • You can search for diagnosis results by entering the diagnosis name in the search area of the Diagnosis Result List page or by clicking the Detailed Search button.

3. On the Diagnosis Result List page, click on an item with a diagnosis result of Completed. You will be taken to the detailed diagnosis result page.

   • Items with a diagnosis result of Error do not display detailed information.

4. On the Detailed Diagnosis Result page, check the detailed diagnosis results.

   Category	Detailed Description
   Excel Download	Download the detailed diagnosis result list as an Excel file
   More > Diagnosis Result Management	Move to the diagnosis result management page
   Checklist	A collection of diagnosis items that serve as the basis for the diagnosis result
   Area	The scope of diagnosis (Samsung Cloud Platform services)
   Diagnosis Item	Security standards recommended for service settings
   Result	The result of checking the diagnosis item

   Table. Detailed Diagnosis Result Items

5. Click on the diagnosis item you want to check in detail. The Diagnosis Item Details popup window will appear.

   • In the Diagnosis Item Details popup window, you can check the following information:

       | Category | Detailed Description |
       |---------|---------|
       | Area | The scope of diagnosis (Samsung Cloud Platform services) |
       | Diagnosis Item | Security standards recommended for service settings |
       | Result | The result of checking the diagnosis item |
       | Diagnosis Criteria | The criteria for determining the result |
       | Diagnosis Method | The method for checking the current settings |
       | Countermeasure Guide | The method for setting the security standards |
       | Detailed Result | Information about the resources and settings corresponding to the diagnosis item |
       | Change Diagnosis Result | A button to change the diagnosis result |
       <div class="figure-caption">
         Table. Config Inspection Diagnosis Item Details
       </div>
     

Managing Diagnosis Results

The diagnosis result page allows you to change the results of items with a CHECK status.

Changing Diagnosis Results

To change a diagnosis result, follow these steps:

1. Click All Services > Security > Config Inspection menu. You will be directed to the Config Inspection Service Home page.

2. Click the Diagnosis Result menu on the Service Home page. You will be directed to the Diagnosis Result List page.

3. Click an item with a completed diagnosis result on the Diagnosis Result List page. You will be directed to the Diagnosis Result Detail page.

   • Items with an Error status will not display detailed information.

4. Click the Diagnosis Result Management button at the top of the Diagnosis Result Detail page. You will be directed to the Diagnosis Result Management page.

5. Click the Result Change button for the item you want to change the diagnosis result for** on the Diagnosis Result Management page. You will be directed to the Result Change popup window.

6. Select or enter the required information for the result change in the Result Change popup window.

   Category	Required	Description
   Register	-	Email of the person changing the diagnosis result
   Valid Period	Required	Set the valid period for the diagnosis result
   Result Change	Required	Select the new diagnosis result (Pass, Check, Fail)
   Detailed Reason	Required	Enter a detailed reason for changing the result
   Attachment	Optional	Upload a file required for result change confirmation Click the File Attachment button to upload a file, up to 5 files can be registered
   Inspection Result	-	Display detailed inspection results

   Table. Detailed Items for Changing Diagnosis Results

7. Confirm the entered information and click the Register button. Verify that the diagnosis result has been changed in the Diagnosis Result Management list.

Deleting Diagnosis Result Change History

To delete the diagnosis result change history, follow these steps:

1. Click All Services > Security > Config Inspection menu. You will be directed to the Config Inspection Service Home page.
2. Click the Diagnosis Result menu on the Service Home page. You will be directed to the Diagnosis Result List page.
3. Click an item with a completed diagnosis result on the Diagnosis Result List page. You will be directed to the Diagnosis Result Detail page.
   • Items with an Error status will not display detailed information.
4. Click the Diagnosis Result Management button at the top of the Diagnosis Result Detail page. You will be directed to the Diagnosis Result Management page.
5. Click the Result Confirmation button for the item you want to delete the diagnosis result change history for** on the Diagnosis Result Management page. You will be directed to the Result Confirmation popup window.
6. Click the Delete button in the Result Confirmation popup window.

3 - Setting up the Cloud

To use the Config Inspection service through the Samsung Cloud Platform Console, users must set up cloud prerequisites, such as generating authentication keys and adding access control IPs.

Setting up the Samsung Cloud Platform Console

To diagnose the Samsung Cloud Platform and external clouds using the Config Inspection service, configure the following items.

Checking policies connected to user groups

To check the policies of the user group you belong to, follow these steps:

1. Click All Services > Management > IAM. You will be taken to the Service Home page of IAM.
2. On the Service Home page, click User Group. You will be taken to the User Group List page.
3. On the User Group List page, click the user group you want to check. You will be taken to the User Group Details page.
4. On the User Group Details page, click the Policy tab. You will be taken to the Policy tab page.
5. On the Policy tab page, click the policy you want to check. You will be taken to the Policy Details page.
6. On the Policy Details page, check the detailed information.

Generating authentication keys

You can check and generate authentication keys to be used for the Config Inspection service.

To generate an authentication key in the Samsung Cloud Platform Console, follow these steps:

1. Click My Menu > My Info. You will be taken to the My Info. details page.
2. On the My Info. details page, click the Authentication Key Management tab. You will be taken to the Authentication Key Management tab page.
3. On the Authentication Key Management tab page, click the Create Authentication Key button. You will be taken to the Create Authentication Key page.
   • On the authentication key management page, you can check the list of authentication keys.
4. On the Create Authentication Key page, enter the expiration period and click the Confirm button.
5. Check if the created authentication key is displayed in the authentication key list.

Adding Allowed Access IP

You can add an allowed access IP in the Samsung Cloud Platform Console.

To add an allowed access IP in the Console, follow these steps:

1. Click the My menu > My info. menu in the Console. You will be moved to the My info. detail page.
2. Click the Authentication key management tab on the My info. detail page. You will be moved to the Authentication key management tab page.
3. On the Authentication key management tab page, click the Modify icon in the Security settings section. The Modify authentication key security settings popup window will open.
4. In the Modify authentication key security settings popup window, enter the authentication method and allowed access IP.
   • Select Authentication key as the authentication method.
   • Set the allowed access IP to Use and enter the IP address, then click the Add button.
5. Once the allowed access IP is added, click the Confirm button. Verify that the information entered in the Security settings section has been modified.

Setting up AWS

To diagnose the AWS (Amazon Web Services) cloud in the Config Inspection service, set up the following items.

Adding Permission Policy

You can add a permission policy for a user or user group in the AWS Console.

Adding User Permissions

To add a user access permission policy in the AWS Console, follow these steps:

1. Click IAM > Users in the AWS Console.
2. Select the diagnostic user name from the user list.
3. Click the Permissions tab on the user information page.
4. Select Add permissions in the permission policy.
   • When adding permissions, select ReadOnlyAccess, ViewOnlyAccess.

Adding User Group Permissions

To add a user group access permission policy in the AWS Console, follow these steps:

1. Click IAM > User groups in the AWS Console.
2. Select the user group that the user belongs to from the user group list.
3. Click the Permissions tab on the user group page.
4. Select Add permissions in the permission policy.
   • When adding permissions, select ReadOnlyAccess, ViewOnlyAccess.

Adding Access Control IP

If you are using an IP access control policy, you must add an exception IP to the policy.

Adding IP Access Control for Users

To add IP access control for users in the AWS Console, follow these steps:

1. Click IAM > Users in the AWS Console.
2. Select the diagnostic user name from the user list.
3. Click the Permissions tab on the user information page.
4. Click Edit on the IP Access Control Policy in the permissions policy item.
   • Add 123.37.24.82 to the exception IP for blocking.

Adding IP Access Control for User Groups

To add IP access control for user groups in the AWS Console, follow these steps:

1. Click IAM > User Groups in the AWS Console.
2. Select the user group that the user belongs to from the user group list.
3. Click the Permissions tab on the user group page.
4. Click Edit on the IP Access Control Policy in the permissions policy item.
   • Add 123.37.24.82 to the exception IP for blocking.

Creating Access Keys

To create access keys in the AWS Console, follow these steps:

1. Click IAM > Users in the AWS Console.
2. Select the diagnostic user name from the user list.
3. Click the Security Credentials tab on the user information page.
4. Click Access Keys on the Security Credentials page.
5. Create an access key for third-party services on the Create Access Key page.
   • Be sure to save the created access key information.

Setting up Azure

To diagnose Azure cloud in the Config Inspection service, set up the following items.

Registering Entra ID Application

To register Entra ID Application in the Azure Console, follow these steps:

1. Click Microsoft Entra ID > App Registration in the Azure Console.
2. Click New Registration on the App Registration page.
3. Register the application (client) ID.
4. After completing the app registration, check the App Name, Application (Client) ID, Directory (Tenant) ID on the overview page.

Adding API Permissions

To add API permissions in the Azure Console, follow these steps:

1. Click Microsoft Entra ID > App Registration (App registrations) > Entra ID Application Registration and select the created App Name > API Permissions (App permissions) > Add a permission.
2. Select Microsoft Graph from the API Permissions list.
3. Click Application Permissions on the API Permission Request page.
   • Select Application.Read.All, Device.Read.All, Group.Read.All, User.Read.All, DeviceManagementManagedDevices.Read.All, AuditLog.Read.All, Directory.Read.All, Domain.Read.All, GroupMember.Read.All, Policy.Read.All, Reports.Read.All from the permission list.
4. Click Grant admin consent for account name after adding permissions on the App API Permission Registration page.
   • Check if the status has changed to Granted for account name.

Creating Client Secret

To create a client secret in the Azure Console, follow these steps:

1. Click Microsoft Entra ID > App Registration (App registrations) > Entra ID Application Registration and select the created App Name > Certificates & Secrets.
2. Click New Client Secret on the Certificates & Secrets list.
3. Check the Value item of the client secret in the list after creating the client secret.
   • Be sure to save the client secret value.

Adding Subscription Access Permissions in Azure Console

Subscription access permissions in the Azure Console can be added to the tenant root group or individual subscriptions. Choose the desired method to add subscription access permissions.

Adding Permissions to the Tenant Root Group

To add Azure Console subscription access permissions to the Tenant Root Group, follow these steps:

1. Click on Management groups > Overview in the Azure Console.
2. Click on Tenant Root Group > IAM.
   • If you cannot access the Tenant Root Group menu, change the following settings:
     • Microsoft Entra ID > Properties > ‘Account name’ can manage access to all Azure subscriptions and management groups in this tenant. > Yes
   • After adding permissions, be sure to change it back to No.
3. On the Access Control page, click on Add > Add role assignment.
4. On the Add role assignment page, enter the details and click on Save (Review+assign).
   • When entering role assignment information, select the following information in the Role and Member tabs to add the App created in Entra ID Application registration. All three permissions below must be added.

       |  Category  |  Permission  |
       |---------|---------|
       |Reader|User, group, or service principal|
       |Key Vault Reader|User, group, or service principal|
       |Reader and Data Access|User, group, or service principal|
       <div class="figure-caption">
         Table. Additional permission items when entering role assignment information
       </div>
     

Adding Permissions to an Individual Subscription

To add Azure Console subscription access permissions to an individual subscription, follow these steps:

1. Click on Subscription > Overview in the Azure Console.
   • Check the Subscription ID in the basic information on the overview page.
2. Click on Subscription > IAM.
3. On the Access Control page, click on Add > Add role assignment.
4. On the Add role assignment page, enter the details and click on Save (Review+assign).
   • When entering role assignment information, select the following information in the Role and Member tabs to add the App created in Entra ID Application registration. All three permissions below must be added.

       |  Category  |  Permission  |
       |---------|---------|
       |Reader|User, group, or service principal|
       |Key Vault Reader|User, group, or service principal|
       |Reader and Data Access|User, group, or service principal|
       <div class="figure-caption">
         Table. Additional permission items when entering role assignment information
       </div>
     

Adding Access Permissions using PowerShell

To add Azure Console subscription access permissions using PowerShell, follow these steps:

1. In the Azure Console, run the following command in Cloud shell > PowerShell:
   • New-AzRoleAssignment -ObjectId “Object ID of the App confirmed in Enterprise Application” -Scope “/providers/Microsoft.aadiam” -RoleDefinitionName ‘Reader’ -ObjectType ‘ServicePrincipal’
   • If the command does not work, change the following settings:
     • Microsoft Entra ID > Properties > ‘Account name’ can manage access to all Azure subscriptions and management groups in this tenant. > Yes
     • After adding permissions, be sure to change it back to No.
2. Run the following command to check if the settings are complete:
   • Get-AzRoleAssignment –ObjectId “Object ID of the App confirmed in Enterprise Application” –Scope “/providers/Microsoft.aadiam”
   • If you need to delete permissions, run the following command:
     • Remove-AzRoleAssignment -ObjectId “Object ID of the App confirmed in Enterprise Application” -Scope “/providers/Microsoft.aadiam” -RoleDefinitionName ‘Reader’