How-to guides

• 1: Dashboard Check
• 2: Diagnostic Result Management
• 3: Pre-configuration

1 - Dashboard Check

Users can view the diagnostic results of the Config Inspection service at a glance on the dashboard through the Samsung Cloud Platform Console.

Check Dashboard

On the dashboard page, you can view the status of Config Inspection’s diagnostic targets and diagnostic history, etc.

To check the dashboard, follow the steps below.

1. Click the All Services > Security > Config Inspection menu. Navigate to the Service Home page of Config Inspection.
2. Click the Dashboard menu on the Service Home page. Navigate to the Dashboard page.
3. Dashboard Check the summary of diagnostic results on the page.
   • Dashboard You can view the dashboard information at the top of the page based on period or diagnosis name.
     • Period: Based on the current month, you can set a period within 6 months to view summary information of the diagnosis results.
     • Diagnosis Name: If you select All, you can view a summary of the entire diagnostic history results, and if you select a diagnostic account, you can view the detailed information of that diagnostic result.
   • Download button can be clicked to download the information displayed on the dashboard page as a PDF file.

     Category	Detailed description
     Security Level (Overall)	Display average of latest diagnostic results for all diagnostic targets Recent diagnostic results are displayed in the list Diagnostic score calculation formula = Total – (Fail + Error + Check)) / Total x 100
     Periodic Diagnosis Status	Display diagnosis status by target during search period Diagnosis Completed: Show recent completed diagnosis details Diagnosis Error: Show recent diagnosis error details, when selecting diagnosis name go to detailed result page
     Summary of Diagnosis Results by Period (All)	Display summary of diagnosis results (All) during the search period If you select a diagnosis name from the list, you will be taken to the detailed diagnosis result page

     Table. Detailed dashboard item description for overall diagnosis results

     Category	Detailed description
     Security Level	Display the last diagnostic result score of the selected diagnostic account Recent diagnostic results are displayed in the list
     Period-wise diagnostic result summary	Show summary of diagnostic results for the last diagnostic account within the search period
     Vulnerability Status by Period	Display the vulnerability diagnosis results of the diagnostic account during the search period as a graph When a graph is selected, display detailed information of the vulnerable items in the diagnosis results

     Table. Detailed dashboard item description for diagnostic results by diagnostic account

2 - Diagnostic Result Management

You can view the Config Inspection diagnostic request results on the diagnostic results page and change the diagnostic results.

Check diagnosis results

On the diagnosis results page, you can view the diagnosis request results.

Check diagnosis result list

To view the list of diagnostic results, follow the steps below.

1. All Services > Security > Config Inspection Click the menu. Navigate to the Service Home page of Config Inspection.
2. Click the Diagnostic Results menu on the Service Home page. You will be taken to the Diagnostic Results List page.
3. Diagnostic Result List Check the summary information of diagnostic results on the page.

   Category	Detailed description
   Diagnosis name	Resource name
   Diagnostic Account	Console information to be diagnosed
   Checklist	Collection of diagnostic items that serve as the basis for diagnostic results
   PASS	Number of items in the checklist with diagnosis result PASS (normal)
   FAIL	Number of items in the checklist with diagnosis result FAIL (vulnerable)
   CHECK	Number of items in the checklist whose diagnosis result is CHECK (verification needed)
   ERROR	Number of items in the checklist whose diagnosis result is ERROR (diagnosis not possible)
   N/A	Number of items in the checklist where the diagnosis result is N/A (not applicable)
   All	Total number of checklist items
   Diagnosis Result	Diagnosis Request Result Completed: The diagnosis request has been successfully completed, clicking Completed moves to the detail page Error: The diagnosis request was not successfully completed, error status items cannot view detailed content
   Diagnosis time	Diagnosis request time

   Table. Diagnosis Result List Items

Check detailed diagnostic result information

To view detailed information of the diagnosis results, follow the steps below.

1. Click the All Services > Security > Config Inspection menu. Navigate to the Service Home page of Config Inspection.
2. Click the Diagnostic Results menu on the Service Home page. It navigates to the Diagnostic Results List page.

• You can search by entering the diagnosis name in the search area of the Diagnosis Result List page or by clicking the Detailed Search button.

3. Click on an item with a Completed diagnosis result on the Diagnosis Result List page. You will be taken to the diagnosis result detail page.

   • Items whose diagnostic result is in error state do not display detailed information.

4. Detailed Diagnosis Results page, check the detailed diagnosis results.

   Category	Detailed description
   Excel Download	Download detailed list of diagnosis results as an Excel file
   More > Diagnosis Result Management	Go to Diagnosis Result Management page
   Checklist	Collection of diagnostic items that serve as the basis for diagnostic results
   Area	Diagnosis scope (services of Samsung Cloud Platform)
   Diagnostic Items	Security standards recommended for service-specific settings
   Result	Result of diagnostic item criteria check

   Table. Detailed Diagnosis Result Items

5. Click the diagnostic item to view detailed information. Diagnostic Item Details popup window opens.

   • Diagnosis Item Details In the popup window, you can view the following information.

     Category	Detailed description
     Area	Diagnosis Scope (Samsung Cloud Platform’s services)
     Diagnostic Items	Security standards recommended for service-specific settings
     Result	Diagnosis item criteria check result
     Diagnosis Criteria	Result Judgment Criteria
     Diagnostic Method	Current Settings Check Method
     Action Guide	Configuration method that meets security standards
     Detailed Result	Resource information and settings corresponding to the diagnostic item
     Diagnosis Result Change	Button to change diagnosis result If the diagnosis result is changed, the Check Result button is displayed, and clicking the Delete button allows deletion of the changed result

     Table. Config Inspection Diagnosis Item Details

Manage Diagnosis Results

On the diagnosis result page, you can change the results of items whose diagnosis result is in CHECK status.

Change Diagnosis Result

To change the diagnosis result, follow the steps below.

1. All Services > Security > Config Inspection Click the menu. Navigate to the Service Home page of Config Inspection.

2. Click the Diagnostic Results menu on the Service Home page. It navigates to the Diagnostic Results List page.

3. Diagnosis Result List page, click the item whose diagnosis result is Completed. You will be taken to the Diagnosis Result Details page.

   • Items with a diagnostic result in error state do not display detailed information.

4. Click the More > Diagnosis Result Management button at the top of the Diagnosis Result Details page. You will be taken to the Diagnosis Result Management page.

5. Click the Result Change button for the item whose diagnostic result you want to modify on the Diagnostic Result Management page. The Result Change popup window will open.

6. Result Change In the popup window, select or enter the information required to change the result.

   Category	Required?	Detailed description
   Registrant	-	Diagnosis result change registrant email
   Validity Period	Required	Set the validity period of the diagnostic result
   Change Result	Required	Select the diagnostic result to change among Pass, Check, Fail
   Detailed Reason	Required	Enter the detailed reason for changing the result
   Attachment File	Select	Upload files required for confirming result changes Attach File button to upload files, up to 5 can be registered
   Inspection Result	-	Detailed inspection result display

   Table. Detailed Items of Diagnosis Result Change

7. Check the entered information and click the Register button. Verify whether the diagnostic results have changed in the Diagnostic Result Management list.

Delete diagnosis result change history

To delete the diagnostic result change history, follow the steps below.

1. All Services > Security > Config Inspection Click the menu. Navigate to Config Inspection’s Service Home page.
2. Click the Diagnostic Results menu on the Service Home page. Navigate to the Diagnostic Results List page.
3. Click an item with a completed diagnosis result on the Diagnosis Result List page. It moves to the Diagnosis Result Details page.
   • Items whose diagnostic result is in error state do not display detailed information.
4. Click the Diagnosis Result Details page’s top Diagnosis Result Management button. It navigates to the Diagnosis Result Management page.
5. Diagnosis Result Management page, click the Check Result button for the item whose diagnosis result you want to change. The Check Result popup window opens.
6. Check Results in the popup window, click the Delete button.

3 - Pre-configuration

Users must perform cloud pre-configuration such as authentication key creation and access control IP addition through the Samsung Cloud Platform Console to use the Config Inspection service.

Samsung Cloud Platform Console Settings

To diagnose Samsung Cloud Platform and external clouds in the Config Inspection service, set the following items.

Check Policies Linked to User Group

To check the policy of the user group you belong to, follow the procedure below.

1. Click All Services > Management > IAM menu. You will be redirected to the Service Home page of IAM.
2. Click User Groups menu on the Service Home page. You will be redirected to the User Group List page.
3. Click the user group you want to check on the User Group List page. You will be redirected to the User Group Details page.
4. Click Policies tab on the User Group Details page. You will be redirected to the Policies tab page.
5. Click the policy you want to check on the Policies tab page. You will be redirected to the Policy Details page.
6. Check the detailed information on the Policy Details page.
   • Check if the policy information in the table below is set. If necessary, contact the administrator to add the policy.

     Item	Policy Requirement 1	Policy Requirement 2
     Action	List, Read	Create, Delete, List, Read, Update
     Resource	All resources	Individual resource (Config Inspection)
     Auth Type	All authentication	Temporary key authentication, Console login
     Allowed IP	123.37.11.42, User-defined IP For diagnosis, you must add IP 123.37.11.42 and IP for user console access separately	User-defined IP

     Table. Policy setting details for diagnosing all clouds

Create Authentication Key

You can check and create authentication keys to use in the Config Inspection service.

To create an authentication key in Samsung Cloud Platform Console, follow the procedure below.

1. Click My Menu > My info. menu in the Console. You will be redirected to the My info. details page.
2. Click Authentication Key Management tab on the My info. details page. You will be redirected to the Authentication Key Management tab page.
3. Click Create Authentication Key button on the Authentication Key Management tab page. You will be redirected to the Create Authentication Key page.
   • You can check the authentication key list on the authentication key management page.
4. Enter the expiration period on the Create Authentication Key page and click OK button.
5. Check if the created authentication key is displayed in the authentication key list.

Add Access Allowed IP

You can add access allowed IPs in Samsung Cloud Platform Console.

To add access allowed IPs in the Console, follow the procedure below.

1. Click My Menu > My info. menu in the Console. You will be redirected to the My info. details page.
2. Click Authentication Key Management tab on the My info. details page. You will be redirected to the Authentication Key Management tab page.
3. Click Edit icon in Security Settings item on the Authentication Key Management tab page. The Edit Authentication Key Security Settings popup will open.
4. Enter the authentication method and access allowed IP in the Edit Authentication Key Security Settings popup.
   • Select Authentication Key for authentication method.
   • Set access allowed IP to Enable, enter the IP address, and click Add button.
5. When adding access allowed IP is complete, click OK button. Check if the information is modified to the entered information in the Security Settings item.

AWS Settings

To diagnose AWS (Amazon Web Services) cloud in the Config Inspection service, set the following items.

Add Permission Policy

You can add permission policies for users/user groups in AWS Console.

Add User Permission

To add user access permission policy in AWS Console, follow the procedure below.

1. Click IAM > Users in AWS Console.
2. Select the diagnostic user name from the user list.
3. Click Permissions tab on the user information page.
4. Select Add permissions in the permission policy.
   • Select ReadOnlyAccess, ViewOnlyAccess when adding permissions.

Add User Group Permission

To add user group access permission policy in AWS Console, follow the procedure below.

1. Click IAM > User groups in AWS Console.
2. Select the group the user belongs to from the user group list.
3. Click Permissions tab on the user group page.
4. Select Add permissions in the permission policy.
   • Select ReadOnlyAccess, ViewOnlyAccess when adding permissions.

Add Access Control IP

If using IP access control policy, you must add block exception IPs to that policy.

Add User Access Control IP

To add user access control IP in AWS Console, follow the procedure below.

1. Click IAM > Users in AWS Console.
2. Select the diagnostic user name from the user list.
3. Click Permissions tab on the user information page.
4. Click Edit in IP Access Control Policy in the permission policy item.
   • Add 123.37.24.82 to block exception IP.

Add User Group Access Control IP

To add user group access control IP in AWS Console, follow the procedure below.

1. Click IAM > User groups in AWS Console.
2. Select the group the user belongs to from the user group list.
3. Click Permissions tab on the user group page.
4. Click Edit in IP Access Control Policy in the permission policy item.
   • Add 123.37.24.82 to block exception IP.

Generate Access Key

To generate Access Key in AWS Console, follow the procedure below.

1. Click IAM > Users in AWS Console.
2. Select the diagnostic user name from the user list.
3. Click Security credentials tab on the user information page.
4. Click Access keys on the Security credentials page.
5. Create access keys for third-party services on the Create access key page.
   • Make sure to save the created access key information.

Azure Settings

To diagnose Azure cloud in the Config Inspection service, set the following items.

Register Entra ID Application

To register Entra ID Application in Azure Console, follow the procedure below.

1. Click Microsoft Entra ID > App registrations in Azure Console.
2. Click New registration on the App registrations page.
3. Register application (client) ID.
4. When app registration is complete, check App name, Application (client) ID, Directory (tenant) ID on the overview page.

Add API Permission

To add API permission in Azure Console, follow the procedure below.

1. Click Microsoft Entra ID > App registrations > Entra ID Application registration > created App name > API permissions > Add a permission in Azure Console.
2. Select Microsoft Graph to add permissions from the API permissions list.
3. Click Application permissions on the Request API permissions page.
   • Select Application.Read.All, Device.Read.All, Group.Read.All, User.Read.All, DeviceManagementManagedDevices.Read.All, AuditLog.Read.All, Directory.Read.All, Domain.Read.All, GroupMember.Read.All, Policy.Read.All, Reports.Read.All from the permission list.
4. After adding permissions in App API permission registration, click Grant admin consent for account name.
   • Check if it changes to Granted for account name status for the account name.

Create Client Secret

To create Client Secret in Azure Console, follow the procedure below.

1. Click Microsoft Entra ID > App registrations > Entra ID Application registration > created App name > Certificates & secrets in Azure Console.
2. Click New client secret from the Certificates & secrets list.
3. When client secret is created, check the Client Secret in the Value item from the list.
   • Make sure to save the Client Secret value.

Add Subscription Access Permission in Azure Console

You can add subscription access permissions in Azure Console from Tenant Root Group or individual Subscription. Choose your preferred method to add subscription access permissions.

Add Permission from Tenant Root Group

To add subscription access permission in Azure Console from Tenant Root Group, follow the procedure below.

1. Click Management groups > Overview in Azure Console.
2. Click Tenant Root Group > Access control (IAM).
   • If you cannot enter the Tenant Root Group menu, change the setting below.
     • Change Microsoft Entra ID > Properties > ‘Account name’ can manage access to all Azure subscriptions and management groups in this tenant. > Yes
   • After adding permissions, you must change it to No.
3. Click Add > Add role assignment on the Access control page.
4. Enter detailed information on the Add role assignment page and click Review+assign.
   • When entering role assignment information, select the information below from the Role and Member tabs to add the App created in Entra ID Application registration. You must add all three permissions below.

     Category	Permission
     Reader	Users, group, or service principal
     Key Vault Reader	Users, group, or service principal
     Reader and Data Access	Users, group, or service principal

     Table. Additional permission items when entering role assignment information

Add Permission from Individual Subscription

To add subscription access permission in Azure Console from individual Subscription, follow the procedure below.

1. Click Subscription > Overview in Azure Console.
   • Check Subscription ID from the basic information on the overview page.
2. Click Subscription > Access control (IAM).
3. Click Add > Add role assignment on the Access control page.
4. Enter detailed information on the Add role assignment page and click Review+assign.
   • When entering role assignment information, select the information below from the Role and Member tabs to add the App created in Entra ID Application registration. You must add all three permissions below.

     Category	Permission
     Reader	Users, group, or service principal
     Key Vault Reader	Users, group, or service principal
     Reader and Data Access	Users, group, or service principal

     Table. Additional permission items when entering role assignment information

Add Access Permission via PowerShell

To add subscription access permission in Azure Console using PowerShell, follow the procedure below.

1. Run the following command in Cloud shell > PowerShell in Azure Console.
   • New-AzRoleAssignment -ObjectId “App’s Object ID confirmed in Enterprise Application” -Scope “/providers/Microsoft.aadiam” -RoleDefinitionName ‘Reader’ -ObjectType ‘ServicePrincipal’
   • If the command does not run, change the setting below.
     • Change Microsoft Entra ID > Properties > ‘Account name’ can manage access to all Azure subscriptions and management groups in this tenant. > Yes
     • After adding permissions, you must change it to No
2. Run the following command to check if the setting is complete.
   • Get-AzRoleAssignment –ObjectId ＂App’s Object ID confirmed in Enterprise Application＂ –Scope ＂/providers/Microsoft.aadiam＂
   • If you need to delete permissions, run the following command.
     • Remove-AzRoleAssignment -ObjectId “App’s Object ID confirmed in Enterprise Application” -Scope “/providers/Microsoft.aadiam” -RoleDefinitionName ‘Reader’