Preconfigure

Users must perform pre‑cloud configuration, such as generating authentication keys and adding access‑control IPs, through the Samsung Cloud Platform Console to use the Config Inspection service.

Setting up Samsung Cloud Platform Console

To diagnose Samsung Cloud Platform and external clouds in the Config Inspection service, set the items below.

Check policies attached to the user group

To view the policy of the user group that the user belongs to, follow these steps.

1. Click the All Services > Management > IAM menu. 1. Go to the Service Home page of IAM.
2. On the Service Home page, click the User Group menu. 2. Navigate to the User Group List page.
3. On the User Group List page, click the user group you want to view. 3. Navigate to the User Group Details page.
4. On the User Group Details page, click the Policy tab. 4. Navigate to the Policy tab page.
5. Policy tab page, click the policy you want to view. 5. Navigate to the Policy Details page.
6. On the Policy Details page, view the detailed information.

   • Verify that the policy information in the table below is configured. * If necessary, contact the administrator to add a policy.

   • Policy settings for all cloud diagnostics, including the Samsung Cloud Platform console

     Item	Policy Requirement 1	Policy Requirement 2
     Action	List, Read	Create, Delete, List, Read, Update
     Applied resource	All resources	Individual resource (Config Inspection)
     Authentication type	All authentication	Temporary key authentication, Console login
     Applied IP	123.37.11.42, custom IP The IP 123.37.11.42 for diagnostics and the IP for the user to access the console must each be added	Custom IP

     Table. Detailed policy setting items for all cloud diagnostics

   • Configure policy for diagnosing only external clouds, excluding the Samsung Cloud Platform console.

     Item	Policy Requirement 1	Policy Requirement 2
     Action	Read	Create, Delete, List, Read, Update
     Applied resource	All resources	Individual resource (Config Inspection)
     Authentication type	Temporary key authentication, Console login	Temporary key authentication, Console login
     Applied IP	Custom IP	Custom IP

     Table: Detailed policy settings when diagnosing only external cloud

Generate authentication key

You can view and generate the authentication key used for the Config Inspection service.

To create an authentication key in the Samsung Cloud Platform Console, follow these steps.

1. Click the My menu > My info. menu in the Console. 1. My info. Go to the detail page.
2. My info. Go to the detail page and click the Key Management tab. 2. Navigate to the Authentication Key Management tab page.
3. On the Authentication Key Management tab page, click the Create Authentication Key button. 3. Go to the Create Authentication Key page.
   • You can view the list of authentication keys on the authentication key management page.
4. On the Authentication Key Creation page, enter the expiration period and click the Confirm button.
5. Verify that the created authentication key appears in the authentication key list.

Add allowed IP

You can add allowed IPs in the Samsung Cloud Platform Console.

To add an allowed IP for the Console, follow these steps.

1. Click the My menu > My info. menu in the Console. 1. My info. Go to the detail page.
2. My info. Go to the detail page and click the Key Management tab. 2. Navigate to the Authentication Key Management tab page.
3. On the Authentication Key Management tab page, click the Edit icon of the Security Settings item. 3. Edit Authentication Key Security Settings The popup window opens.
4. Edit Authentication Key Security Settings Enter the authentication method and allowed IP address in the popup window.
   • Select the authentication method authentication key.
   • Set the allowed access IP to Use, enter the IP address, and click the Add button.
5. When the allowed IP addition is complete, click the Confirm button. 5. Verify that it has been updated with the information entered in the Security Settings field.

Setting up AWS

To diagnose the AWS (Amazon Web Services) cloud in the Config Inspection service, set the items below.

Add Permission Policy

You can add permission policies for users or user groups in the AWS Console.

Add user permission

To add a user access permission policy in the AWS Console, follow these steps.

1. Click IAM > User in the AWS Console.
2. Select the diagnostic user name from the user list.
3. Click the Permissions tab on the user information page.
4. Select Add Permission in the permission policy.
   • When adding permissions, select ReadOnlyAccess, ViewOnlyAccess.

Add user group permissions

To add a user group access permission policy in the AWS Console, follow these steps.

1. Click IAM > User Groups in the AWS Console.
2. Select the group that the user belongs to from the list of user groups.
3. On the user group page, click the Permissions tab.
4. Select Add Permission in the permission policy.
   • When adding permissions, select ReadOnlyAccess, ViewOnlyAccess.

Add access control IP

When using an IP access control policy, you need to add a block exception IP to the policy.

Add user access control IP

To add a user access control IP in the AWS Console, follow these steps.

1. Click IAM > User in the AWS Console.
2. Select the diagnostic user name from the user list.
3. Click the Permissions tab on the user information page.
4. In the permission policy item, click Edit for the IP Access Control Policy.
   • Add 123.37.24.82 to the block exception IPs.

Add user group access control IP

To add a user group access control IP in the AWS Console, follow these steps.

1. Click IAM > User Groups in the AWS Console.
2. Select the group that the user belongs to from the list of user groups.
3. Click the Permission tab on the user group page.
4. Click Edit of the IP Access Control Policy in the permission policy item.
   • Add 123.37.24.82 to the block exception IPs.

Access Key Creation

To create an Access Key in the AWS Console, follow these steps.

1. Click IAM > User in the AWS Console.
2. Select the diagnostic user name from the user list.
3. Click the Security Credentials tab on the user information page.
4. On the Security credentials page, click Access keys.
5. On the Create Access Key page, create an access key for third‑party services.
   • Be sure to save the generated access key information.

Configure Azure

To diagnose Azure cloud with the Config Inspection service, set the items below.

Entra ID Application registration

To register an Entra ID Application in the Azure Console, follow these steps.

1. Click Microsoft Entra ID > App registrations in the Azure Console.
2. On the App Registration page, click New Registration.
3. Register the application (client) ID.
4. When the app registration is complete, check the app name, application (client) ID, directory (tenant) ID on the overview page.

Add API permission

To add API permissions in Azure Console, follow these steps.

1. In the Azure Console’s Microsoft Entra ID > App registrations (App registrations) > Entra ID Application registration, click App name > API permissions (App permissions) > Add a permission (Add a permission).
2. From the API permissions list, select the Microsoft Graph to which you want to add permissions.
3. On the API Permission Request page, click Application Permissions.
   • Select Application.Read.All, Device.Read.All, Group.Read.All, User.Read.All, DeviceManagementManagedDevices.Read.All, AuditLog.Read.All, Directory.Read.All, Domain.Read.All, GroupMember.Read.All, Policy.Read.All, Reports.Read.All from the permission list.
4. In App API permission registration, after adding a permission, click Grant admin consent(Grant admin consent for account name).
   • Verify that it has been changed to the Allowed (Granted for account name) status for the account name.

Client Secret creation

To create a Client Secret in the Azure Console, follow these steps.

1. In the Azure Console, go to Microsoft Entra ID > App registration(App registrations) > Entra ID Application registration, then click App name > Certificates & secrets(Certificates & secrets).
2. In the Certificates and passwords list, click New client password.
3. When the client secret is generated, check the Client Secret in the Value field of the list.
   • Be sure to store the Client Secret value.

Add subscription access permission in Azure Console

Subscription access permissions in the Azure Console can be added from the tenant root group or an individual subscription. Choose the desired method to add subscription access permissions.

Add permission in Tenant Root Group

Follow these steps to add subscription access permissions in Azure Console from the Tenant Root Group.

1. Click Management groups(Management groups) > Overview(Overview) in the Azure Console.
2. Click Tenant Root Group > Access Control (IAM).
   • If you cannot access the Tenant Root Group menu, change the settings below.
     • Microsoft Entra ID > Properties > ‘Account Name’ can manage access to all Azure subscriptions and management groups in this tenant. * > Change to Yes
   • After adding the permission, you must change it to No.
3. On the Access Control page, click Add(Add) > Add role assignment(Add role assignment).
4. On the Add Role Assignment page, after entering the detailed information, click Save(Review+assign).
   • When entering role assignment information, select the information below in the Role and Member tabs, and add the app created in Entra ID Application registration. * All three of the following permissions must be added.

     Category	Permission
     Reader(Reader)	User, group, or service principal(Users, group, or service principal)
     Key Vault Reader (Key Vault Reader)	User, group, or service principal(Users, group, or service principal)
     Reader and Data Access	User, group, or service principal(Users, group, or service principal)

     Table. Additional permission items when entering role assignment information

Add permission in individual Subscription

To add subscription access permissions in the Azure Console for an individual subscription, follow these steps.

1. Click Subscription(Subscription) > Overview(Overview) in the Azure Console.
   • Check the Subscription ID(Subscription ID) in the basic information on the Overview page.
2. Click Subscription(Subscription) > Access Control(IAM).
3. On the Access Control page, click Add(Add) > Add role assignment(Add role assignment).
4. On the Add Role Assignment page, after entering the detailed information, click Save (Review+assign).
   • When entering role assignment information, select the information below in the Role and Member tabs, and add the App created in Entra ID Application registration. * You need to add all three permissions below.

     Category	Permission
     Reader(Reader)	User, group, or service principal(Users, group, or service principal)
     Key Vault Reader (Key Vault Reader)	User, group, or service principal(Users, group, or service principal)
     Reader and Data Access	User, group, or service principal(Users, group, or service principal)

     Table. Additional permission items when entering role assignment information

Adding access permissions via PowerShell

To add subscription access permissions in the Azure Console using PowerShell, follow these steps.

1. Run the following command in Cloud shell > PowerShell of the Azure Console.
   • New-AzRoleAssignment -ObjectId “App’s Object ID retrieved from Enterprise Application” -Scope “/providers/Microsoft.aadiam” -RoleDefinitionName ‘Reader’ -ObjectType ‘ServicePrincipal’
   • If the command does not execute, change the settings below.
     • Microsoft Entra ID > Properties(Properties) > ‘account name’ can manage access to all Azure subscriptions and management groups in this tenant. * > Change to yes(yes)
     • After adding the permission, you must change it to No (no).
2. Run the command below to verify whether the configuration is complete.
   • Get-AzRoleAssignment –ObjectId ＂the App’s Object ID as seen in Enterprise Application＂ –Scope ＂/providers/Microsoft.aadiam＂
   • If you need to delete permissions, run the command below.
     • Remove-AzRoleAssignment -ObjectId “App’s Object ID retrieved from the Enterprise Application” -Scope “/providers/Microsoft.aadiam” -RoleDefinitionName ‘Reader’