Configure In-Account Scanning

To configure in-account scanning, create and connect a dedicated account, and then grant Tenable One AI Exposure permissions to provision the necessary infrastructure resources in the target account.

To configure in-account scanning:

  1. Create one or more dedicated account/s for scanning purposes.

    Note: Only one scanning account can be defined per scope in AI Exposure. A scanning account can only be mapped to a single scope. Customers are responsible for any relevant compute costs associated with such accounts (estimated at about $300 per region). See Resources Provisioned per Region for more information.
  2. Connect the account in AI Exposure.
  3. Depending on your cloud provider, add the following to the account to grant Tenable the necessary permissions required to manage compute resources:
  4. Contact Support for help completing the process. At this point:
    • Tenable will provision the necessary compute resources for each region in which you have virtual machines. See Resources Provisioned per Region for more information.
    • Tenable will orchestrate the scanning on a regular basis.

Required Alibaba Cloud Permissions

Grant Tenable the permissions required to deploy, manage, and scan workloads in the dedicated, in-account Alibaba Cloud account by creating a custom RAM policy and attaching it to the Tenable RAM role. These permissions allow Tenable to:

  • Provision and manage the ACK cluster and its node pools, including the ROS stack, Auto Scaling resources, and ECS disks and security groups.
  • Create and manage the VPC networking components, such as VSwitches, NAT gateways, Elastic IPs, route tables, and the VPC gateway endpoint.
  • Manage the RAM roles, resource groups, and KMS instance and key used to encrypt and decrypt Kubernetes secrets and to scan encrypted disks.

Most create and delete actions are limited by condition to resources tagged with a Namespace value that starts with Tenable.

Copy

JSON

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeDisks",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:DescribeSecurityGroups",
        "ecs:TagResources"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ecs:CreateSecurityGroup",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "acs:RequestTag/Namespace": "Tenable*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:AuthorizeSecurityGroup",
        "ecs:AuthorizeSecurityGroupEgress",
        "ecs:DeleteDisk",
        "ecs:DeleteSecurityGroup",
        "ecs:RevokeSecurityGroup",
        "ecs:RevokeSecurityGroupEgress"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "acs:ResourceTag/Namespace": "Tenable*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ram:GetResourceGroup",
        "ram:GetRole",
        "ram:ListResourceGroups",
        "ram:ListRoles",
        "ram:UpdateAssociatedTransferSetting"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ram:CreateResourceGroup",
        "ram:CreateServiceLinkedRole",
        "ram:DeleteResourceGroup"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ram:CreateRole",
      "Resource": "acs:ram:*:*:role/Aliyun*Role"
    },
    {
      "Effect": "Allow",
      "Action": "ram:CreateRole",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "acs:RequestTag/Namespace": "Tenable*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "ram:AttachPolicyToRole",
      "Resource": "acs:ram:*:*:role/Aliyun*Role"
    },
    {
      "Effect": "Allow",
      "Action": "ram:AttachPolicyToRole",
      "Resource": "acs:ram:*:system:policy/Aliyun*Policy"
    },
    {
      "Effect": "Allow",
      "Action": "ram:AttachPolicyToRole",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "acs:ResourceTag/Namespace": "Tenable*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "ram:TagResources",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "resourcemanager:GetAutoGroupingRule",
        "resourcemanager:GetAutoGroupingStatus",
        "resourcemanager:ListAssociatedTransferSetting",
        "resourcemanager:ListAutoGroupingRules"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "resourcemanager:CreateAutoGroupingRule",
        "resourcemanager:DeleteAutoGroupingRule",
        "resourcemanager:EnableAccount",
        "resourcemanager:EnableAssociatedTransfer",
        "resourcemanager:EnableAutoGrouping",
        "resourcemanager:TagResources",
        "resourcemanager:UpdateAssociatedTransferSetting",
        "resourcemanager:UpdateResourceGroupAdminSetting"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ros:GetStack",
        "ros:ListStacks",
        "ros:TagResources"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cs:DescribeClusterDetail",
        "cs:DescribeClusterNodePoolDetail",
        "cs:DescribeClusterNodePools",
        "cs:DescribeClusterResources",
        "cs:DescribeClusterUserKubeconfig",
        "cs:DescribeKubernetesVersionMetadata",
        "cs:DescribeTaskInfo",
        "cs:GetClusterAddonInstance",
        "cs:GetClusters",
        "cs:ListClusterAddonInstances"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "cs:CreateCluster",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "acs:RequestTag/Namespace": "Tenable*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "cs:CreateClusterNodePool",
      "Resource": "acs:cs:*:*:cluster/*",
      "Condition": {
        "StringLike": {
          "acs:ResourceTag/Namespace": "Tenable*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "cs:DeleteCluster",
        "cs:DeleteClusterNodepool",
        "cs:EnableSecretEncryption",
        "cs:ModifyClusterNodePool",
        "cs:ModifyClusterTags",
        "cs:UpdateUserPermissions",
        "cs:UpgradeCluster",
        "cs:UpgradeClusterNodepool"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "acs:ResourceTag/Namespace": "Tenable*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:DescribeAccountKmsStatus",
        "kms:DescribeKey",
        "kms:GetKmsInstance",
        "kms:ListAliases",
        "kms:ListKeys",
        "kms:ListKmsInstances",
        "kms:ListTagResources"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:ConnectKmsInstance",
        "kms:CreateAlias",
        "kms:CreateKey",
        "kms:DeleteAlias",
        "kms:OpenKmsService",
        "kms:SetKeyPolicy",
        "kms:ReleaseKmsInstance",
        "kms:TagResources",
        "kms:UpdateDKMSInstance"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:ScheduleKeyDeletion",
        "kms:SetDeletionProtection"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "kms:tag/Namespace": "Tenable*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "vpc:DescribeEipAddresses",
        "vpc:DescribeNatGateways",
        "vpc:DescribeRouteEntryList",
        "vpc:DescribeRouteTableList",
        "vpc:DescribeSnatTableEntries",
        "vpc:DescribeVpcAttribute",
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "vpc:ListDhcpOptionsSets",
        "vpc:ListTagResources",
        "vpc:ListVpcGatewayEndpoints"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "vpc:CreateRouteEntry",
        "vpc:CreateSnatEntry",
        "vpc:CreateVSwitch",
        "vpc:TagResources"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "vpc:AllocateEipAddress",
        "vpc:CreateNatGateway",
        "vpc:CreateRouteTable",
        "vpc:CreateVpc",
        "vpc:CreateVpcGatewayEndpoint"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "acs:RequestTag/Namespace": "Tenable*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "vpc:AssociateEipAddress",
        "vpc:AssociateRouteTable",
        "vpc:AssociateRouteTablesWithVpcGatewayEndpoint",
        "vpc:DeleteDhcpOptionsSet",
        "vpc:DeleteNatGateway",
        "vpc:DeleteRouteEntry",
        "vpc:DeleteRouteTable",
        "vpc:DeleteSnatEntry",
        "vpc:DeleteVpc",
        "vpc:DeleteVpcGatewayEndpoint",
        "vpc:DeleteVSwitch",
        "vpc:DissociateRouteTablesFromVpcGatewayEndpoint",
        "vpc:ModifyVpcAttribute",
        "vpc:ReleaseEipAddress",
        "vpc:UnassociateEipAddress",
        "vpc:UnassociateRouteTable"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "acs:ResourceTag/Namespace": "Tenable*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "bss:DescribeInstances",
        "bss:ModifyInstance",
        "bss:QueryAvailableInstances"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "tag:ListTagResources",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "tag:TagResources",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "acs:RequestTag/Namespace": "Tenable*"
        }
      }
    }, 
    {
      "Effect": "Allow",
      "Action": [
        "ecs:CreateDisk",
        "ecs:DescribeSnapshots"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "resourcesharing:ListResourceShareInvitations",
        "resourcesharing:AcceptResourceShareInvitation"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cs:DescribeRegions",
        "cs:DescribeClusterNodes"
      ],
      "Resource": "*"
    }
  ]
}

Disk Securing for Scanning

When a disk is created for scan in the outpost account, Tenable encrypts it. ECS uses a RAM role named AliyunECSDiskEncryptDefaultRole to create the encrypted disks for scanning.

Tenable creates the role once per account. If the role already exists in your account, Tenable keeps it and attaches the AliyunECSDiskEncryptRolePolicy system policy to it. The policy you created in Required Alibaba Cloud Permissions already covers role creation, so you have nothing extra to add.

For disks encrypted with Alibaba-managed keys, Tenable re-encrypts the snapshots with a KMS key it provisions, so the disks can be scanned. See Alibaba Cloud for details.

If you want to check the role, or create it yourself, use the following policies.

Trust Policy

Copy

JSON

{
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "ecs.aliyuncs.com"
        ]
      }
    }
  ],
  "Version": "1"
}

Permissions

Attach the AliyunECSDiskEncryptRolePolicy system policy to the role. If this policy is not available in your Alibaba Cloud console, create a custom policy with the following content and attach it to the role:

Copy

JSON

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kms:List*",
        "kms:DescribeKey",
        "kms:TagResource",
        "kms:UntagResource"
      ],
      "Resource": [
        "acs:kms:*:*:*",
        "acs:kms:*:*:*/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": [
        "acs:kms:*:*:*/*"
      ]
    }
  ]
}

Required AWS Permissions

The required AWS permissions consist of an AWS managed policy and a custom inline policy.

  • Attach the following AWS managed policy: AmazonVPCFullAccess.
  • Add the below custom inline policy to the IAM role you created during integration.

These permissions are needed to deploy, manage, and scan workloads in a customer's environment. This includes provisioning and modifying compute resources (EC2, Auto Scaling, EKS), managing IAM roles and policies for authentication and access control, handling encryption keys for secure data access (KMS), and organizing resources efficiently (Resource Groups). These permissions ensure the necessary infrastructure is in place for workload scanning while maintaining security and compliance.

Copy

JSON

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "autoscaling:UpdateAutoScalingGroup"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags",
                "ec2:DetachVolume"
              ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ec2:CreateVolume",
            "Resource": "arn:aws:ec2:*:*:volume/*",
            "Condition": {
                "StringEquals": {
                    "aws:RequestTag/Context": "WorkloadAnalysis"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "ec2:CreateVolume",
            "Resource": "arn:aws:ec2:*:*:snapshot/*"
        },
        {
            "Effect": "Allow",
            "Action": "ec2:DeleteVolume",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/Context": "WorkloadAnalysis"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateLaunchTemplate",
                "ec2:CreateLaunchTemplateVersion",
                "ec2:DeleteLaunchTemplate",
                "ec2:ModifyLaunchTemplate",
                "ec2:RunInstances"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "eks:AssociateEncryptionConfig",
                "eks:CreateAddon",
                "eks:CreateCluster",
                "eks:CreateNodegroup",
                "eks:CreatePodIdentityAssociation",
                "eks:DeleteCluster",
                "eks:DeleteNodegroup",
                "eks:TagResource",
                "eks:UpdateAddon",
                "eks:UpdateClusterVersion",
                "eks:UpdateNodegroupConfig",
                "eks:UpdateNodegroupVersion"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:AttachRolePolicy",
                "iam:CreateRole",
                "iam:CreateServiceLinkedRole",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:DetachRolePolicy",
                "iam:List*Tags",
                "iam:PassRole",
                "iam:PutRolePolicy",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:Tag*",
                "iam:UpdateAssumeRolePolicy"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:CreateAlias",
                "kms:CreateGrant",
                "kms:CreateKey",
                "kms:Decrypt",
                "kms:DeleteAlias",
                "kms:DescribeKey",
                "kms:EnableKeyRotation",
                "kms:GenerateDataKeyWithoutPlaintext",
                "kms:ListAliases",
                "kms:ListKeys",
                "kms:ListResourceTags",
                "kms:ReEncryptFrom",
                "kms:ReEncryptTo",
                "kms:ScheduleKeyDeletion",
                "kms:TagResource"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "license-manager:ListReceivedLicenses",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "rds:AddTagsToResource",
                "rds:CopyDBClusterSnapshot",
                "rds:CopyDBSnapshot",
                "rds:CreateDBClusterParameterGroup",
                "rds:CreateDBInstance",
                "rds:CreateDBSnapshot",
                "rds:CreateDBSubnetGroup",
                "rds:DeleteDBCluster",
                "rds:DeleteDBClusterParameterGroup",
                "rds:DeleteDBClusterSnapshot",
                "rds:DeleteDBInstance",
                "rds:DeleteDBSnapshot",
                "rds:DeleteDBSubnetGroup",
                "rds:ModifyDBCluster",
                "rds:ModifyDBClusterParameterGroup",
                "rds:ModifyDBInstance",
                "rds:RestoreDBClusterFromSnapshot",
                "rds:RestoreDBInstanceFromDBSnapshot"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "resource-groups:CreateGroup",
                "resource-groups:DeleteGroup",
                "resource-groups:Get*",
                "resource-groups:Tag"
            ],
            "Resource": "*"
        }
    ]
}

Required Azure Permissions

Assign the following custom role to the AI Exposure Connector app in the dedicated, in-account subscription. This role enables Tenable to:

  • Oversee managed disks, including the creation and deletion of disks.
  • Create the role definition (TenableRoleDefinitionWorkloadAnalysisScanning) responsible for allowing the Kubernetes cluster to attach a disk to the scan job.
Copy

JSON

{
    "properties": {
        "assignableScopes": [
            "/subscriptions/<SubscriptionId>"
        ],
        "description": "",
        "permissions": [
            {
                "actions": [
                    "Microsoft.Authorization/roleAssignments/delete",
                    "Microsoft.Authorization/roleAssignments/write",
                    "Microsoft.Authorization/roleDefinitions/delete",
                    "Microsoft.Authorization/roleDefinitions/write",
                    "Microsoft.Compute/disks/delete",
                    "Microsoft.Compute/disks/write",
                    "Microsoft.Compute/register/action",
                    "Microsoft.Compute/skus/read",
                    "Microsoft.Compute/virtualMachines/attachDetachDataDisks/action",
                    "Microsoft.Compute/virtualMachines/write",
                    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/restart/action",
                    "Microsoft.Compute/virtualMachineScaleSets/write",
                    "Microsoft.ContainerService/managedClusters/agentPools/abort/action",
                    "Microsoft.ContainerService/managedClusters/agentPools/deleteMachines/action",
                    "Microsoft.ContainerService/managedClusters/agentPools/machines/read",
                    "Microsoft.ContainerService/managedClusters/agentPools/machines/write",
                    "Microsoft.ContainerService/managedClusters/agentPools/read",
                    "Microsoft.ContainerService/managedClusters/agentPools/upgradeNodeImageVersion/action",
                    "Microsoft.ContainerService/managedClusters/agentPools/write",
                    "Microsoft.ContainerService/managedClusters/delete",
                    "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
                    "Microsoft.ContainerService/managedClusters/write",
                    "Microsoft.ContainerService/register/action",
                    "Microsoft.Features/providers/features/register/action",
                    "Microsoft.KeyVault/*",
                    "Microsoft.ManagedIdentity/register/action",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/delete",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/write",
                    "Microsoft.Network/natGateways/delete",
                    "Microsoft.Network/natGateways/write",
                    "Microsoft.Network/networkSecurityGroups/delete",
                    "Microsoft.Network/networkSecurityGroups/join/action",
                    "Microsoft.Network/networkSecurityGroups/securityRules/delete",
                    "Microsoft.Network/networkSecurityGroups/securityRules/write",
                    "Microsoft.Network/networkSecurityGroups/write",
                    "Microsoft.Network/publicIPAddresses/delete",
                    "Microsoft.Network/publicIPAddresses/write",
                    "Microsoft.Network/register/action",
                    "Microsoft.Network/routeTables/delete",
                    "Microsoft.Network/routeTables/join/action",
                    "Microsoft.Network/routeTables/write",
                    "Microsoft.Network/virtualNetworks/delete",
                    "Microsoft.Network/virtualNetworks/subnets/delete",
                    "Microsoft.Network/virtualNetworks/subnets/join/action",
                    "Microsoft.Network/virtualNetworks/subnets/write",
                    "Microsoft.Network/virtualNetworks/write",
                    "Microsoft.Resources/subscriptions/providers/read",
                    "Microsoft.Resources/subscriptions/resourceGroups/delete",
                    "Microsoft.Resources/subscriptions/resourceGroups/write",
                    "Microsoft.Resources/tags/write",
                    "Microsoft.Storage/register/action",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/delete",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/write",
                    "Microsoft.Storage/storageAccounts/delete",
                    "Microsoft.Storage/storageAccounts/listkeys/action",
                    "Microsoft.Storage/storageAccounts/managementPolicies/delete",
                    "Microsoft.Storage/storageAccounts/managementPolicies/write",
                    "Microsoft.Storage/storageAccounts/write"
                ],
                "dataActions": [
                    "Microsoft.ContainerService/managedClusters/*",
                    "Microsoft.KeyVault/vaults/keyrotationpolicies/*",
                    "Microsoft.KeyVault/vaults/keys/*",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
                ],
                "notActions": [],
                "notDataActions": []
            }
        ],
        "roleName": "InAccountCustomRole"
    }
}

Required GCP Permissions

Add the following predefined roles to the AI Exposure service account you created during integration:

GCP Role Description
Cloud KMS Admin Needed to manage encryption keys used for decrypting and scanning workloads that are encrypted at rest.
Editor Grants permissions to read and modify resources, enabling workload scanning across various GCP services.
Kubernetes Engine Admin Required to inspect workloads running in Google Kubernetes Engine (GKE) clusters and ensure security compliance.
Project IAM Admin Needed to manage IAM policies, ensuring the scanner has the necessary permissions to access and inspect workloads across the project.
Service Account Admin Allows the creation and management of service accounts needed for authentication and scanning operations.

Required OCI Permissions

Grant AI Exposure permissions to scan OCI In-Account workloads by adding the below statements to the OCI policy that you created during integration.

  • Allow group TenableCS to manage all-resources in compartment <InAccount compartment OCID>
  • Allow group TenableCS to use volumes in tenancy

To scan volumes encrypted with customer-managed keys, add the following statement to the OCI policy:

  • Allow group TenableCS to use key-delegate in tenancy

Resources Provisioned per Region

This section focuses on detailing the specific cloud infrastructure components (resources) that Tenable deploys and uses within each distinct geographical cloud region, along with the specific technical requirements and context for each component.

Alibaba Cloud

Resource Requirement Context
Compute
  • ACK (Managed Kubernetes) cluster
  • 2 Auto Scaling Groups
  • ROS (Resource Orchestration Service) Stack
  • Scanning virtual machines
  • ACK cluster — Manages scanning operations and orchestration
  • Auto Scaling Groups — One per node pool (Default and Spot), manage scaling of worker nodes
  • ROS Stack — Infrastructure stack auto-created by ACK for cluster resources
  • Scanning virtual machines — Execute the scanning operations. Scalable on demand, with a maximum capacity of 32 vCPUs and 64 GB RAM

The number and size of nodes are automatically managed by Tenable to minimize costs while meeting scanning demands
Identities 3 RAM roles
  • Used by the ACK cluster (node pools)
  • Used by the management pod
  • AliyunECSDiskEncryptDefaultRole — Used by ECS to create encrypted disks for scanning. Created once per account. If the role already exists, Tenable keeps it and attaches the AliyunECSDiskEncryptRolePolicy system policy
Storage N/A N/A
Network
  • 1 DHCP Options Set
  • 2 Elastic IPs
  • 2 ENIs (Elastic Network Interfaces)
  • 1 NAT gateway
  • 3 Route tables
  • 3 Security groups
  • 1 SLB (Server Load Balancer)
  • 2 VSwitches
  • 1 VPC
  • 1 VPC Gateway Endpoint (OSS)
  • VSwitches — 1 Egress VSwitch for outbound traffic; 1 Private VSwitch for internal communication
  • Elastic IPs — Used by the NAT gateway and ACK cluster
  • NAT gateway — Used for egress traffic
  • SLB — Internal load balancer for Kubernetes API server
  • VPC — Network container
  • VPC Gateway Endpoint — Private access to Object Storage
Security
  • KMS instance
  • 2 KMS keys
  • KMS instance — Key Management Service for the region
  • KMS key — Used to encrypt and decrypt Kubernetes secrets
  • KMS key — Used to re-encrypt snapshots of disks encrypted with Alibaba-managed keys so they can be scanned. Shared with the accounts the outpost scans

AWS

Resource Requirement Context
Compute
  • EKS cluster
  • 2 On-demand management virtual machine, 4 vCPU, and 16 GB RAM
  • Scanning virtual machines
  • EKS cluster — Manages scanning operations and orchestration
  • Management virtual machines — Orchestrate scanning processes initiated by the EKS cluster
  • Scanning virtual machines — Execute the scanning operations. Scalable on demand, with a maximum capacity of 32 vCPUs and 64 GB RAM
    Note: Could be increased if needed

The number and size of provisioned nodes are automatically managed by Tenable to minimize costs while meeting scanning demands
Identities 5 IAM roles
  • Used by the EKS cluster (control plane)
  • Used by Kublet management nodes
  • Used by Karpenter nodes Kublet for launching and scanning VMs
  • Used by the EBS CSI driver for attaching disks to a EC2 instance for scanning
  • Used by the management pod
Storage N/A N/A
Network
  • 2 Elastic IPs
  • 1 Internet gateway
  • 2 NAT gateways
  • 6 Route tables
  • 4 Security groups
  • 6 Subnets
  • 1 VPC
  • Subnets — 2 Egress subnets to communicate externally; 2 private subnets to communicate internally
  • Internet gateway — Used for egress traffic
  • NAT gateways — Used by the NAT
  • VPC — Network container

The subnets are used for private subnets, EKS (control plane and workers), and VPC
Security KMS key Used to encrypt and decrypt Kubernetes secrets
Minimum Estimated Cost (per month) $300 Minimum cost for infrastructure, not including scanning costs. Learn more about scanning costs for Workload and Data Protection.

Azure

Resource Requirement Context
Compute
  • AKS cluster
  • 2 On-demand management virtual machine, 4 vCPU, and 16 GB RAM
  • Scanning virtual machines
  • Internal load balancer
  • AKS cluster — Manages scanning operations and orchestration
  • Management virtual machines — Orchestrates scanning processes within the AKS cluster
  • Scanning virtual machines — Execute the scanning operations. Scalable on demand, with a maximum capacity of 32 vCPUs and 64 GB RAM.
    Note: Could be increased if needed
  • Load balancer — Used for managing inbound and outbound traffic for the ASK API server
Identities 3 User-managed identities
  • Used by the AKS cluster (control plane) for:
    • Attach disks to a VM for scanning
    • Encrypt and decrypt Kubernetes secrets
  • Used by Kublet (created by Azure automatically upon AKS creation)
  • Used by Karpenter for launching and scanning VMs
Storage
  • 1 Storage account
    • 1 Blob container
 Copies managed disks from the scanned subscription to the scanning subscription
Network
  • 3 Subnets
    • 3 Network security groups
  • 1 Private endpoint
  • 1 NAT gateway
  • 1 Public IP
  • 1 Virtual network
  • 3 Route tables
  • Subnets — 1 egress subnet to communicate externally; 1 private subnet to communicate internally; 1 subnet for ASK API server VNet integration
    • Security groups — Used per network subnet
  • Private endpoint — Maps a private IP from the AKS virtual network to Azure key vault, isolating API traffic from the internet.
  • NAT gateway — Used for egress traffic
  • Public IP — Used by the NAT
  • Virtual network — Network container
  • Route tables — Used by the subnets
Security Key vault key Used to encrypt and decrypt Kubernetes secrets
Minimum Estimated Cost (per month) $325 Minimum cost for infrastructure, not including scanning costs. Learn more about scanning costs for Workload and Data protection.

GCP

Resource Requirement Context
Compute
  • 1 GKE cluster
  • 1 Spot machine - e2-standard-2 (2vCPU and 8GB RAM)
  • GKE Cluster — Manages scanning operations and orchestration

The number and size of provisioned nodes are automatically managed by Tenable to minimize costs while meeting scanning demands
Identities 1 Service account (per project) Used by the GKE cluster nodes Kubelet (control plane)
Storage N/A N/A
Network
  • 1 Egress subnet
  • 1 Private subnet
  • 1 IP address
  • 1 Router
  • 1 NAT gateway
  • 1 VPC (per project)
  • Subnets — 1 egress subnet to communicate externally; 1 private subnet to communicate internally
  • Router + NAT — Used for egress traffic
  • IP — Used by the NAT
  • VPC (Network container): Provides network isolation for the private subnet and GKE (control plane and nodes)
Security Cloud key ring key Used to encrypt and decrypt Kubernetes secrets
Minimum Estimated Cost (per month) $300 Minimum cost for infrastructure, not including scanning costs. Learn more about scanning costs for Workload and Data Protection.

OCI

Resource Requirement Context
Compute
  • 1 OKE cluster
  • Nodes
  • Nodes — One node per Availability Domain

Tenable automatically manages the number and size of provisioned nodes to minimize costs while meeting scanning demands
Identities N/A N/A
Storage N/A N/A
Network
  • 3 Subnets
  • 3 Route tables
  • VCN
  • 3 Security lists
  • 1 Internet gateway
  • 1 Reserved IP
  • 1 NAT gateway
  • 1 Service gateway
  • Subnets — 2 egress subnets to communicate externally; 1 private subnet to communicate internally
  • NAT gateway — Used for egress traffic
  • IP — Used by the NAT
  • VCN (Network container): Provides network isolation for private subnets and OKE (control plane and nodes)
Security
  • Vault
  • Key
 Used to encrypt and decrypt Kubernetes secrets
Minimum Estimated Cost (per month) $300 Minimum cost for infrastructure, not including scanning costs. Learn more about scanning costs for Workload and Data Protection.