Cloud Account Discovery FAQ

Cloud Onboarding Flow via > Connection Cloud Account Discovery Flow
Primarily for onboarding single accounts, except for an AWS organization. This flow supports only single account onboarding for Azure and GCP.

Supports multiple account discovery for all cloud providers — AWS, Azure, and GCP. Tenable Cloud Security can automatically discover the following:

  • All member accounts in an AWS organization.

  • All Azure subscriptions in a management group.

  • All projects in a GCP organization.
Tenable Cloud Security can onboard all accounts in an AWS organization. However, if you create a new account after onboarding, you must onboard that single account manually. With cloud account discovery, Tenable Cloud Security schedules discovery every 24 hours and automatically discovers any new member accounts in the management account. The new account has the icon next to it, indicating that it is newly discovered. All newly discovered accounts must be configured by providing the credentials and associated with projects before they can be assessed.

Cloud discovery supports single account onboarding. To onboard a single account, select the account type as Single and provide the credentials of the account in the cloud discovery flow. Tenable Cloud Security onboards the account, but no further discovery happens.

The default schedule for the account discovery process is every 24 hours. The schedule cannot be configured.

You cannot delete a cloud account from Tenable Cloud Security; but, you can ignore the cloud account that you no longer want to scan. Ignoring an account results in the disassociation of the cloud account from the project and stops any future assessment. Tenable Cloud Security removes all findings related to the cloud account. The account still appears in the user interface with the Ignored status, but is not deleted. For more information, see Ignore a Cloud Account.

Tenable Cloud Security dissociates an ignored cloud account from the project and no longer includes the account in any future scans. All findings related to the cloud account are removed from Tenable Cloud Security.

You can onboard an Ignored account again with the Configure option. Provide the credentials of the ignored cloud account and the associated project. After you save this configuration, the cloud account status changes to Discovered and the account is ready for assessment. For more information, see Edit the Configuration of a Cloud Account.

You can still use the existing cloud onboarding flow via > Connection to onboard cloud accounts. For onboarding multiple accounts automatically, Tenable recommends using the cloud account discovery flow.

Yes. Any management account that is onboarded via the > Connection flow shows as a member account in the Cloud accounts tab. To enable cloud account discovery for that account, onboard the account again (with account type as Multiple) using the cloud discovery flow. This enables automatic discovery of all member accounts.

Tenable Cloud Security does not discover any new member accounts created after the organization onboarding via the > Connection flow. Manually onboard those new member accounts.

Verify if cloud account discovery failed due to any of the following conditions:

  • The cloud account credentials used for the discovery have changed. Update the credentials of your cloud account in Tenable Cloud Security.

  • The cloud account expired or the cloud service provider deactivated the account. Activate your cloud account to enable cloud account discovery.

With the Ignore option, you can exclude an account from any future scan, but you can still view the account in Tenable Cloud Security as long as the account is active in the cloud. Tenable Cloud Security does not provide the option to delete a cloud account because of the potential security risk when an active cloud account is deleted from Tenable Cloud Security unintentionally. Another advantage of the Ignore option is that it is much easier to re-onboard an ignored cloud account and make it available for assessment.

Any cloud account that is decommissioned, closed, canceled, shut, or terminated by the cloud provider appears with the Suspended state in Tenable Cloud Security. All such cloud accounts are deleted by the cloud provider after a certain waiting period or post-closure period, which varies for each cloud service provider. Tenable Cloud Security then automatically removes such deleted cloud accounts and they no longer appear in the user interface.