Configure an IP Tag Cloud Connection

If you have not already done so, activate User Context and configure a segment to receive the mapping information.

Select

User Context

IP-Tag Collection

.



Select the

Credential Configuration

tab if it is not already selected.

To

Set Up a New Credential Configuration

, select the type of configuration.

AWS—Connect to an Amazon Web Services (AWS) instance.
Azure—Connect to a Microsoft Azure Active Directory instance.



Enter a unique and descriptive

Name

for the configuration.

(

AWS only

) Configure your AWS connection.

To open your AWS administrator portal in a new window, click

Open CFT

.



Enter your
Access Key ID
.
To learn how to obtain your access key ID and secret access key, refer to the AWS documentation.
Enter your
Secret Access Key
.
Reenter your secret access key to
Confirm Secret Access Key
.
(Optional) Enter a
Role ARN Name
and
Role ARN Value
.
To configure additional Role ARNs, click
Add Role ARN
for each Role ARN you want to include. For more information on the Amazon Role Name (ARN), refer to the AWS documentation.
If you specify an ARN, you cannot also specify a VPC.

(

Azure only

) Configure your Azure connection.

Enter your
Client ID
.
To learn how to obtain the client ID and client secret, refer to the Azure documentation.

Enter your
Client Secret
.
Enter your
Tenant ID
.
To learn how to obtain the tenant ID and subscription ID, refer to the Azure documentation.
Enter your
Subscription ID
.

Verify the connection by clicking the

Test Connection

button.

For AWS configurations, you can optionally select the

Region

before testing the connection. By default, the Cloud Identity Engine selects the

US West

region; if this region does not allow API requests, select a region that can allow API requests.

Even if the connection test is not successful, you can still submit your configuration; until the connectivity issues are resolved, the configuration status is

Not connected

. You must resolve the connection issues for the configuration to successfully retrieve the IP-tag mappings.

Submit

the configuration.

To configure a connection for monitoring purposes (such as audits) or to share the IP-tag mapping information using a segment, select the

Monitor & Status

tab.

There are three states for the connection:

Connected
—The Cloud Identity Engine has successfully established a connection.
Partially connected
—The Cloud Identity Engine could successfully establish a connection to some aspects of the configuration, such as regions or VPCs for AWS, but not all of them.
Not connected
—The Cloud Identity Engine could not successfully establish a connection with the current configuration.



Set Up a New Monitor Configuration
and select the type of monitor configuration.
Enter a unique and descriptive
Name
for the configuration.

Select the
Credential Configuration
that you configured.
(
AWS only
) Optionally select the
Role ARN
you want to use.
Select if you want to configure the connection for
All Regions
,
All VPCs
(AWS only), or both.
To select a specific region or virtual private cloud (VPC), deselect the
All Regions
or
All VPCs
checkbox and allow the list of regions or VPCs to populate, then select the region or VPC you want to include. To select a specific VPC, you must select a region first.
Define the
Polling Interval (in seconds)
to specify how frequently the Cloud Identity Engine checks for new data.
The default is 60 seconds and the range is 60–1800 seconds.
Select the segment you configured in Step 1.
Because you cannot select another segment after you submit the configuration, ensure you select the correct segment before submitting the configuration. If you need to change the segment after you submit the configuration, you must create a new configuration and select the segment you want to use.
Submit
the configuration.

(

Strata Cloud Manager only

) If you are using Strata Cloud Manager, view the tags that the Cloud Identity Engine shares with Strata Cloud Manager by selecting an address group then select the

Tags from CIE

tab when you add match criteria.