Terraform (Recommended)

Table of Contents

Automate cloud IP-Tag collection and distribution in Strata™ Cloud Manager to enable dynamic security policies using Terraform templates.

This procedure guides you through connecting SCM to your cloud environment for IP-Tag collection using Terraform templates.

Log in to SCM.
Select Configuration IP-Tag Collection
On the IP-Tag Collection page, select Add New Cloud Account.
Select your cloud service provider.
Select Connect via Terraform (Recommended).
Enter a descriptive Name.
Enter the information, depending on your cloud service provider
- AWS—Enter the Role Name associated with your AWS account.
- Azure—Enter your Azure Tenant ID and Subscription ID.
- CGP—Enter your GCP Project ID and Service Account.
Click Next: Integrate Cloud Account to continue.
Download your Terraform template.
- If you are familiar with Terraform click the Download Terraform.
- If you are new to Terraform, follow the Guided Steps.
Click Save Configuration.
Verify the cloud service provider account connection status. A successful connection ensures that SCM can communicate with your cloud environment and begin the tag discovery process.

Configure Tag Distribution

Create a new Tag Distribution for your onboarded AWS account.
1. On the IP-Tag Collection page, choose a successfully connected cloud account.
2. Click + Distribute.
Define the scope for tag collection. Specifying regions and VPCs ensures that only relevant IP-to-tag mappings are collected, optimizing performance and data relevance for your security policies.
1. Enter a descriptive Name.
2. Enter a Polling Interval in seconds.
3. Select Regions and VPC (AWS only).
4. Optional For Azure deployments, select Fetch Service Tags. For more information about Azure service tag and Palo Alto Networks firewalls, see Attributes Monitored on Azure
Select Tag Destination folders containing the firewalls intended to receive the IP-to-tag mappings. Specify the target for tag distribution.
Save the Tag Distribution configuration. Saving the distribution settings makes them active within SCM, preparing them for deployment to your firewalls.
Push the configuration to your firewall.
1. Navigate to ConfigurationPush Config.
2. Select the relevant Admin Scope and Folder.
3. Select Push. This synchronizes the cloud integration and harvested IP-to-tag mappings from Strata Cloud Manager to your managed firewalls, enabling granular Layer 7 security policies based on real-time asset classifications.