Set up CloudVision360

CloudVision360 finds security, compliance and cost problems across your clouds. A new organization opens on a Get started card with three steps; each one ticks itself off when it’s really done, and its How to link opens its section below. You need the CustomerAdmin or CloudAdmin role.

Connect Azure, AWS or Google Cloud

CloudVision360 only reads. It needs a least-privileged reader identity in your cloud; nothing in your cloud changes.

1. On the Get started card choose Connect a cloud (or go to Inventory → Cloud connections → Connect a cloud).
2. Pick the tab for your cloud and follow Before you start in the dialog. Each cloud has a ready-made template in the repository that creates the reader identity with exactly the permissions listed.

Amazon Web Services

1. Deploy the CloudFormation template (or a StackSet for every account in your AWS Organization), passing the ExternalId shown in the dialog.
2. Enter a Display name and your AWS account id, keep Cross-account IAM role with ExternalId (recommended), and paste the Role ARN the stack outputs.
3. For an Organizations management account, tick the box to discover and onboard every member account. List the Regions you use and choose Connect.

Microsoft Azure

1. Create an app registration (service principal) in Microsoft Entra ID and assign it Cost Management Reader and Security Reader on the subscription or management group. The setup script does both.
2. Enter a Display name, the Subscription id, the Entra tenant id, the Application (client) id and a Client secret with a short expiry (for example 90 days).
3. Tick Discover every subscription this service principal can read to bring them all in, and choose Connect.

Google Cloud

1. Create a dedicated service account and grant it the viewer roles listed in the dialog at organization, folder or project level. Turn on the Cloud Billing export to BigQuery if you want cost data.
2. Enter a Display name, the Project / folder / organization, optionally the Billing export table, and the Service-account key JSON. Workload Identity Federation is preferred where you can use it.
3. Choose Connect.

More detail, including the exact permissions: Connect Azure, Connect AWS, Connect Google Cloud.

Run the first scan

There’s nothing to start: the first scan runs on its own as soon as a cloud is connected, and then on your plan’s schedule.

1. Open Inventory → Cloud connections (the Get started card’s See scans button goes there). Each connection shows its access scope, health and Last scan.
2. To scan again now, choose Scan on a row or Scan all. Scan history shows each run’s stages: discover, configuration, identity, cost, compliance, risk, recommendations and report.

A first scan takes a few minutes. Scores, findings and savings appear across the app when it finishes.

Review Fix first

Fix first is a short, ranked plan: the fixes that remove the most risk and cost for the least effort.

1. Open Home → Fix first (or Open Fix first on the card).
2. Work from the top. Each action says how much risk it removes or money it saves, the effort, the owner, and which frameworks it helps. Findings or Savings opens the items behind it.

When all three steps are done the card disappears. Day-to-day use is in Use CloudVision360.