Connect Cloud Account

From the Multicloud Defense Controller dashboard, click Setup located to the left of the window.

Select Connect Account.

Select the AWS icon.

Enter the information in the modal:

1. Click Launch Stack to download and deploy our CloudFormation template. This should open up another tab to deploy the template.

2. Log in to AWS. Copy and paste the controller IAM role ARN from the CloudFormation stack output in the CloudFormation template.

3. In the Multicloud Defense Controller easy setup modal, enter the AWS Account Number. This number can be found in the output value Current Account of the CloudFormation Template.

4. Assign an Account Name to your account in the Multicloud Defense Controller.

5. (Optional) Enter an account Description.

6. Enter the External ID. This random string is for the IAM role's trust policy used in the controller IAM role. You can edit or regenerate the External ID.

7. Enter the Controller IAM Role. This is the IAM role created for the Multicloud Defense Controller during CloudFormation Template (CFT) deployment. Look for the output value MCDControllerRoleArm in CFT stack. It should be something similar to this: arn:aws:iam::<Acc Number>:role/ciscomcdcontrollerrole.

8. Enter the Inventory Monitor Role. This is the IAM role created for Multicould Defense Inventory during CFT deployment. Look for the output value MCDInventoryRoleArn in CFT stack. Should be something similar to this: arn:aws:iam::<Acc Number>:role/ciscomcdinventoryrole.

Click Next to onboard your account to the Multicloud Defense Controller.

In the Security Cloud Control dashboard, click the Multicloud Defense tab located in the left navigation pane.

Click Multicloud Defense Controller located in the upper right window.

From the Multicloud Defense Controller dashboard, click Setup located to the left of the window.

Select Connect Account.

Select the Azure icon.

Enter the required information:

1. Click the link to open an Azure Cloud Shell in bash mode.

2. In the Azure account modal, click Copy to copy the onboarding script and execute it in the bash shell that was opened in step 1.

3. In the Azure account modal, provide a name for this Azure account. You can choose to name this the same as your Azure subscription name. This name is visible on the Multicloud Defense Controller accounts page only.

4. (Optional) Provide a description for the subscription.

5. Enter the Directory ID, also referred as the Tenant ID.

6. Enter the Subscription ID for the subscription being onboarded.

7. Enter the Application ID, also referred to as the Client ID, created by the onboarding script.

8. Enter the Client Secret, also referred to as the Secret ID.

Click Next.

In the Multicloud Defense Controller dashboard, click Setup.

Select Connect Account.

Select the GCP icon.

Click Cloud Platform Cloud Shell to launch the Cloud Shell. You can also log into your GCP account and launch the Cloud Shell from the project to connect to Multicloud Defense; note that the script automatically modifies the project name to the name of the project you launch the cloud shell from.

1. Copy the command generated in the Multicloud Defense Controller easy setup modal and paste the command into the Cloud Shell. Execute it to initiate the onboarding process. This script automatically creates user accounts enabling Multicloud Defense Controller to communicate directly with your GCP project.

2. If you have multiple GCP projects, you are prompted to select the project through a numbered list. Select the value for the project you want to connect and submit.

3. When prompted with Continue configuring this project? [y/n] note that you only need to type either "y" or "n". Do not hit enter to submit your selection.

Enter the required information:

1. Enter the GCP Account Name. This name is displayed only in Multicloud Defense.

2. (Optional) Enter a Description.

3. Enter the Project ID for the GCP project. This can be found at the top of the private key generated by the script from step 1.

4. Enter the Client Email for the service account created as part of the onboarding process. This is included in the private key generated by the script from step 1.

5. Copy and paste the Private key of the service account from the script output.

Click Next.

Log in to your OCI tenant.

Navigate to Identity & Security > Groups.

Click Create Group.

Enter the following:

Click Create.

Create a Network Firewall Policy in OCI. For more information, refer to the OCI documentation. Include this information when creating the policy:

1. Add the following permissions under the Show Manual Editor tab:

   
   Allow group <group_name> to inspect instance-images in compartment <compartment_name>
   Allow group <group_name> to read app-catalog-listing in compartment <compartment_name>
   Allow group <group_name> to use volume-family in compartment <compartment_name>
   Allow group <group_name> to use virtual-network-family in compartment <compartment_name>
   Allow group <group_name> to manage volume-attachments in compartment <compartment_name>
   Allow group <group_name> to manage instances in compartment <compartment_name>
   Allow group <group_name> to {INSTANCE_IMAGE_READ} in compartment <compartment_name>
   Allow group <group_name> to manage load-balancers in compartment <compartment_name>
   Allow group <group_name> to read marketplace-listings in tenancy
   Allow group <group_name> to read marketplace-community-listings in tenancy
   Allow group <group_name> to inspect compartments in tenancy
   Allow group <group_name> to manage app-catalog-listing in compartment <compartment_name>
   Allow group <group_name> to read virtual-network-family in tenancy
   Allow group <group_name> to read instance-family in tenancy
   Allow group <group_name> to read load-balancers in tenancy 

   • group_name: Multicloud Defense-controller-group.

   • compartment_name:[Compartment where Multicloud Defense will be deployed].

     Note

     When replacing the <compartment_name> with the name of the compartment where the policy will apply, if the compartment is a sub-compartment, the name format is compartment:sub-compartment (for example, Prod:App1).

     If the <compartment_name> is specified as the root compartment (e.g., multicloud (root)), OCI will not accept the policy and will produce an error: Invalid parameter. The policy will need to be defined for a specific compartment and that compartment cannot be the root compartment.

2. Click Create.

Create a user in OCI. For more information, refer to the OCI documentation. Provide the configuration information when creating a user:

Create an API Key. For more information, refer to the OCI documentation.

Accept the Terms and Conditions for an OCI account. For more information, refer to the OCI documentation. Ensure to access the Change image section of the UI to add the following "community image" information specific to Multicloud Defense:

1. Check the box for Multicloud Defense.

2. Check the box for I have reviewed and accept the Publishers terms of use, Oracle Terms of Use, and the Oracle General Privacy Policy.

3. Click Exit without deploying the image prior to connecting the account to Multicloud Defense.

   Repeat the steps for each compartment you plan to deploy a Multicloud Defense Gateway.

In the Multicloud Defense Controller dashboard, click Setup.

Select Connect Account.

Select the OCI icon.

Click Oracle Cloud Shell to launch the native shell prompt.

Run the command from the Multicloud Defense Setup wizard in your cloud shell.

Enter the required information:

1. Enter an OCI Account Name. This name is used only within the Multicloud Defense Controller and used for identification purposes.

2. (Optional) Enter a Description of your account.

3. Enter your Tenancy OCID . This is your Tenancy Oracle Cloud Identifier obtained from the OCI User.

4. Enter the Private Key that is assigned to the OCI User.

Click Next.