Asset Discovery¶

Asset Discovery scans all Azure Key Vaults across your subscriptions to inventory secrets, keys, and certificates with expiration tracking.

Overview¶

Discovery provides a centralized view of all vault contents across your Azure environment:

• Multi-subscription scanning: Scan all Key Vaults across multiple Azure subscriptions
• Complete inventory: Secrets, keys, and certificates with metadata
• Expiration tracking: Visual indicators for healthy, warning, and critical status
• Historical data: Track changes over time with scan history
• Delta scanning: Efficient updates using cached data

What Gets Scanned¶

Secrets¶

Keys¶

Certificates¶

Running a Scan¶

From the UI¶

1. Navigate to the Assets tab
2. Click Scan Now
3. Select scan mode:
4. Full Scan: Complete refresh of all data
5. Delta Scan: Only fetch changes (faster)
6. Monitor progress in real-time
7. View results when complete

Via API¶

# Start a full scan
curl -X POST http://localhost:8080/api/assets/discovery/scan \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode": "full"}'

# Start a delta scan (faster)
curl -X POST http://localhost:8080/api/assets/discovery/scan \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode": "delta"}'

Scan Modes¶

Expiration Status¶

CertifyClouds categorizes assets by expiration status:

Configuring Thresholds¶

Thresholds are configurable per alert rule:

1. Go to Settings > Alerts
2. Create or edit an expiring secrets rule
3. Set your preferred threshold (e.g., 14, 30, 60 days)

Scan Results¶

Dashboard View¶

The Assets dashboard shows:

• Total Assets: Count by type (secrets, keys, certificates)
• Expiration Distribution: Donut chart of healthy/warning/critical
• Recent Scans: History with duration and counts
• Vault List: All vaults with asset counts

Asset Details¶

Click any vault to see:

• Vault Properties: Name, location, resource group, SKU
• Access Configuration: RBAC vs Access Policies
• Network Settings: Public/private access, firewall rules
• Asset List: All secrets, keys, and certificates

Export Options¶

Export scan results in multiple formats:

• JSON: For automation and integration
• CSV: For spreadsheets and reporting
• PDF: For compliance documentation

Scan Performance¶

Configuration¶

Tune scan performance via Settings > Advanced or environment variables:

Performance Tips¶

1. Use Delta Scans: For regular monitoring, delta scans are significantly faster
2. Reduce Workers: If hitting Azure API rate limits, reduce max workers
3. Subscription Filtering: Scan only needed subscriptions to reduce time
4. Schedule Off-Peak: Run full scans during low-usage periods

Typical Scan Times¶

Scheduled Scanning¶

CertifyClouds can automatically run discovery scans on a schedule:

Configure Schedule¶

1. Go to Settings > Discovery
2. Enable Scheduled Scanning
3. Set frequency:
4. Every 6 hours
5. Every 12 hours
6. Daily
7. Custom cron expression
8. Save settings

Best Practices¶

• Run at least once daily for compliance monitoring
• Use delta scans for frequent schedules
• Schedule full scans weekly
• Monitor scan history for performance trends

Filtering and Search¶

Filter Options¶

Search¶

Search across all assets by:

• Name (partial match)
• Tags (key or value)
• Content type
• Vault name

Troubleshooting¶

"Access denied" for some vaults¶

Cause: CertifyClouds doesn't have read permissions on the vault.

Fix: Run the setup script to grant permissions:

./setup-certifyclouds-access.sh --principal-id $PRINCIPAL_ID --apply

"Network unreachable" errors¶

Cause: Key Vault has firewall enabled and CertifyClouds IP is blocked.

Fix: Add your subnet to the vault's firewall rules, or use private endpoints.

Slow scan times¶

Cause: Too many concurrent workers hitting rate limits.

Fix: Reduce DISCOVERY_MAX_WORKERS to 3 or lower.

Missing subscriptions¶

Cause: CertifyClouds doesn't have Reader role on the subscription.

Fix: Grant Reader role at subscription scope:

az role assignment create \
  --assignee $PRINCIPAL_ID \
  --role Reader \
  --scope /subscriptions/<subscription-id>

API Reference¶

Start Scan¶

POST /api/assets/discovery/scan
Content-Type: application/json

{
  "mode": "full" | "delta" | "force",
  "subscriptions": ["sub-id-1", "sub-id-2"]  // optional filter
}

Get Scan Status¶

GET /api/assets/discovery/scan/{scan_id}/status

Get Scan Results¶

GET /api/assets/discovery/scan/{scan_id}/results

List All Assets¶

GET /api/assets/discovery/assets?type=secret&status=critical

Best Practices¶

1. Run Regular Scans: Schedule daily delta scans for continuous monitoring
2. Act on Critical: Address critical expiration items immediately
3. Set Up Alerts: Configure email/webhook alerts for expiring assets
4. Review Compliance: Check compliance score after each scan
5. Archive History: Keep scan history for audit trails