CLI Commands

cnspec integrate azure

Onboard Azure subscriptions into Mondoo Platform for continuous scanning.

Connect your Azure environment to Mondoo Platform. The command creates an app registration, its credentials, and the role assignments Mondoo needs. To learn about the full setup, read Terraform setup.

By default, Mondoo discovers every subscription and integrates it for continuous scanning:

cnspec integrate azure

To scan only specific subscriptions, pass them with --allow:

cnspec integrate azure --allow SUBSCRIPTION_ID_1 --allow SUBSCRIPTION_ID_2

To scan every subscription except the ones you specify, pass them with --deny:

cnspec integrate azure --deny "SUBSCRIPTION_ID_1,SUBSCRIPTION_ID_2"

You can't use --allow and --deny together.

The integration's resources are created in a primary subscription. If you don't set it with --subscription-id, cnspec lists your subscriptions with the Azure CLI (az account list) and asks you to select one. In a non-interactive shell, cnspec lists them and exits, so pass --subscription-id. To authenticate with Workload Identity Federation instead of a certificate, add --use-wif. To also scan Azure VMs using RunCommand, add --scan-vms.

Options

      --allow strings            Set the Azure subscriptions to include in scanning
      --deny strings             Set the Azure subscriptions to exclude from scanning
  -h, --help                     help for azure
      --scan-vms                 Enable scanning Azure VMs using RunCommand
      --subscription-id string   Set the Azure subscription used to create resources
      --use-wif                  Use Workload Identity Federation (keyless) instead of a certificate

Options inherited from parent commands

      --api-proxy string          Set the proxy for communications with Mondoo Platform API
      --auto-update               Enable automatic provider installation and update (default true)
      --config string             Set config file path (default $HOME/.config/mondoo/mondoo.yml)
      --integration-name string   Set the name of the integration
      --log-level string          Set the log level: error, warn, info, debug, trace (default "info")
      --logging-config string     Path to a logging configuration file (YAML or JSON) that selects the log writer, level, and writer-specific options
      --output string             Set the location to write automation code
      --space string              Set the space to create the integration
      --strict                    Default MQL strict mode for policies that do not declare one: every link in an MQL chain must resolve
  -v, --verbose                   Enable verbose output

SEE ALSO

  • cnspec integrate - Onboard integrations for continuous scanning into the Mondoo Platform

On this page