Connect an OVHcloud account

Authorize CISAPP read-only on an OVHcloud account to inventory cloud resources and report security posture findings.

Access: organization administrator. Beta feature; the connector must be enabled on your platform.

Prerequisites

• Be an organization administrator in CISAPP.
• Be able to sign in to the OVHcloud account to analyze with its customer identifier (nichandle, like xx11111-ovh) with an account allowed to create API keys: the authorization is granted with that account.
• Know the account region: Europe, Canada or United States. An OVHcloud account belongs to one region.
• An OVHcloud account can only be connected to one CISAPP organization.

CISAPP never asks for a password or a key to copy: authentication only happens on the OVHcloud site.

Connect in CISAPP

1. Open My company → Connectors, then Connect on the OVHcloud card.
2. Choose the account region (Europe, Canada or United States), then Continue to OVHcloud.
3. You are redirected to the OVHcloud authorization page: sign in with the account to analyze.
4. Choose the validity period of the authorization. Prefer a dated validity over "Unlimited": an authorization without an expiration date is flagged in CISAPP, and you will have to renew it before it expires.
5. Authorize the access. OVHcloud brings you back to CISAPP automatically.
6. Check the displayed OVHcloud account (customer identifier), then Connect. The first synchronization starts.

If you close the wizard before confirmation, the connection stays Pending: use Resume validation from its record (renew the authorization on OVHcloud, then confirm the account). If you refused the authorization or let the page expire, start the connection again to request a new one.

What CISAPP collects

CISAPP only performs reads (read-only requests, on a limited list of routes) and only reads configuration, never content:

• Public Cloud: instances, security groups, volumes, private networks, Object Storage buckets (configuration, not the objects), managed databases, managed Kubernetes clusters;
• dedicated servers, virtual private servers (VPS), web hostings;
• domain names and DNS zones, IP address blocks;
• services and their expiration and renewal dates;
• account security: two-factor authentication, IP restrictions, API keys (expiration dates, last use, allowed addresses).

A product that the authorization does not cover is reported as not granted in the synchronization result. Resources appear in the Operational Safety → Cloud inventory menu entry and its Map view, with their region and location.

What CISAPP never reads

CISAPP changes nothing in your account and never reads:

• personal profile information (contacts, contact details) or phone numbers;
• domain transfer codes;
• IPMI access, Object Storage (S3) credentials, kubeconfig files or database access credentials;
• bucket content (objects), secrets and encryption keys;
• rescue passwords, SSH keys and access tokens of instances, servers and hostings.

A single write is requested: letting the authorization cancel itself when you disconnect or renew the connection.

Posture findings

Findings appear in security findings with the OVHcloud posture source. A rule only triggers when the information is certain: an unknown state (product not granted, unreadable value) neither creates nor resolves a finding.

• Account: two-factor authentication not enabled; API key without an expiration date, unused for more than 90 days or usable from any IP address.
• Domains: domain without a transfer lock, without DNSSEC although the extension supports it, or close to expiry (less than 30 days) without automatic renewal.
• Services: service close to expiry without automatic renewal, or unpaid.
• Network: security group reachable from the whole Internet (0.0.0.0/0 or ::/0) on remote administration (SSH 22, RDP 3389) or on a common database port (3306, 5432, 6379, 27017…).
• Managed databases: public access without an IP restriction, no backup.
• Kubernetes: API reachable from the whole Internet, available upgrade not applied, audit logs missing.
• Object storage: bucket without encryption at rest or without versioning. Public bucket detection is not possible with the OVHcloud API.
• Servers and hostings: dedicated server without the OVHcloud hardware firewall enabled, web hosting without an SSL certificate, instance created from an end-of-support image.

The connection's own key is excluded from these rules and handled separately: without an expiration date it shows a warning on the record; less than 30 days before expiry, a Credentials expiring soon badge.

Renew the authorization

1. On the connection record, Update credentials then Renew the authorization.
2. You are redirected to OVHcloud: sign in to the same account, choose a new dated validity and authorize.
3. Back in CISAPP, confirm the account. The new authorization replaces the old one, which is revoked.
4. If it belongs to another OVHcloud account, it is refused and the current authorization is kept.

The region cannot be changed after creation: an OVHcloud account belongs to one region.

Disconnect and revoke

Disconnect deletes the connection and its cloud inventory, and marks its posture findings as resolved. CISAPP also automatically asks OVHcloud to cancel the authorization; if that cancellation fails, it stays valid until it expires. Then revoke it manually in your OVHcloud account, in the API keys (credentials) section, by deleting the authorization created for CISAPP.

Common issues

Message	What to do
The OVHcloud connector is unavailable on this instance	The connector is not configured on your platform yet: contact support.
The OVHcloud validation is not finished, or the authorization was refused or expired	Finish the validation on the OVHcloud page, or start the connection again to get a new authorization.
OVHcloud refused this authorization	The validation was refused or expired: start the connection again.
This OVHcloud account is already connected by another CISAPP organization	An OVHcloud account has a single connection: disconnect it from the other CISAPP organization first.
This authorization belongs to another OVHcloud account	When renewing, sign in to the same OVHcloud account.
Product "not granted"	The authorization does not cover this product: renew it, then check that your account has access to it.
Expired service (error 460) in the synchronization	A service (for example a domain) has expired at OVHcloud: this is not an authorization problem, the rest of the account is analyzed. Renew or delete that service.
Expired or refused credentials	The authorization expired or was revoked: renew it from the record.

Expected result

The connection is active, the cloud inventory is populated and OVHcloud posture findings appear in CISAPP.

See also: Configure connectors.