Conjur Cloud Integration

GGScout supports integration with Conjur Cloud to collect and monitor your secrets. This guide will help you set up and configure the integration.

Supported Features

• Multiple secret versions collection
• CyberArk authentication
• Tenant-specific configuration
• Subdomain support

Configuration

To configure GGScout to work with Conjur Cloud, add the following configuration to your ggscout.toml file:

[sources.conjur]
type = "conjurcloud"
auth_mode = "cyberark"
conjur_url = "${CONJUR_URL}"
client_id = "${CYBERARK_CLIENT_ID}"
client_secret = "${CYBERARK_CLIENT_SECRET}"
tenant_id = "${CYBERARK_TENANT_ID}"
subdomain = "my-company"
fetch_all_versions = true

Configuration Parameters

Parameter	Description	Required
type	Must be set to "conjurcloud"	Yes
auth_mode	Authentication mode (e.g., "cyberark")	Yes
conjur_url	The Conjur Cloud URL	Yes
client_id	The client ID for authentication	Yes
client_secret	The client secret for authentication	Yes
tenant_id	The tenant ID	Yes
subdomain	Your company's subdomain	Yes
fetch_all_versions	Whether to collect all versions of secrets	No

Authentication

GGScout supports authentication with Conjur Cloud through:

1. CyberArk Integration: Using client ID and secret
2. Environment Variables: Using standard Conjur environment variables

Environment Variables

• CONJUR_URL: The Conjur Cloud URL
• CYBERARK_CLIENT_ID: Your CyberArk client ID
• CYBERARK_CLIENT_SECRET: Your CyberArk client secret
• CYBERARK_TENANT_ID: Your CyberArk tenant ID

Best Practices

1. Use environment variables for sensitive credentials
2. Follow the principle of least privilege for access policies
3. Enable fetch_all_versions to track changes in your secrets over time
4. Regularly rotate client secrets
5. Use separate subdomains for different environments
6. Implement proper secret rotation policies