Conjur Cloud Integration

GGScout supports integration with Conjur Cloud to collect and monitor your secrets. This guide will help you set up and configure the integration.

Supported Features

• Multiple secret versions collection
• CyberArk authentication
• Tenant-specific configuration
• Subdomain support

Configuration

To configure GGScout to work with Conjur Cloud, add the following configuration to your ggscout.toml file:

CyberArk Authentication

[sources.conjur]
type = "conjurcloud"
auth_mode = "cyberark"
conjur_url = "${CONJUR_URL}"
client_id = "${CYBERARK_CLIENT_ID}"
client_secret = "${CYBERARK_CLIENT_SECRET}"
tenant_id = "${CYBERARK_TENANT_ID}"
subdomain = "my-company"
fetch_all_versions = true
mode = "read"

Workload Authentication

[sources.conjur]
type = "conjurcloud"
auth_mode = "workload"
api_key = "${CONJUR_API_KEY}"
login = "${CONJUR_LOGIN}"
subdomain = "my-company"
fetch_all_versions = true
mode = "read"

Configuration Parameters

Parameter	Description	Required	Default Value
type	Must be set to "conjurcloud"	Yes
auth_mode	Authentication mode (one of: "cyberark", "workload")	Yes
subdomain	Your company's subdomain	Yes
fetch_all_versions	Whether to collect all versions of secrets	Yes
mode	Integration mode (one of: "read", "write", "read/write")	No	"read"

With additional parameters depending on the chosen authentication mode:

For CyberArk Authentication:

Parameter	Description	Required	Default Value
client_id	The client ID for authentication	Yes
client_secret	The client secret for authentication	Yes
tenant_id	The tenant ID	Yes

For Workload Authentication:

Parameter	Description	Required	Default Value
api_key	Your Conjur API key	Yes
login	Your Conjur login	Yes

Authentication

GGScout supports authentication with Conjur Cloud through:

1. CyberArk Integration: Using client ID and secret
2. Environment Variables: Using standard Conjur environment variables

Environment Variables

• CONJUR_URL: The Conjur Cloud URL

For CyberArk Authentication:

• CYBERARK_CLIENT_ID: Your CyberArk client ID
• CYBERARK_CLIENT_SECRET: Your CyberArk client secret
• CYBERARK_TENANT_ID: Your CyberArk tenant ID

For Workload Authentication:

• CONJUR_API_KEY: Your Conjur API key
• CONJUR_LOGIN: Your Conjur login

Best Practices

1. Use environment variables for sensitive credentials
2. Follow the principle of least privilege for access policies
3. Enable fetch_all_versions to track changes in your secrets over time
4. Regularly rotate client secrets
5. Use separate subdomains for different environments
6. Implement proper secret rotation policies