You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The diagram above shows a typical deployment where:
122
-
- The scanner infrastructure runs in a dedicated VPC with private instances
123
-
- Scanner instances are distributed across multiple zones in a Managed Instance Group
124
-
- Service account impersonation enables scanning of resources in the same project and cross-project
125
-
- All scanner communication goes through Cloud NAT for outbound connectivity to Datadog
126
-
127
-
### Module Relationships
128
-
129
-
```mermaid
130
-
flowchart TD
131
-
subgraph "GCP Project A - Scanner Project"
132
-
subgraph "Main Module"
133
-
VPC[VPC Module]
134
-
INST[Instance Module]
135
-
VPC --> INST
136
-
end
137
-
138
-
SSA[Scanner Service Account]
139
-
SSA --> INST
140
-
141
-
ISA_A[Impersonated Service Account A]
142
-
SSA -.impersonates.-> ISA_A
143
-
ISA_A -.scans.-> RES_A[Compute Resources A]
144
-
end
145
-
146
-
subgraph "GCP Project B - Other Project"
147
-
ISA_B[Impersonated Service Account B]
148
-
SSA -.impersonates.-> ISA_B
149
-
ISA_B -.scans.-> RES_B[Compute Resources B]
150
-
end
151
-
```
152
-
153
121
### How It Works
154
122
155
123
1.**Network Isolation**: The scanner runs in a dedicated VPC with private instances that have no external IP addresses. Outbound connectivity is provided through Cloud NAT.
0 commit comments