Skip to content

Commit c9847e5

Browse files
committed
Learn Editor: Update quickstart-onboard-aws.md
1 parent 2b84ea9 commit c9847e5

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

articles/defender-for-cloud/quickstart-onboard-aws.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,17 +36,16 @@ Microsoft Defender for Cloud CSPM service acquires a Microsoft Entra token with
3636

3737
The Microsoft Entra token is exchanged with AWS short living credentials and Defender for Cloud's CSPM service assumes the CSPM IAM role (assumed with web identity).
3838

39-
Since the principle of the role is a federated identity as defined in a trust relationship policy, the AWS identity provider validates the Microsoft Entra token against the Microsoft Entra ID through a process that includes:
39+
Since the principal of the role is a federated identity as defined in a trust relationship policy, the AWS identity provider validates the Microsoft Entra token against the Microsoft Entra ID through a process that includes:
4040

4141
- audience validation
4242

43-
- signing of the token
44-
43+
- token digital signature validation
4544
- certificate thumbprint
4645

4746
The Microsoft Defender for Cloud CSPM role is assumed only after the validation conditions defined at the trust relationship have been met. The conditions defined for the role level are used for validation within AWS and allows only the Microsoft Defender for Cloud CSPM application (validated audience) access to the specific role (and not any other Microsoft token).
4847

49-
After the Microsoft Entra token validated by the AWS identity provider, the AWS STS exchanges the token with AWS short-living credentials which CSPM service uses to scan the AWS account.
48+
After the Microsoft Entra token is validated by the AWS identity provider, the AWS STS exchanges the token with AWS short-living credentials which the CSPM service uses to scan the AWS account.
5049

5150
## Prerequisites
5251

@@ -303,3 +302,4 @@ Connecting your AWS account is part of the multicloud experience available in Mi
303302
- Set up your [on-premises machines](quickstart-onboard-machines.md) and [GCP projects](quickstart-onboard-gcp.md).
304303
- Get answers to [common questions](faq-general.yml) about onboarding your AWS account.
305304
- [Troubleshoot your multicloud connectors](troubleshooting-guide.md#troubleshooting-the-native-multicloud-connector).
305+

0 commit comments

Comments
 (0)