Skip to content

Commit e4f7d6a

Browse files
Merge pull request #262463 from lizetpenamsft/docs-editor/quickstart-onboard-aws-1704397806
Update quickstart-onboard-aws.md
2 parents 40d7642 + c9847e5 commit e4f7d6a

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

articles/defender-for-cloud/quickstart-onboard-aws.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,17 +36,16 @@ Microsoft Defender for Cloud CSPM service acquires a Microsoft Entra token with
3636

3737
The Microsoft Entra token is exchanged with AWS short living credentials and Defender for Cloud's CSPM service assumes the CSPM IAM role (assumed with web identity).
3838

39-
Since the principle of the role is a federated identity as defined in a trust relationship policy, the AWS identity provider validates the Microsoft Entra token against the Microsoft Entra ID through a process that includes:
39+
Since the principal of the role is a federated identity as defined in a trust relationship policy, the AWS identity provider validates the Microsoft Entra token against the Microsoft Entra ID through a process that includes:
4040

4141
- audience validation
4242

43-
- signing of the token
44-
43+
- token digital signature validation
4544
- certificate thumbprint
4645

4746
The Microsoft Defender for Cloud CSPM role is assumed only after the validation conditions defined at the trust relationship have been met. The conditions defined for the role level are used for validation within AWS and allows only the Microsoft Defender for Cloud CSPM application (validated audience) access to the specific role (and not any other Microsoft token).
4847

49-
After the Microsoft Entra token validated by the AWS identity provider, the AWS STS exchanges the token with AWS short-living credentials which CSPM service uses to scan the AWS account.
48+
After the Microsoft Entra token is validated by the AWS identity provider, the AWS STS exchanges the token with AWS short-living credentials which the CSPM service uses to scan the AWS account.
5049

5150
## Prerequisites
5251

@@ -303,3 +302,4 @@ Connecting your AWS account is part of the multicloud experience available in Mi
303302
- Set up your [on-premises machines](quickstart-onboard-machines.md) and [GCP projects](quickstart-onboard-gcp.md).
304303
- Get answers to [common questions](faq-general.yml) about onboarding your AWS account.
305304
- [Troubleshoot your multicloud connectors](troubleshooting-guide.md#troubleshooting-the-native-multicloud-connector).
305+

0 commit comments

Comments
 (0)