Cloud Side-Scan (Azure/GCP)
cloud_side_scanDestructive
Run agentless cloud disk side-scan to snapshot and mount read-only, record SBOM/CVE/secret metadata, then tear down. Fail-closed returns disabled or unavailable if unable to scan.
Instructions
Trigger one agentless Azure/GCP disk side-scan and read back honest state.
Runs the same executor as ``agent-bom cloud side-scan`` and the REST
``POST /v1/cloud/side-scan``: snapshot the disk, mount a temp copy on an
in-account collector read-only, record SBOM + CVE + secret *metadata* only,
and tear every owned temporary resource down. Requires an admin operator +
``cloud:write`` scope. Credentials are never accepted here — the
executor resolves read-only credentials from the provider's default chain
(``credentialed_smoke=false``). Fail-closed and honest: OFF → ``disabled``;
missing extra/credentials → ``unavailable``; never a clean-workload claim.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| reason | No | Human audit reason for triggering the side-scan. | |
| region | No | Optional provider region hint for client construction. | |
| location | No | Azure location / GCP zone of the temp disk (must match the collector). | |
| provider | No | Cloud provider: 'azure' or 'gcp' (AWS EBS uses the CLI side-scan entrypoint). | |
| target_id | No | Managed/persistent disk resource id to scan. | |
| tenant_id | No | Tenant scope for the execution and durable lifecycle record. | default |
| account_id | No | Azure subscription id / GCP project id owning the disk + collector. | |
| collector_id | No | In-account collector VM/instance the temp disk attaches to. | |
| operator_role | No | Operator role for this write action (audit). | viewer |
| idempotency_key | No | Retry-safe key; the same key reuses one execution record. | |
| operator_scopes | No | Comma-separated operator scopes (audit). | |
| scan_secrets_enabled | No | Include the redacted secret scan (type + location only, never values). | |
| collector_resource_group | No | Azure only: resource group of the collector VM. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |