Getting Started with External Key Source Connection

1. On the Select External KMS Type step, select Automated Scan as the scan type.

2. Under Select connection type, select External Key SourceConnections. Then, under Select external key source type, select Fortanix DSM (SaaS).

3. Click NEXT.

4.3 Set Up DSM (SaaS) Connection

Perform the following steps to add a Fortanix DSM (SaaS) connection on the Set Up DSM (SaaS) Connection step:

1. Connection name: Enter a name for your Fortanix DSM  (SaaS) connection.

2. Region: Select the required region from the drop down. For example, North America. For the list of all supported regions, refer to Fortanix DSM SaaS Global Availability Map.

3. This will create a DSM Connection. The connection can be deleted later from the connections screen: Select thecheck box to confirm that a Fortanix DSM SaaS connection will be created. The connection appears on the EXTERNAL KEY SOURCE tab on the Connections page, but it will not yet be integrated with Fortanix DSM.

4. Click ADD CONNECTION & PROCEED.

4.4 Add Admin App UUID

Perform the following steps to configure the private key and certificate on the Add Admin App UUID step:

1. Click GENERATE PRIVATE KEY to create a private key. You can generate a maximum of two private keys.

   • Click GENERATE ANOTHER PRIVATE KEY to generate an additional key.

   • You can delete the private key using .

2. Click GENERATE CERTIFICATE to generate a self-signed certificate. This option becomes available only after a private key has been generated..

   • You can copy the generated certificate details.

   • You can also RE-GENERATE THE CERTIFICATE, if required.

3. After generating and downloading the certificate,

   1. Log in to your Fortanix DSM account in the same region selected in Step 2 ofSection 4.3: Set Up DSM (SaaS) Connection above to ensure proper correlation.

   2. Create an administrative (admin) app using the steps mentioned in Authentication, selecting Certificate as the authentication method, and uploading the certificate generated in Step 2.

   3. After creating the admin app, copy the UUID value.

4. Admin app UUID: Enter the value obtained from Fortanix DSM (SaaS) admin app.

   NOTE

   It is recommended to use a unique Fortanix DSM admin app UUID for each Fortanix DSM (SaaS) connection in Fortanix Key Insight to prevent performance degradation and reduce unnecessary clutter.

5. Click CONNECT to establish the connection between Fortanix DSM (SaaS) and Fortanix Key Insight. If your credentials (region and certificate) are incorrect, an error message appears. Ensure you use the correct credentials to establish the connection with Fortanix DSM (SaaS).

1. On the Select Connection Type step, select Automated Scan as the scan type.

2. Under Select connection type, select External Key Source Connections. Then, under Select external key source type, select Fortanix DSM (On-Premises).

3. Click NEXT.

NOTE

You can also add a Fortanix DSM (On-premises) connection by clicking ADD EXTERNAL KEY SOURCE in the top-right corner of the EXTERNAL KEY SOURCE tab on the Connections page.

5.3 Set Up Fortanix DSM (On-premises) Connection

Perform the following steps to add a Fortanix DSM (On-premises) connection on the Set Up DSM (On-Premises) Connection step:

1. Connection name: Enter a name for your Fortanix DSM (On-premises) connection.

2. This will create a DSM Connection. The connection can be deleted later from the connections screen: Select the check box to confirm that a Fortanix DSM SaaS connection will be created. The connection appears on the EXTERNAL KEY SOURCE tab on the Connections page, but it will not yet be integrated with Fortanix DSM.

3. Click Fortanix on-premises scanner package to download the Fortanix On-premises Scanner for Fortanix DSM on-premises connection.

   1. After downloading the package, install it depending on your operating system (Linux or Windows).

      • For instructions on how to install the Fortanix On-Premises Scanner package on Linux, refer to On-premises Scanner Configuration - Linux.

      • For instructions on how to install the Fortanix On-Premises Scanner package on Windows, refer to On-premises Scanner Configuration - Windows.

   2. After installing the package, configure the Fortanix DSM on-premises connection using the configuration file.

      For information on Fortanix DSM On-premises connection configuration file parameters, refer to On-premises Scanner Configuration File.

   3. After configuration, execute the Fortanix On-premises Scanner package depending on your operating system (Linux or Windows).

      • For instructions on how to execute the Fortanix On-Premises Scanner package on Linux, refer to On-premises Scanner Configuration - Linux.

      • For instructions on how to install the Fortanix On-Premises Scanner package on Windows, refer to On-premises Scanner Configuration - Windows.

4. After installing and configuring the package, select the I have downloaded and installed the Scanner package check box.

5. Click ADD DSM & GENERATE API KEY to add the scanner using the generated API key.

6. In the API Key Details dialog box, click COPY API KEY to copy the API key value. This value is used to authenticate both the Fortanix On-premises Scanner and Fortanix Key Insight.

7. Close the dialog box to complete the onboarding.

NOTE

After onboarding the Fortanix DSM (On-premises) connection:

• You can verify the connection status on the EXTERNAL KEY SOURCE tab.

  • If the status is Connected, you can access the Overview and Keys UI. You can alsoswitch the regionusing the region switcher drop down located on the top navigation bar. When the region is changed, the UI updates automatically to show the data, connections, and scan results for that region.

    For more information on the UI, refer to External Key Source Connection - User Interface Components.

  • If the status is Disconnected, restart the scanner to re-establish the connection.

  • If the status is Pending, use the generated API key to connect to Fortanix Key Insight. After the connection is established, add the resources to begin scanning.

• Users with theAccount AdministratorandGroup Administratorroles can manage (edit, delete, rescan, and view details) the connection from the Configuration → Connections → EXTERNAL KEY SOURCE.

  • If you edit the Fortanix DSM (On-premises) connection, rescan both the Fortanix DSM (On-premises) connection and its associated parent connection (if any) to apply the changes.

  • Deleting the Fortanix DSM (On-premises) connection cannot be undone.

  • The Rescan option is available only when the Fortanix DSM (On-premises) connection status is Connected.

    • After rescanning the Fortanix DSM (On-premises) connection, manually rescan the linked Fortanix Key Insight cloud or on-premises connection (if any) to update the correlated key data.

  • When viewing the connection details:

    • Copy the Connection ID. This value is required in the Fortanix On-premises Scanner configuration.

    • Click MANAGE API KEY to manage (copy, delete, regenerate) the API key geneated.

      • You can generate a maximum of two API keys for configuring the connection between Fortanix DSM (On-premises) and Fortanix Key Insight.

      • Deleting an API key may revoke access for the Fortanix DSM (On-premises) connection, potentially disrupting its functionality. This action is irreversible.

    • Click DOWNLOAD PACKAGE to download the package again in case you changed your machine, your current package has errors or was not installed correctly.

    

• A group with the same name will be created on the Fortanix IAM Groups page. For more information on Groups, refer to Fortanix Armor Identity and Access Management (IAM).