Agentless Discovery

Discover cloud and on-premises infrastructure without deploying agents.

Overview

Agentless Discovery provides comprehensive visibility into your infrastructure using native cloud APIs and standard protocols. No agents to install, manage, or update—just configure credentials and start discovering.

Supported Providers

Amazon Web Services (AWS)

Discover EC2 instances, VPCs, security groups, IAM, S3, RDS, Lambda, and more using IAM role assumption.

Setup:

1. Create an IAM role with read-only permissions
2. Configure a trust policy allowing Infracast to assume the role
3. Add an External ID for security
4. Enter the Role ARN in Infracast

Multi-Region: Automatically scans all enabled regions concurrently.

Microsoft Azure

Discover virtual machines, virtual networks, NSGs, storage accounts, Entra ID, and more using service principal authentication.

Setup:

1. Create a Service Principal in Entra ID
2. Grant Reader role on target subscriptions
3. Enter Tenant ID, Client ID, and Client Secret in Infracast

Google Cloud Platform (GCP)

Discover Compute instances, VPC networks, firewall rules, IAM, Cloud Storage, and more.

Setup:

1. Create a Service Account with Viewer role
2. Configure Workload Identity Federation (recommended) or export a key file
3. Enter Project ID and credentials in Infracast

Microsoft 365

Discover Entra ID users, groups, apps, Conditional Access policies, Exchange mailboxes, SharePoint sites, and Teams.

Setup:

1. Create an App Registration in Entra ID
2. Add required Microsoft Graph API permissions
3. Grant admin consent
4. Enter Tenant ID, Client ID, and Client Secret in Infracast

Compliance: Includes 23 CIS Microsoft 365 Benchmark rules for automated security assessment.

On-Premises

Discover Linux/Unix hosts via SSH and Windows hosts via WinRM.

Resources discovered:

• Operating system and version
• Installed packages
• Running services
• Open ports
• Network interfaces
• Storage configuration

Authentication options:

• SSH: Password, key-based, or key with passphrase
• WinRM: Basic, domain, or certificate-based

Target specification:

• Single IP address
• Comma-separated IP list
• CIDR range (up to /24)

Using Agentless Discovery

Start a Scan

1. Navigate to Operations → Agentless Discovery
2. Select your provider (AWS, Azure, GCP, M365, On-Prem)
3. Follow the setup wizard to configure credentials
4. Click Test Connection to validate
5. Click Start Scan

View Results

• Discovered resources appear in the Asset Graph
• Relationships are automatically mapped
• Compliance rules run against discovered resources

Schedule Scans

Configure recurring scans to maintain up-to-date visibility:

• Daily, weekly, or custom schedules
• Automatic drift detection
• Alert on new resources or changes

Security Model

Agentless Discovery is designed with security in mind:

• Read-only access — All providers use read-only permissions
• No stored credentials — Credentials are used once to obtain session tokens
• External ID (AWS) — Prevents confused deputy attacks
• Connection testing — Validate credentials before running full scans

Agent vs Agentless

Aspect	Agentless	Agent-Based
Setup time	Minutes	Hours
Depth	API-visible resources	Deep (processes, files, connections)
Coverage	All API-discoverable	Hosts with agents installed
Runtime data	Point-in-time snapshot	Real-time monitoring
Maintenance	None	Agent updates required

Recommendation: Start with Agentless for quick visibility. Add agents to critical systems for deeper runtime insights.

On-Prem Relay

For on-premises infrastructure that isn't directly accessible from Infracast SaaS, deploy a Relay Connector:

• No VPN required — Relay connects outbound to Infracast
• No inbound firewall rules — Only port 443 outbound
• Credentials stay secure — Stored in Infracast, sent per-task over TLS

Create the relay in the app (Relays → Create) and run the install command it shows:

curl -fsSL https://get.infracast.io/install.sh | sudo bash -s -- \
  --token '<token>' --relay-id '<relay-id>' --server 'wss://api.infracast.io/ws/relay' --version '<build>'

See On-Prem Relay Connector for complete setup instructions.

API Endpoints

All scan operations are tenant-scoped.

# Start a scan
POST /api/v1/tenants/{tenantID}/agentless/scan
{
  "provider": "aws",
  "config": {
    "role_arn": "arn:aws:iam::123456789012:role/InfracastReader",
    "external_id": "unique-external-id",
    "regions": ["us-east-1", "us-west-2"]
  }
}

# Validate credentials without running a full scan
POST /api/v1/tenants/{tenantID}/agentless/test-connection
POST /api/v1/tenants/{tenantID}/agentless/test-all

# Scan lifecycle
GET    /api/v1/tenants/{tenantID}/agentless/scans
GET    /api/v1/tenants/{tenantID}/agentless/scan/{scanID}
DELETE /api/v1/tenants/{tenantID}/agentless/scan/{scanID}     # cancel a running scan
DELETE /api/v1/tenants/{tenantID}/agentless/scans/{scanID}    # delete the scan record
POST   /api/v1/tenants/{tenantID}/agentless/rescan

# Scheduled scans
POST   /api/v1/tenants/{tenantID}/agentless/schedules
GET    /api/v1/tenants/{tenantID}/agentless/schedules
DELETE /api/v1/tenants/{tenantID}/agentless/schedules/{scheduleID}

# Permission coverage for the configured credentials
GET /api/v1/tenants/{tenantID}/agentless/coverage

# Remove all data discovered from one provider
DELETE /api/v1/tenants/{tenantID}/agentless/provider/{provider}

# Rotate the AWS external id used for cross-account trust
POST /api/v1/tenants/{tenantID}/agentless/aws-external-id/rotate

Setup instructions are reference data and are not tenant-scoped. Pass the provider as a path parameter (aws, azure, gcp, m365, onprem):

GET /api/v1/agentless/setup/{provider}

Cancel and delete are different operations

DELETE .../agentless/scan/{scanID} (singular scan) cancels a running scan. DELETE .../agentless/scans/{scanID} (plural scans) deletes the scan record. The paths differ by one character and do very different things — check which one you are calling.

Troubleshooting

AWS: Access Denied

• Verify the IAM role trust policy includes the correct External ID
• Ensure the role has SecurityAudit or equivalent read permissions

Azure: Authentication Failed

• Verify the Service Principal has Reader role on the subscription
• Check that the Client Secret hasn't expired

On-Prem: Connection Timeout

• Verify network connectivity to target hosts
• Check firewall rules allow SSH (22) or WinRM (5985/5986)
• Verify credentials are correct