Embedded Files
About
About
Asset ownership refers to the individual or business unit responsible for an asset's management, security, and lifecycle decisions.
Problem statement - Broken ownership = no control, no accountability, higher risk, and higher cost. It makes cloud environments messy, insecure, and expensive.
Terminology
Terminology
Asset - Insight Object a copy of Cloud Provider Objects metadata of so-called Cloud Resources, Cloud Resource Containers, Billing items like tenants/organizations/subscriptions/projects/accounts, configuration items and others. Asset can be a Virtual Machine, Public IP address assigned to VM or even a configuration entry for VM like Firewall rule, Recommendation discovery item and others.
Asset Parent - All assets have a parent. AWS Account is parent for all AWS assets that are deployed under that Account, same with Google Project. Azure assets must have 'Resource Group' type as parent and 'Resource Groups' have parents which are Subscriptions.
Azure: Cloud Tenant - Subscription - Resource Group - Resource
AWS: Cloud Organization - Account - Resource
Google: Cloud Organization - Project - Resource
Asset Groups (AG) - allocated assets are logically grouped and visible for delegated Users.
Delegation - User assignment to Asset Group.
Allocation - Asset assignment to Asset Group.
Main features and use cases
Main features and use cases
Ownership management
Ownership management
Use case: Setup Asset Ownership
Allocate assets to asset owners using middle point: Asset Group.
Accountability
Accountability
Use case: Contact Owner
Provide resource ownership information for operations, internal automations and systems.
Security
Security
Use case: Control Access
Enable (or restrict) Users to access/view owned resources and respective recommendations.
Economics
Economics
Use case: Cost Allocation
Cost View per Asset Group, for asset owners and managers to understand business cost.
Quick Start
Quick Start
General Recommendations
General Recommendations
Use automatic AG creation.
Use tag allocation, fix issues in cloud if possible.
Asset Group creation and Asset Allocation.
Asset Group creation and Asset Allocation.
Ownership Menu will be found under Administration. Ownership Configuration is available for role ' Company - Ownership Manager'. Here are main use cases of Ownership:
Automatic Setup (Recommended)
Automatic Group creation - Setup tag-key for company and enable automatic AG creation. This will enable Asset Group allocation to Assets using tag-key:value pairs, which will automatically assign Assets to Asset Groups. Rename Asset Group as desired. Initial name would be equal to tag value.
Semi/Manual Setup (Alternative)
Create groups manually - Allocate assets automatically by adding tag-key:values pair.
Manual errors fixing:
Allocate assets directly to Asset Group. This can be done on any scenario. Direct allocation brakes inheritance and overrides tag allocation.
Inheritance (Hidden/backend)
Automatic rules will execute asset allocation to AG as per parent allocation, if asset do not have other allocations.
User Delegation to Asset Group
User Delegation to Asset Group
After creating 'Asset Group's you will have enabled views and filters per 'Asset Group's.
If you want to provide access to Asset owners to see their Assets:
Delegate User to Asset Group
Ensure that User have at least 'Company User' and relevant 'X Service User' roles.
Note: Users with Managers and Analyst roles have read only visibility of all Asset Groups.
Feature Description
Feature Description
How Assets are allocated
How Assets are allocated
Possible Asset allocation to Asset Group types (starting from highest priority):
Direct - modify allocation manually.
Tag - allocate automatically using tag:value pairs mapped to Asset Group (if does not have direct allocation).
Inheritance - if Asset parent allocated to Asset Group, Asset will inherit Asset Group (if does not have tag or direct allocations).
Unassigned - default Asset Group created for all Assets per company.
Use Cases
Use Cases
Scenario 1 - Most common setup when AG is assigned tag value and rest is left for backend rules. In this case tag allocation leverages deployment and tag strategy.
Scenario 2 - Used when you want to separate some resources from on group to another, like when you have multiple applications under one Subscription, Account or Project. In this case Direct allocation fixes cloud deployment and tag strategy.
Scenario 3 - This scenario possible only with Azure and should be avoided. But, if you replace subscription tag allocation with direct allocation, there could be use cases for such allocations. Example: If Subscription level managed by finance, RG level is managed by chief of products and other Asset Groups are delegated to lower managers group like products owners.
Scenario 4 - Similarly, like in scenario 3, this separates asset's and asset's parent delegation.
Report abuse