How do cross cloud imports work in / Forensic Acquisition and Investigation?

/ Forensic Acquisition and Investigation allows you to import data across different cloud environments, meaning that you can deploy / Forensic Acquisition and Investigation in one cloud (AWS, Azure, or Google Cloud) and import data from another. This is referred to as cross-cloud importing.

In a cross-cloud setup, / Forensic Acquisition and Investigation can seamlessly acquire data from cloud environments other than where the platform is deployed, enabling flexible and comprehensive data collection across multiple cloud providers.

Next Steps in AWS

/ Forensic Acquisition and Investigation supports multiple methods for configuring cross-account access in AWS:

• AWS Organizations Integration (Recommended)

  • Using AWS Organizations

• Manual Setup

  • Creating cross-account roles manually
  • Adding cross-account roles manually

• Automated Setup

  • Automated cross-account role creation

• API-Based Setup

  • Cross-account role creation via API

• Additional AWS Configuration

  • Adding AWS accounts
  • Adding AWS access keys
  • Using AWS STS
  • Skip role configuration

Next Steps in Azure

/ Forensic Acquisition and Investigation supports cross-tenancy investigations in Azure:

• Adding Azure tenants
• Cross-tenancy subscription access

Next Steps in GCP

/ Forensic Acquisition and Investigation enables investigations across multiple GCP projects:

• Adding GCP projects

Comparison: Cross-Account vs Individual Account Setup

Understand the differences between centralized cross-account configurations and individual account setups:

• Cross-account vs individual account deployment

Diagrams

Below are diagrams showing how cross-cloud imports work for each cloud provider:

AWS

Azure

Google Cloud