Akeyless Scanner
The Akeyless Scanner is a native scanner type that inspects your Akeyless account, discovering the full inventory of identities, AI agents, roles, secrets and certificates, as well as the relationships between them. Each discovered object is evaluated against Identity & Secrets Intelligence security policies, which assess its risk posture and surface the resulting findings for review.
What the Akeyless Scanner Discovers
Each scanner covers one or more object types, selected when the scanner is created:
| Object Type | What is discovered |
|---|---|
| Secrets | Static and rotated secrets, with their tags, dates, and rotation details, plus Targets |
| Certificates | Certificates stored in Akeyless, with their status, algorithms, and validity dates |
| Identities | Auth methods, Access Roles, and role assignments, showing which identities can access which secrets and certificates, including identities set up for AI agents that haven't been used yet |
| AI Agents | AI agents that use Secretless AI or Agentic Runtime Authority, with the identity they run as, the secrets they used, and the secrets they can access |
Prerequisite
- An Akeyless account with the Identity & Secrets Intelligence license.
- A deployed and connected Akeyless Gateway version
4.52.0and later. - A Gateway with Akeyless AI Insights configured.
- A user with
Manage ISI ScannersorAdminGateway Permission. - A user with
Identity & Secrets IntelligenceAdministrative Rule set to Scoped or All.
Required Akeyless Permissions
The Akeyless Scanner does not use a Target. Grant the List capability on the Access Role associated with the Gateway's Admin Access ID. The scanner only lists objects, and never reads secret values.
| Object Type | Access Role rules | Capability |
|---|---|---|
| Secrets | Items, Targets | List |
| Certificates | Items | List |
| Identities | Auth Methods, Access Roles | List |
| AI Agents | Access Roles | List |
To scan the whole account, set the path of each rule to /*.
To scan AI agents, also set the Agentic Runtime Authority Administrative Rule to All on the same Access Role. When set to Scoped, only the AI agents within its scope are discovered.
WarningObjects the Admin Access ID can't list are skipped without a warning. If an object is missing from Findings, check the rules of the Access Role associated with the Gateway's Admin Access ID.
Create an Akeyless Scanner in the Akeyless Console
- Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
- Click New, and select the scanner type Akeyless then click Next.
- Define a Name for the scanner.
- Define a Gateway that will execute the scans and click Next.
- Use the Object Type drop-down list to select the scanner's scope, and click Finish.
Scan Akeyless
- Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
- Click the Akeyless scanner
- Click start scan
Once the scan completes, results appear in Inventory for review.
Updated 12 days ago