From c7f9ac5056c4308d75cb295c46ba51185121ac39 Mon Sep 17 00:00:00 2001 From: jenny hajee Date: Mon, 13 Jul 2026 20:21:37 -0500 Subject: [PATCH 01/10] added read policy creds and which policies are discovered and can be read --- .../pages/adding-agentcore-mcp-scanner.adoc | 11 +++-- .../pages/adding-amazon-bedrock-scanner.adoc | 15 ++++--- .../pages/adding-amazon-gateway-scanner.adoc | 45 ++++++++++++++++++- modules/ROOT/pages/adding-apigee-scanner.adoc | 9 +++- .../adding-azure-api-management-scanner.adoc | 10 ++++- 5 files changed, 75 insertions(+), 15 deletions(-) diff --git a/modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc b/modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc index 15cdff61..71977e13 100644 --- a/modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc +++ b/modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc @@ -3,24 +3,29 @@ ifndef::env-site,env-github[] include::_attributes.adoc[] endif::[] -Add a scanner to discover, import, and sync MCP servers from Amazon Bedrock AgentCore MCP Gateway into Exchange. Then you can govern the MCP servers and consume them in other applications. +Add a scanner to discover, import, and sync MCP servers from Amazon Bedrock AgentCore MCP Gateway into Exchange and to discover and read policies from MCP server configurations. Then you can govern the MCP servers and consume them in other applications. == Before You Begin Before adding the scanner, verify that you have these prerequisites: +For discovering and importing MCP servers: + * An active AWS account to register and host MCP servers * Amazon access key ID * Amazon secret access key * Amazon region * Exchange Administrator permission -* An IAM user with an inline policy that allows these permissions: + +Additional requirements for discovering and reading policies: + +* An IAM user with an inline policy that allows these read/runtime actions: + ** bedrock-agentcore:ListAgentRuntimes ** bedrock-agentcore:GetAgentRuntime ** bedrock-agentcore:ListAgentRuntimeVersions ** bedrock-agentcore:ListAgentRuntimeEndpoints - ** bedrock-agentcore:InvokeAgentRuntime + ** bedrock-agentcore:InvokeAgentRuntime For more information, see the https://docs.aws.amazon.com/bedrock-agentcore/[Amazon Bedrock documentation]. diff --git a/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc b/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc index f2f64b49..7a28a81c 100644 --- a/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc +++ b/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc @@ -3,25 +3,28 @@ ifndef::env-site,env-github[] include::_attributes.adoc[] endif::[] -Add a scanner to discover, import, and sync agents from Amazon Bedrock into Exchange. Then you can govern the agents and consume them in other applications. +Add a scanner to discover, import, and sync agents from Amazon Bedrock into Exchange and to discover and read policies from agent configurations. Then you can govern the agents and consume them in other applications. == Before You Begin Before adding the scanner, verify that you have these prerequisites: -* Exchange Administrator permission +For discovering and importing agents: + +* Exchange Administrator permission * Knowledge about the Amazon Web Services region where the agents are deployed. * Amazon Bedrock access key ID * Amazon Bedrock secret access key -* Ensure you have these Amazon Bedrock permissions: +* To make sure the scanner discovers the agent, assign an alias and link that alias to a version. The scanner ignores agents without an invocable URL. + +Additional requirements for discovering and reading policies: + +* Ensure you have these Amazon Bedrock read permissions: ** bedrock:ListAgents ** bedrock:GetAgent ** bedrock:ListAgentAliases ** bedrock:GetAgentAlias ** bedrock:ListAgentVersions ** bedrock:GetAgentVersion -+ - -* To make sure the scanner discovers the agent, assign an alias and link that alias to a version. The scanner ignores agents without an invocable URL. == Add a Scanner for Amazon Bedrock diff --git a/modules/ROOT/pages/adding-amazon-gateway-scanner.adoc b/modules/ROOT/pages/adding-amazon-gateway-scanner.adoc index 79d9ea5d..7bd709a3 100644 --- a/modules/ROOT/pages/adding-amazon-gateway-scanner.adoc +++ b/modules/ROOT/pages/adding-amazon-gateway-scanner.adoc @@ -3,17 +3,29 @@ ifndef::env-site,env-github[] include::_attributes.adoc[] endif::[] -Add a scanner to discover, import, and sync APIs from Amazon API Gateway into Anypoint Exchange. Once imported, you can apply governance rulesets and publish them to your developer portal. +Add a scanner to discover, import, and sync APIs from Amazon API Gateway into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal. == Before You Begin Before adding the scanner, verify that you have these prerequisites: +For discovering and importing APIs: + * Exchange Administrator permission -* IAM policy with read-only permissions for Amazon API Gateway * Knowledge about the Amazon Web Services region where the services are deployed * AWS access key ID * AWS secret access key +Additional requirements for discovering and reading policies: + +* IAM policy with read permissions for Amazon API Gateway: +** `apigateway:GET` +** `apigateway:GET*` actions on REST and HTTP API resources +* Resource scope: +** `arn:aws:apigateway:{region}::/restapis/*` +** `arn:aws:apigateway:{region}::/apis/*` ++ +For web application firewall (WAF) policies, the scanner also uses `software.amazon.awssdk:wafv2` and `software.amazon.awssdk:route53`. + Example custom IAM policy for read-only access: [source,json,linenums] @@ -30,6 +42,35 @@ Example custom IAM policy for read-only access: } ---- +== Policy Coverage for Amazon API Gateway + +The scanner reads and extracts these policy areas from AWS API Gateway configurations: + +[cols="1,3",options="header"] +|=== +|Policy area |What the scanner reads +|Authentication and authorization |IAM signature enforcement (`aws-iam`), Cognito/custom authorizers (`cognito-authorizer`), and API key requirements (`api-key-required`). +|Rate limiting and quotas |Usage plan throttles and quotas, stage and method throttles, and account-level default throttle settings. +|Network and access control |Resource policies (including IP-filter conditions), mutual TLS settings, and CORS-related request filtering. +|Application firewall and threat protection |WAF Web ACLs, WAF IP filtering rules, WAF size restrictions, and WAF bot control rules. +|Traffic, resilience, and optimization |Canary settings, Route53 health-check associations, and API cache settings. +|Request and response processing |Integration timeout settings, header mappings, VTL mapping templates, request validators, and integration type patterns (including Step Functions and mock integrations). +|Observability |Access logging, X-Ray tracing, and CloudWatch metrics. +|=== + +Policies that aren't represented in this supported coverage list aren't currently scanned by this AWS API Gateway scanner. + +The scanner doesn't currently read these policy areas: + +[cols="1,3",options="header"] +|=== +|Policy area not scanned |Reason +|JWT check (`jwt-check`) |JWT authorizers are tied to HTTP API v2 patterns and aren't covered by this scanner's current API model. +|Attribute-based access control (`attribute-based-access-control`) |There isn't a reliable API-to-policy linkage signal in the current scanner flow. +|Tokenization (`tokenization`) |This is typically enforced in downstream services (for example, Lambda/KMS usage), not directly in API Gateway configuration. +|PII protection (`pii-protection`) |This is typically implemented in downstream processing services, not as direct API Gateway policy configuration. +|=== + == Add a Scanner for Amazon API Gateway . Verify that you are in the business group where you want to add the scanner. . From the sidebar in Exchange, click *Scanners*. diff --git a/modules/ROOT/pages/adding-apigee-scanner.adoc b/modules/ROOT/pages/adding-apigee-scanner.adoc index 9f0cf523..ef1e38b8 100644 --- a/modules/ROOT/pages/adding-apigee-scanner.adoc +++ b/modules/ROOT/pages/adding-apigee-scanner.adoc @@ -3,17 +3,22 @@ ifndef::env-site,env-github[] include::_attributes.adoc[] endif::[] -Add a scanner to discover, import, and sync APIs from Google Apigee into Anypoint Exchange. Once imported, you can apply governance rulesets and publish them to your developer portal. +Add a scanner to discover, import, and sync APIs from Google Apigee into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal. == Before You Begin Before adding the scanner, verify that you have these prerequisites: +For discovering and importing APIs: + * Exchange Administrator permission -* Apigee Read-only Admin permission * Google Cloud Platform (GCP) project ID * Service account email * Private key +Additional requirements for discovering and reading policies: + +* Viewer role, or a specific Apigee permission role, assigned to the service account + == Add a Scanner for Google Apigee . Verify that you are in the business group where you want to add the scanner. . From the sidebar in Exchange, click *Scanners*. diff --git a/modules/ROOT/pages/adding-azure-api-management-scanner.adoc b/modules/ROOT/pages/adding-azure-api-management-scanner.adoc index 02858bd8..4b56a6e6 100644 --- a/modules/ROOT/pages/adding-azure-api-management-scanner.adoc +++ b/modules/ROOT/pages/adding-azure-api-management-scanner.adoc @@ -3,13 +3,14 @@ ifndef::env-site,env-github[] include::_attributes.adoc[] endif::[] -Add a scanner to discover, import, and sync APIs from Azure API Management into Anypoint Exchange. Once imported, you can apply governance rulesets and publish them to your developer portal. +Add a scanner to discover, import, and sync APIs from Azure API Management into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal. == Before You Begin Before adding the scanner, verify that you have these prerequisites: +For discovering and importing APIs: + * Exchange Administrator permission -* API Management Service Reader Role permission * Tenant ID * Client ID * Client Secret @@ -17,6 +18,11 @@ Before adding the scanner, verify that you have these prerequisites: * Resource Group * Service Name +Additional requirements for discovering and reading policies: + +* API Management Service Reader role permission, scoped to the API Management resource or resource group +* OAuth scope: `https://management.azure.com/.default` + == Add a Scanner for Azure API Management . Verify that you are in the business group where you want to add the scanner. . From the sidebar in Exchange, click *Scanners*. From c019b1c1bb91fb63949527cba90d282113cd379d Mon Sep 17 00:00:00 2001 From: jenny hajee Date: Mon, 13 Jul 2026 20:38:14 -0500 Subject: [PATCH 02/10] edits --- modules/ROOT/pages/adding-amazon-gateway-scanner.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/ROOT/pages/adding-amazon-gateway-scanner.adoc b/modules/ROOT/pages/adding-amazon-gateway-scanner.adoc index 7bd709a3..756ba111 100644 --- a/modules/ROOT/pages/adding-amazon-gateway-scanner.adoc +++ b/modules/ROOT/pages/adding-amazon-gateway-scanner.adoc @@ -58,7 +58,7 @@ The scanner reads and extracts these policy areas from AWS API Gateway configura |Observability |Access logging, X-Ray tracing, and CloudWatch metrics. |=== -Policies that aren't represented in this supported coverage list aren't currently scanned by this AWS API Gateway scanner. +Policies that aren't represented in this supported coverage list aren't currently scanned by this Amazon API Gateway scanner. The scanner doesn't currently read these policy areas: From 8a486cbf689a01a550949a9f75b36f178746c7d8 Mon Sep 17 00:00:00 2001 From: jenny hajee Date: Wed, 22 Jul 2026 15:51:30 -0500 Subject: [PATCH 03/10] added agentforce agent scanner --- modules/ROOT/nav.adoc | 1 + modules/ROOT/pages/agentforce-scanners.adoc | 23 +++++++++++++++++++++ 2 files changed, 24 insertions(+) create mode 100644 modules/ROOT/pages/agentforce-scanners.adoc diff --git a/modules/ROOT/nav.adoc b/modules/ROOT/nav.adoc index b8b30f4b..c5d9b51e 100644 --- a/modules/ROOT/nav.adoc +++ b/modules/ROOT/nav.adoc @@ -86,6 +86,7 @@ *** xref:kong-scanners.adoc[] *** xref:langchain-scanners.adoc[] *** xref:microsoft-scanners.adoc[] +*** xref:agentforce-scanners.adoc[] *** xref:salesforce-scanners.adoc[] *** xref:snowflake-scanners.adoc[] *** xref:managing-scanners.adoc[] diff --git a/modules/ROOT/pages/agentforce-scanners.adoc b/modules/ROOT/pages/agentforce-scanners.adoc new file mode 100644 index 00000000..f9b6e22d --- /dev/null +++ b/modules/ROOT/pages/agentforce-scanners.adoc @@ -0,0 +1,23 @@ += Salesforce Agentforce Scanners +ifndef::env-site,env-github[] +include::_attributes.adoc[] +endif::[] + +When your agents are hosted on Salesforce Agentforce, use this page to jump to the Exchange scanner setup. Step-by-step instructions are in the linked page. + +== Agent Scanners + +* xref:adding-agentforce-scanner.adoc[Add a scanner for Salesforce Agentforce agents] + +== Before You Begin Adding a Scanner + +Make sure you have the permission and access: + +* Exchange Administrator permission +* Verify that you are in the business group where you want to add the scanner. + +== See Also + +* xref:discovering-and-importing-external-agents.adoc[] +* xref:agent-scanners.adoc[] +* xref:managing-scanners.adoc[] From c2d05790389761fb1cb21476d5bc35bfe4157736 Mon Sep 17 00:00:00 2001 From: jenny hajee Date: Wed, 22 Jul 2026 16:15:56 -0500 Subject: [PATCH 04/10] removed policy read info from Amazon Bedrock and AgentCore runtime. The the read/write policy initiative only includes Kong, Apigee, Azure API Management and AWS API Gateway --- modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc | 5 +---- modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc | 6 ++---- 2 files changed, 3 insertions(+), 8 deletions(-) diff --git a/modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc b/modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc index 71977e13..09f8537d 100644 --- a/modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc +++ b/modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc @@ -3,7 +3,7 @@ ifndef::env-site,env-github[] include::_attributes.adoc[] endif::[] -Add a scanner to discover, import, and sync MCP servers from Amazon Bedrock AgentCore MCP Gateway into Exchange and to discover and read policies from MCP server configurations. Then you can govern the MCP servers and consume them in other applications. +Add a scanner to discover, import, and sync MCP servers from Amazon Bedrock AgentCore MCP Gateway into Exchange. Then you can govern the MCP servers and consume them in other applications. == Before You Begin @@ -16,9 +16,6 @@ For discovering and importing MCP servers: * Amazon secret access key * Amazon region * Exchange Administrator permission - -Additional requirements for discovering and reading policies: - * An IAM user with an inline policy that allows these read/runtime actions: + ** bedrock-agentcore:ListAgentRuntimes diff --git a/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc b/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc index 7a28a81c..21b78870 100644 --- a/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc +++ b/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc @@ -3,7 +3,7 @@ ifndef::env-site,env-github[] include::_attributes.adoc[] endif::[] -Add a scanner to discover, import, and sync agents from Amazon Bedrock into Exchange and to discover and read policies from agent configurations. Then you can govern the agents and consume them in other applications. +Add a scanner to discover, import, and sync agents from Amazon Bedrock into Exchange. Then you can govern the agents and consume them in other applications. == Before You Begin Before adding the scanner, verify that you have these prerequisites: @@ -15,9 +15,6 @@ For discovering and importing agents: * Amazon Bedrock access key ID * Amazon Bedrock secret access key * To make sure the scanner discovers the agent, assign an alias and link that alias to a version. The scanner ignores agents without an invocable URL. - -Additional requirements for discovering and reading policies: - * Ensure you have these Amazon Bedrock read permissions: ** bedrock:ListAgents ** bedrock:GetAgent @@ -25,6 +22,7 @@ Additional requirements for discovering and reading policies: ** bedrock:GetAgentAlias ** bedrock:ListAgentVersions ** bedrock:GetAgentVersion +* To make sure the scanner discovers the agent, assign an alias and link that alias to a version. The scanner ignores agents without an invocable URL. == Add a Scanner for Amazon Bedrock From 66cc73f8c3c240c63c754703cd2040a8b2da1acb Mon Sep 17 00:00:00 2001 From: jenny hajee Date: Wed, 22 Jul 2026 16:23:00 -0500 Subject: [PATCH 05/10] edits --- modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc | 6 +++--- modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc b/modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc index 09f8537d..4fb3c30b 100644 --- a/modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc +++ b/modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc @@ -1,4 +1,4 @@ -= Adding a Scanner for Amazon Bedrock AgentCore MCP += Adding a Scanner for Amazon Bedrock AgentCore MCP ifndef::env-site,env-github[] include::_attributes.adoc[] endif::[] @@ -16,14 +16,14 @@ For discovering and importing MCP servers: * Amazon secret access key * Amazon region * Exchange Administrator permission -* An IAM user with an inline policy that allows these read/runtime actions: +* An IAM user with an inline policy that allows these permissions: + ** bedrock-agentcore:ListAgentRuntimes ** bedrock-agentcore:GetAgentRuntime ** bedrock-agentcore:ListAgentRuntimeVersions ** bedrock-agentcore:ListAgentRuntimeEndpoints ** bedrock-agentcore:InvokeAgentRuntime - + For more information, see the https://docs.aws.amazon.com/bedrock-agentcore/[Amazon Bedrock documentation]. == Add a Scanner for Amazon AgentCore diff --git a/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc b/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc index 21b78870..90095898 100644 --- a/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc +++ b/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc @@ -15,7 +15,7 @@ For discovering and importing agents: * Amazon Bedrock access key ID * Amazon Bedrock secret access key * To make sure the scanner discovers the agent, assign an alias and link that alias to a version. The scanner ignores agents without an invocable URL. -* Ensure you have these Amazon Bedrock read permissions: +* Ensure you have these Amazon Bedrock permissions: ** bedrock:ListAgents ** bedrock:GetAgent ** bedrock:ListAgentAliases @@ -24,7 +24,7 @@ For discovering and importing agents: ** bedrock:GetAgentVersion * To make sure the scanner discovers the agent, assign an alias and link that alias to a version. The scanner ignores agents without an invocable URL. -== Add a Scanner for Amazon Bedrock +== Add a Scanner for Amazon Bedrock . Verify that you are in the business group where you want to add the scanner. . From the sidebar in Exchange, click *Scanners*. @@ -35,7 +35,7 @@ For discovering and importing agents: |=== |*Field/Option* |*Value* |*Run Schedule* |Select a frequency and time. -|*Sync Review* |Select Auto-resolve. +|*Sync Review* |Select an option: *Auto-resolve* or *Ask to review*. |=== . From *Connection Configuration*, complete these fields: From aed789f214cf628414db34e27b8410ea1f56c9ad Mon Sep 17 00:00:00 2001 From: jenny hajee Date: Wed, 22 Jul 2026 16:25:10 -0500 Subject: [PATCH 06/10] edits --- modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc | 3 --- 1 file changed, 3 deletions(-) diff --git a/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc b/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc index 90095898..e7c4d948 100644 --- a/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc +++ b/modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc @@ -8,13 +8,10 @@ Add a scanner to discover, import, and sync agents from Amazon Bedrock into Exch == Before You Begin Before adding the scanner, verify that you have these prerequisites: -For discovering and importing agents: - * Exchange Administrator permission * Knowledge about the Amazon Web Services region where the agents are deployed. * Amazon Bedrock access key ID * Amazon Bedrock secret access key -* To make sure the scanner discovers the agent, assign an alias and link that alias to a version. The scanner ignores agents without an invocable URL. * Ensure you have these Amazon Bedrock permissions: ** bedrock:ListAgents ** bedrock:GetAgent From 763400b4abcdb32bbcc0aba25a3e4b15ffa5e38c Mon Sep 17 00:00:00 2001 From: jenny hajee Date: Wed, 22 Jul 2026 16:35:32 -0500 Subject: [PATCH 07/10] edits --- modules/ROOT/pages/adding-apigee-scanner.adoc | 1 + modules/ROOT/pages/adding-kong-gateway-scanner.adoc | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/ROOT/pages/adding-apigee-scanner.adoc b/modules/ROOT/pages/adding-apigee-scanner.adoc index ef1e38b8..58f311a8 100644 --- a/modules/ROOT/pages/adding-apigee-scanner.adoc +++ b/modules/ROOT/pages/adding-apigee-scanner.adoc @@ -11,6 +11,7 @@ Before adding the scanner, verify that you have these prerequisites: For discovering and importing APIs: * Exchange Administrator permission +* Apigee Read-only Admin permission * Google Cloud Platform (GCP) project ID * Service account email * Private key diff --git a/modules/ROOT/pages/adding-kong-gateway-scanner.adoc b/modules/ROOT/pages/adding-kong-gateway-scanner.adoc index b690cea2..8b26586f 100644 --- a/modules/ROOT/pages/adding-kong-gateway-scanner.adoc +++ b/modules/ROOT/pages/adding-kong-gateway-scanner.adoc @@ -3,7 +3,7 @@ ifndef::env-site,env-github[] include::_attributes.adoc[] endif::[] -Add a scanner to discover, import, and sync APIs from Kong Gateway into Anypoint Exchange. Once imported, you can apply governance rulesets and publish them to your developer portal. +Add a scanner to discover, import, and sync APIs from Kong Gateway into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal. == Before You Begin Before adding the scanner, verify that you have these prerequisites: From e9197726f124fec859e40437e3c45f8b11aa258f Mon Sep 17 00:00:00 2001 From: jenny hajee Date: Wed, 22 Jul 2026 17:35:28 -0500 Subject: [PATCH 08/10] updated Kong scanner with required read scope and that policies appear in V2 --- modules/ROOT/pages/adding-apigee-scanner.adoc | 1 + modules/ROOT/pages/adding-kong-gateway-scanner.adoc | 8 +++++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/modules/ROOT/pages/adding-apigee-scanner.adoc b/modules/ROOT/pages/adding-apigee-scanner.adoc index 58f311a8..bebbccbd 100644 --- a/modules/ROOT/pages/adding-apigee-scanner.adoc +++ b/modules/ROOT/pages/adding-apigee-scanner.adoc @@ -5,6 +5,7 @@ endif::[] Add a scanner to discover, import, and sync APIs from Google Apigee into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal. + == Before You Begin Before adding the scanner, verify that you have these prerequisites: diff --git a/modules/ROOT/pages/adding-kong-gateway-scanner.adoc b/modules/ROOT/pages/adding-kong-gateway-scanner.adoc index 8b26586f..3dd1858a 100644 --- a/modules/ROOT/pages/adding-kong-gateway-scanner.adoc +++ b/modules/ROOT/pages/adding-kong-gateway-scanner.adoc @@ -5,15 +5,21 @@ endif::[] Add a scanner to discover, import, and sync APIs from Kong Gateway into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal. +In Kong, policies are called plugins. The scanner discovers plugins attached to Kong Gateway services and routes, and the enhanced MuleSoft experience shows those discovered plugins as policies. Plugins applied directly at the service instance level are not currently scanned. + + == Before You Begin Before adding the scanner, verify that you have these prerequisites: * Exchange Administrator permission * Kong Control Plane Viewer permission - * Kong Gateway region * Personal access token (PAT) +Credential scope required for discovering and reading policies: + +* Kong Admin API read + == Add a Scanner for Kong Gateway . Verify that you are in the business group where you want to add the scanner. . From the sidebar in Exchange, click *Scanners*. From 0e050e1770d0d5e6479a84258e35bc489d3b7647 Mon Sep 17 00:00:00 2001 From: jenny hajee Date: Wed, 22 Jul 2026 17:52:51 -0500 Subject: [PATCH 09/10] edits --- modules/ROOT/pages/adding-amazon-gateway-scanner.adoc | 2 ++ modules/ROOT/pages/adding-apigee-scanner.adoc | 2 ++ modules/ROOT/pages/adding-azure-api-management-scanner.adoc | 2 ++ 3 files changed, 6 insertions(+) diff --git a/modules/ROOT/pages/adding-amazon-gateway-scanner.adoc b/modules/ROOT/pages/adding-amazon-gateway-scanner.adoc index 756ba111..6357476b 100644 --- a/modules/ROOT/pages/adding-amazon-gateway-scanner.adoc +++ b/modules/ROOT/pages/adding-amazon-gateway-scanner.adoc @@ -5,6 +5,8 @@ endif::[] Add a scanner to discover, import, and sync APIs from Amazon API Gateway into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal. +The scanner discovers policies attached to supported Amazon API Gateway API, stage, route, and integration configurations and shows discovered policies in the enhanced MuleSoft experience as policies applied per imported API. Policies outside the supported scanner coverage aren't currently scanned. + == Before You Begin Before adding the scanner, verify that you have these prerequisites: diff --git a/modules/ROOT/pages/adding-apigee-scanner.adoc b/modules/ROOT/pages/adding-apigee-scanner.adoc index bebbccbd..62acc3ee 100644 --- a/modules/ROOT/pages/adding-apigee-scanner.adoc +++ b/modules/ROOT/pages/adding-apigee-scanner.adoc @@ -5,6 +5,8 @@ endif::[] Add a scanner to discover, import, and sync APIs from Google Apigee into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal. +The scanner discovers policies attached to supported Apigee API proxy configurations and shows discovered policies in the enhanced MuleSoft experience as policies applied per imported API. + == Before You Begin Before adding the scanner, verify that you have these prerequisites: diff --git a/modules/ROOT/pages/adding-azure-api-management-scanner.adoc b/modules/ROOT/pages/adding-azure-api-management-scanner.adoc index 4b56a6e6..73a58749 100644 --- a/modules/ROOT/pages/adding-azure-api-management-scanner.adoc +++ b/modules/ROOT/pages/adding-azure-api-management-scanner.adoc @@ -5,6 +5,8 @@ endif::[] Add a scanner to discover, import, and sync APIs from Azure API Management into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal. +The scanner discovers policies attached to supported Azure API Management API and operation configurations and shows discovered policies in the enhanced MuleSoft experience as policies applied per imported API. + == Before You Begin Before adding the scanner, verify that you have these prerequisites: From 7a69259af4e660ae6149bcc0c90b8e5e7e79b151 Mon Sep 17 00:00:00 2001 From: jenny hajee Date: Thu, 23 Jul 2026 09:58:31 -0500 Subject: [PATCH 10/10] trailing spaces and typos --- modules/ROOT/pages/adding-apigee-scanner.adoc | 2 +- modules/ROOT/pages/adding-azure-api-management-scanner.adoc | 2 +- modules/ROOT/pages/adding-kong-gateway-scanner.adoc | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/ROOT/pages/adding-apigee-scanner.adoc b/modules/ROOT/pages/adding-apigee-scanner.adoc index 62acc3ee..1450ee59 100644 --- a/modules/ROOT/pages/adding-apigee-scanner.adoc +++ b/modules/ROOT/pages/adding-apigee-scanner.adoc @@ -5,7 +5,7 @@ endif::[] Add a scanner to discover, import, and sync APIs from Google Apigee into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal. -The scanner discovers policies attached to supported Apigee API proxy configurations and shows discovered policies in the enhanced MuleSoft experience as policies applied per imported API. +The scanner discovers policies attached to supported Apigee API proxy configurations and shows discovered policies in the enhanced MuleSoft experience as policies applied per imported API. == Before You Begin diff --git a/modules/ROOT/pages/adding-azure-api-management-scanner.adoc b/modules/ROOT/pages/adding-azure-api-management-scanner.adoc index 73a58749..ac93b090 100644 --- a/modules/ROOT/pages/adding-azure-api-management-scanner.adoc +++ b/modules/ROOT/pages/adding-azure-api-management-scanner.adoc @@ -5,7 +5,7 @@ endif::[] Add a scanner to discover, import, and sync APIs from Azure API Management into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal. -The scanner discovers policies attached to supported Azure API Management API and operation configurations and shows discovered policies in the enhanced MuleSoft experience as policies applied per imported API. +The scanner discovers policies attached to supported Azure API Management API and operation configurations and shows discovered policies in the enhanced MuleSoft experience as policies applied per imported API. == Before You Begin Before adding the scanner, verify that you have these prerequisites: diff --git a/modules/ROOT/pages/adding-kong-gateway-scanner.adoc b/modules/ROOT/pages/adding-kong-gateway-scanner.adoc index 3dd1858a..5ff9e920 100644 --- a/modules/ROOT/pages/adding-kong-gateway-scanner.adoc +++ b/modules/ROOT/pages/adding-kong-gateway-scanner.adoc @@ -11,8 +11,8 @@ In Kong, policies are called plugins. The scanner discovers plugins attached to == Before You Begin Before adding the scanner, verify that you have these prerequisites: -* Exchange Administrator permission -* Kong Control Plane Viewer permission +* Exchange Administrator permission +* Kong Control Plane Viewer permission * Kong Gateway region * Personal access token (PAT) @@ -30,7 +30,7 @@ Credential scope required for discovering and reading policies: |=== |*Field/Option* |*Value* |*Run Schedule* |Select a frequency and local time. -|*Sync Review* |Select an option: Auto-resolve or Ask to review. +|*Sync Review* |Select an option: *Auto-resolve* or *Ask to review*. |=== . From *Connection Configuration*, complete these fields: