W-23433246 scanners read policy ga jh

modules/ROOT/nav.adoc

@@ -86,6 +86,7 @@
 *** xref:kong-scanners.adoc[]
 *** xref:langchain-scanners.adoc[]
 *** xref:microsoft-scanners.adoc[]
+*** xref:agentforce-scanners.adoc[]
 *** xref:salesforce-scanners.adoc[]
 *** xref:snowflake-scanners.adoc[]
 *** xref:managing-scanners.adoc[]

modules/ROOT/pages/adding-agentcore-mcp-scanner.adoc

@@ -1,4 +1,4 @@
-= Adding a Scanner for Amazon Bedrock AgentCore MCP 
+= Adding a Scanner for Amazon Bedrock AgentCore MCP
 ifndef::env-site,env-github[]
 include::_attributes.adoc[]
 endif::[]
@@ -9,6 +9,8 @@ Add a scanner to discover, import, and sync MCP servers from Amazon Bedrock Agen
 
 Before adding the scanner, verify that you have these prerequisites:
 
+For discovering and importing MCP servers:
+
 * An active AWS account to register and host MCP servers
 * Amazon access key ID
 * Amazon secret access key
@@ -20,8 +22,8 @@ Before adding the scanner, verify that you have these prerequisites:
  ** bedrock-agentcore:GetAgentRuntime
  ** bedrock-agentcore:ListAgentRuntimeVersions
  ** bedrock-agentcore:ListAgentRuntimeEndpoints
- ** bedrock-agentcore:InvokeAgentRuntime    
- 
+ ** bedrock-agentcore:InvokeAgentRuntime
+
 For more information, see the https://docs.aws.amazon.com/bedrock-agentcore/[Amazon Bedrock documentation].
 
 == Add a Scanner for Amazon AgentCore

modules/ROOT/pages/adding-amazon-bedrock-scanner.adoc

@@ -8,7 +8,7 @@ Add a scanner to discover, import, and sync agents from Amazon Bedrock into Exch
 == Before You Begin
 Before adding the scanner, verify that you have these prerequisites:
 
-* Exchange Administrator permission 
+* Exchange Administrator permission
 * Knowledge about the Amazon Web Services region where the agents are deployed.
 * Amazon Bedrock access key ID
 * Amazon Bedrock secret access key
@@ -19,11 +19,9 @@ Before adding the scanner, verify that you have these prerequisites:
 ** bedrock:GetAgentAlias
 ** bedrock:ListAgentVersions
 ** bedrock:GetAgentVersion
-+
-
 * To make sure the scanner discovers the agent, assign an alias and link that alias to a version. The scanner ignores agents without an invocable URL.
 
-== Add a Scanner for Amazon Bedrock 
+== Add a Scanner for Amazon Bedrock
 
 . Verify that you are in the business group where you want to add the scanner.
 . From the sidebar in Exchange, click *Scanners*.
@@ -34,7 +32,7 @@ Before adding the scanner, verify that you have these prerequisites:
 |===
 |*Field/Option* |*Value*
 |*Run Schedule* |Select a frequency and time.
-|*Sync Review* |Select Auto-resolve.
+|*Sync Review* |Select an option: *Auto-resolve* or *Ask to review*.
 |===
 
 . From *Connection Configuration*, complete these fields:

modules/ROOT/pages/adding-amazon-gateway-scanner.adoc

@@ -3,17 +3,31 @@ ifndef::env-site,env-github[]
 include::_attributes.adoc[]
 endif::[]
 
-Add a scanner to discover, import, and sync APIs from Amazon API Gateway into Anypoint Exchange. Once imported, you can apply governance rulesets and publish them to your developer portal.
+Add a scanner to discover, import, and sync APIs from Amazon API Gateway into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal.
+
+The scanner discovers policies attached to supported Amazon API Gateway API, stage, route, and integration configurations and shows discovered policies in the enhanced MuleSoft experience as policies applied per imported API. Policies outside the supported scanner coverage aren't currently scanned.
 
 == Before You Begin
 Before adding the scanner, verify that you have these prerequisites:
 
+For discovering and importing APIs:
+
 * Exchange Administrator permission
-* IAM policy with read-only permissions for Amazon API Gateway
 * Knowledge about the Amazon Web Services region where the services are deployed
 * AWS access key ID
 * AWS secret access key
 
+Additional requirements for discovering and reading policies:
+
+* IAM policy with read permissions for Amazon API Gateway:
+** `apigateway:GET`
+** `apigateway:GET*` actions on REST and HTTP API resources
+* Resource scope:
+** `arn:aws:apigateway:{region}::/restapis/*`
+** `arn:aws:apigateway:{region}::/apis/*`
++
+For web application firewall (WAF) policies, the scanner also uses `software.amazon.awssdk:wafv2` and `software.amazon.awssdk:route53`.
+
 Example custom IAM policy for read-only access:
 
 [source,json,linenums]
@@ -30,6 +44,35 @@ Example custom IAM policy for read-only access:
 }
 ----
 
+== Policy Coverage for Amazon API Gateway
+
+The scanner reads and extracts these policy areas from AWS API Gateway configurations:
+
+[cols="1,3",options="header"]
+|===
+|Policy area |What the scanner reads
+|Authentication and authorization |IAM signature enforcement (`aws-iam`), Cognito/custom authorizers (`cognito-authorizer`), and API key requirements (`api-key-required`).
+|Rate limiting and quotas |Usage plan throttles and quotas, stage and method throttles, and account-level default throttle settings.
+|Network and access control |Resource policies (including IP-filter conditions), mutual TLS settings, and CORS-related request filtering.
+|Application firewall and threat protection |WAF Web ACLs, WAF IP filtering rules, WAF size restrictions, and WAF bot control rules.
+|Traffic, resilience, and optimization |Canary settings, Route53 health-check associations, and API cache settings.
+|Request and response processing |Integration timeout settings, header mappings, VTL mapping templates, request validators, and integration type patterns (including Step Functions and mock integrations).
+|Observability |Access logging, X-Ray tracing, and CloudWatch metrics.
+|===
+
+Policies that aren't represented in this supported coverage list aren't currently scanned by this Amazon API Gateway scanner.
+
+The scanner doesn't currently read these policy areas:
+
+[cols="1,3",options="header"]
+|===
+|Policy area not scanned |Reason
+|JWT check (`jwt-check`) |JWT authorizers are tied to HTTP API v2 patterns and aren't covered by this scanner's current API model.
+|Attribute-based access control (`attribute-based-access-control`) |There isn't a reliable API-to-policy linkage signal in the current scanner flow.
+|Tokenization (`tokenization`) |This is typically enforced in downstream services (for example, Lambda/KMS usage), not directly in API Gateway configuration.
+|PII protection (`pii-protection`) |This is typically implemented in downstream processing services, not as direct API Gateway policy configuration.
+|===
+
 == Add a Scanner for Amazon API Gateway
 . Verify that you are in the business group where you want to add the scanner.
 . From the sidebar in Exchange, click *Scanners*.

modules/ROOT/pages/adding-apigee-scanner.adoc

@@ -3,17 +3,26 @@ ifndef::env-site,env-github[]
 include::_attributes.adoc[]
 endif::[]
 
-Add a scanner to discover, import, and sync APIs from Google Apigee into Anypoint Exchange. Once imported, you can apply governance rulesets and publish them to your developer portal.
+Add a scanner to discover, import, and sync APIs from Google Apigee into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal.
+
+The scanner discovers policies attached to supported Apigee API proxy configurations and shows discovered policies in the enhanced MuleSoft experience as policies applied per imported API.
+
 
 == Before You Begin
 Before adding the scanner, verify that you have these prerequisites:
 
+For discovering and importing APIs:
+
 * Exchange Administrator permission
 * Apigee Read-only Admin permission
 * Google Cloud Platform (GCP) project ID
 * Service account email
 * Private key
 
+Additional requirements for discovering and reading policies:
+
+* Viewer role, or a specific Apigee permission role, assigned to the service account
+
 == Add a Scanner for Google Apigee
 . Verify that you are in the business group where you want to add the scanner.
 . From the sidebar in Exchange, click *Scanners*.

modules/ROOT/pages/adding-azure-api-management-scanner.adoc

@@ -3,20 +3,28 @@ ifndef::env-site,env-github[]
 include::_attributes.adoc[]
 endif::[]
 
-Add a scanner to discover, import, and sync APIs from Azure API Management into Anypoint Exchange. Once imported, you can apply governance rulesets and publish them to your developer portal.
+Add a scanner to discover, import, and sync APIs from Azure API Management into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal.
+
+The scanner discovers policies attached to supported Azure API Management API and operation configurations and shows discovered policies in the enhanced MuleSoft experience as policies applied per imported API.
 
 == Before You Begin
 Before adding the scanner, verify that you have these prerequisites:
 
+For discovering and importing APIs:
+
 * Exchange Administrator permission
-* API Management Service Reader Role permission
 * Tenant ID
 * Client ID
 * Client Secret
 * Subscription ID
 * Resource Group
 * Service Name
 
+Additional requirements for discovering and reading policies:
+
+* API Management Service Reader role permission, scoped to the API Management resource or resource group
+* OAuth scope: `https://management.azure.com/.default`
+
 == Add a Scanner for Azure API Management
 . Verify that you are in the business group where you want to add the scanner.
 . From the sidebar in Exchange, click *Scanners*.

modules/ROOT/pages/adding-kong-gateway-scanner.adoc

@@ -3,17 +3,23 @@ ifndef::env-site,env-github[]
 include::_attributes.adoc[]
 endif::[]
 
-Add a scanner to discover, import, and sync APIs from Kong Gateway into Anypoint Exchange. Once imported, you can apply governance rulesets and publish them to your developer portal.
+Add a scanner to discover, import, and sync APIs from Kong Gateway into Anypoint Exchange and to discover and read policies from API configurations. Once imported, you can apply governance rulesets and publish them to your developer portal.
+
+In Kong, policies are called plugins. The scanner discovers plugins attached to Kong Gateway services and routes, and the enhanced MuleSoft experience shows those discovered plugins as policies. Plugins applied directly at the service instance level are not currently scanned.
+
 
 == Before You Begin
 Before adding the scanner, verify that you have these prerequisites:
 
-* Exchange Administrator permission 
-* Kong Control Plane Viewer permission 
-
+* Exchange Administrator permission
+* Kong Control Plane Viewer permission
 * Kong Gateway region
 * Personal access token (PAT)
 
+Credential scope required for discovering and reading policies:
+
+* Kong Admin API read
+
 == Add a Scanner for Kong Gateway
 . Verify that you are in the business group where you want to add the scanner.
 . From the sidebar in Exchange, click *Scanners*.
@@ -24,7 +30,7 @@ Before adding the scanner, verify that you have these prerequisites:
 |===
 |*Field/Option* |*Value*
 |*Run Schedule* |Select a frequency and local time.
-|*Sync Review* |Select an option: Auto-resolve or Ask to review.
+|*Sync Review* |Select an option: *Auto-resolve* or *Ask to review*.
 |===
 
 . From *Connection Configuration*, complete these fields:

modules/ROOT/pages/agentforce-scanners.adoc

@@ -0,0 +1,23 @@
+= Salesforce Agentforce Scanners
+ifndef::env-site,env-github[]
+include::_attributes.adoc[]
+endif::[]
+
+When your agents are hosted on Salesforce Agentforce, use this page to jump to the Exchange scanner setup. Step-by-step instructions are in the linked page.
+
+== Agent Scanners
+
+* xref:adding-agentforce-scanner.adoc[Add a scanner for Salesforce Agentforce agents]
+
+== Before You Begin Adding a Scanner
+
+Make sure you have the permission and access:
+
+* Exchange Administrator permission
+* Verify that you are in the business group where you want to add the scanner.
+
+== See Also
+
+* xref:discovering-and-importing-external-agents.adoc[]
+* xref:agent-scanners.adoc[]
+* xref:managing-scanners.adoc[]