# Cloud and SaaS Setup Guides

> Each guide here covers what a provider administrator configures so dfe-fetcher
> can pull data from that provider: the access it needs, how to grant it
> least-privilege, where to put credentials, and how to verify the connection.
> Every source is read-side: M365 starts its activity-feed subscription and
> Pub/Sub acknowledges what it delivered. Nothing else changes provider state.

For the fetcher's own configuration (scheduler, output, credential resolution,
the `sources.db` and `sources.file` blocks), see
[config.example.yaml](https://github.com/hyperi-io/dfe-fetcher/blob/v1.4.54/config.example.yaml). The architecture and the
profile grammar are in [../internals.md](/v/2.2.2/dfe-fetcher/internals.md).

## Credentials in Kubernetes

The released chart mounts one Secret, Kafka's: its `username`, `password` and `sasl.mechanism` keys become `DFE_FETCHER_KAFKA_SASL_USER`, `DFE_FETCHER_KAFKA_SASL_PASSWORD` and `DFE_FETCHER_KAFKA_SASL_MECHANISM`. Name an existing Secret with the chart value `secrets.kafka.existingSecret`.

A provider's credentials are yours to supply, through the chart's `extraEnv` (a map of variable name to value or `valueFrom`) or `extraEnvFrom` (a list of `envFrom` sources) values. Two shapes work, and each guide's Environment Variables section names the fields:

- set the field itself, `DFE_FETCHER_SOURCES__<BLOCK>__<FIELD>`, from a Secret key, e.g. `DFE_FETCHER_SOURCES__AWS__SECRET_ACCESS_KEY`
- write the field as an `env:NAME` spec in the config, and load a Secret whose keys are those names with `extraEnvFrom`

```yaml
extraEnv:
  DFE_FETCHER_SOURCES__AZURE__CLIENT_SECRET:
    valueFrom:
      secretKeyRef:
        name: fetcher-azure
        key: client-secret
extraEnvFrom:
  - secretRef:
      name: fetcher-credentials
```

An empty value counts as unset, so a Secret key left blank leaves the field unset rather than signing requests with an empty key.

## Providers

| Provider | Data it pulls | Guide |
|----------|---------------|-------|
| AWS | Security and operational logs | [aws.md](/v/2.2.2/dfe-fetcher/cloud-setup/aws.md) |
| Azure | Platform and security logs | [azure.md](/v/2.2.2/dfe-fetcher/cloud-setup/azure.md) |
| Microsoft 365 | Audit and security logs | [m365.md](/v/2.2.2/dfe-fetcher/cloud-setup/m365.md) |
| Google Cloud | Audit and security logs | [gcp.md](/v/2.2.2/dfe-fetcher/cloud-setup/gcp.md) |
| Google Cloud Pub/Sub | Subscription streaming | [gcp-pubsub.md](/v/2.2.2/dfe-fetcher/cloud-setup/gcp-pubsub.md) |
| Google Workspace | Admin and audit logs | [google-workspace.md](/v/2.2.2/dfe-fetcher/cloud-setup/google-workspace.md) |
| Okta | System log | [okta.md](/v/2.2.2/dfe-fetcher/cloud-setup/okta.md) |
| Cisco Duo | Admin and authentication logs | [duo.md](/v/2.2.2/dfe-fetcher/cloud-setup/duo.md) |
| CrowdStrike | Falcon detections and events | [crowdstrike.md](/v/2.2.2/dfe-fetcher/cloud-setup/crowdstrike.md) |
| Cloudflare | Audit logs | [cloudflare.md](/v/2.2.2/dfe-fetcher/cloud-setup/cloudflare.md) |
| Datadog | Audit trail and security signals | [datadog.md](/v/2.2.2/dfe-fetcher/cloud-setup/datadog.md) |
| Bitwarden | Event logs | [bitwarden.md](/v/2.2.2/dfe-fetcher/cloud-setup/bitwarden.md) |
| 1Password | Audit and sign-in events | [onepassword.md](/v/2.2.2/dfe-fetcher/cloud-setup/onepassword.md) |
| Slack | Audit logs | [slack.md](/v/2.2.2/dfe-fetcher/cloud-setup/slack.md) |
| GitHub | Audit log | [github.md](/v/2.2.2/dfe-fetcher/cloud-setup/github.md) |
| Salesforce | Event monitoring logs | [salesforce.md](/v/2.2.2/dfe-fetcher/cloud-setup/salesforce.md) |
| runZero | Asset inventory snapshots | [runzero.md](/v/2.2.2/dfe-fetcher/cloud-setup/runzero.md) |
| Object store | Buckets (S3 and compatible) | [object-store.md](/v/2.2.2/dfe-fetcher/cloud-setup/object-store.md) |
| Package registries | PyPI, crates.io, Go modules | [supply-chain.md](/v/2.2.2/dfe-fetcher/cloud-setup/supply-chain.md) |

## Source Maturity

A source's release maturity is the `maturity` field of its shipped profile
under `crates/fetcher/profiles/`; the capability catalog
(`docs/capability-catalog.yaml`) repeats it and a test keeps the two equal.
The fetcher logs a warning at startup for any enabled source that is not yet
stable.

| Stage | Meaning |
|-------|---------|
| Alpha | Code-complete but not production-validated. Behaviour and config may change. The default for a new source. |
| Beta | Validated against a live service; hardening in progress. |
| Stable | Production-ready. |