Volver a la documentaciónonboarding/README.mdRepositorio privado

Onboarding a tenant in under 60 minutes

Step	Time	What you do	What Centinela verifies
1. AWS	10 min	Deploy `aws/centinela-read-roles.cfn.yaml` as a StackSet (or `aws/terraform`) with the ExternalId shown in the wizard	Assume role works; metadata APIs allowed; data/secret reads denied
2. GCP (optional)	10 min	Run `gcp/setup-wif.sh`, upload the credential config (no secrets inside)	Token exchange; required permissions present; broad roles absent
3. GitHub	10 min	Create Centinela Reader from `github/app-manifests/centinela-reader.json`, install on the org. Optionally create Centinela Executor and install it only where PRs are allowed	Exact permission sets; installations present; executor cannot merge
4. Verify	2 min	`python3 -I verify/verify_permissions.py --aws-role-arn … --external-id …` (the console wizard runs the same checks live)	Green/red checklist with remediation per failing item
5. First evaluation	≤ 25 min	Centinela discovers all accounts/regions/projects/repos automatically and runs the first matching pass	"Does it affect me?" answers for the current KEV catalogue

Try everything first in demo mode (synthetic data, nothing connected): make dev && make demo.

Principles you can verify yourself: Centinela never asks for write access to your clouds; the only write capability is a separate GitHub App that can open pull requests and nothing else.

Onboarding en menos de 60 minutos (ES)

AWS (10 min): despliega aws/centinela-read-roles.cfn.yaml con StackSets usando el ExternalId del asistente.
GCP (10 min, opcional): ejecuta gcp/setup-wif.sh; no se crean claves.
GitHub (10 min): crea la App Centinela Reader (solo lectura) y, si quieres PRs automáticos tras aprobación, Centinela Executor (solo contents y pull_requests).
Verificación (2 min): verify/verify_permissions.py muestra la lista en verde/rojo con la solución de cada fallo.
Primera evaluación (≤ 25 min): descubrimiento automático de cuentas, regiones, proyectos y repositorios.