Permissions

When you set up Prisma Cloud Compute to secure your cloud workloads, you’ll need to ensure you’ve granted Prisma Cloud the right permissions. The following tables list the permissions required for each of Compute’s protection capabilities.

You can review the permissions needed for each cloud service provider:

You can review the permissions needed for agentless scanning in each cloud service provider:

AWS

The following table shows the required permissions needed if you are using AWS. You can also review the permissions needed for agentless scanning in AWS.

Capability

Feature

Permissions

Role/Policy

Condition

Workload Discovery

Serverless Radar

cloudwatch:DescribeAlarms

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

iam:GetPolicyVersion

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

iam:GetRole

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

iam:GetPolicy

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

iam:GetRolePolicy

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

iam:ListRolePolicies

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

iam:ListAttachedRolePolicies

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

lambda:ListFunctions

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

lambda:GetFunction

PrismaCloud-ReadOnly-Policy-Compute

Workload Discovery

Serverless Radar

lambda:ListAliases

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

lambda:ListEventSourceMappings

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

lambda:GetPolicy

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

kms:Decrypt

PrismaCloud-ReadOnly-Policy-Compute

Workload Discovery

Serverless Radar

logs:DescribeSubscriptionFilters

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

s3:GetBucketNotification

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

elasticloadbalancing:DescribeListeners

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

elasticloadbalancing:DescribeTargetGroups

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

elasticloadbalancing:DescribeListenerCertificates

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

elasticloadbalancing:DescribeRules

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

cloudfront:ListDistributions

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

events:ListRules

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

Serverless Radar

apigateway:GET

arn:aws:iam::aws:policy/SecurityAudit

Workload Discovery

VM Tags Discovery

ec2:DescribeTags

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Registry Scanning

ecr:GetAuthorizationToken

PrismaCloud-ReadOnly-Policy-Compute

Agent-Based Workload Scan

Registry Scanning

ecr:BatchCheckLayerAvailability

PrismaCloud-ReadOnly-Policy-Compute

Agent-Based Workload Scan

Registry Scanning

ecr:GetDownloadUrlForLayer

PrismaCloud-ReadOnly-Policy-Compute

Agent-Based Workload Scan

Registry Scanning

ecr:GetRepositoryPolicy

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Registry Scanning

ecr:DescribeRepositories

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Registry Scanning

ecr:ListImages

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Registry Scanning

ecr:DescribeImages

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Registry Scanning

ecr:BatchGetImage

PrismaCloud-ReadOnly-Policy-Compute

Agent-Based Workload Scan

Registry Scanning

ecr:GetLifecyclePolicy

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Registry Scanning

ecr:GetLifecyclePolicyPreview

PrismaCloud-ReadOnly-Policy-Compute

Agent-Based Workload Scan

Registry Scanning

ecr:ListTagsForResource

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Registry Scanning

ecr:DescribeImageScanFindings

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Serverless Auto Defend

lambda:PublishLayerVersion

PrismaCloud-Remediation-Compute-Policy-ServerlessAutoDefend

Agent-Based Workload Scan

Serverless Auto Defend

lambda:UpdateFunctionConfiguration

PrismaCloud-IAM-Remediation-Policy

Agent-Based Workload Scan

Serverless Auto Defend

lambda:GetLayerVersion

PrismaCloud-ReadOnly-Policy-Compute

Agent-Based Workload Scan

Serverless Auto Defend

lambda:GetFunctionConfiguration

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Serverless Auto Defend

iam:SimulatePrincipalPolicy

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Serverless Auto Defend

lambda:GetFunction

PrismaCloud-ReadOnly-Policy-Compute

Agent-Based Workload Scan

Serverless Auto Defend

lambda:ListFunctions

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Serverless Auto Defend

iam:GetPolicyVersion

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Serverless Auto Defend

iam:GetRole

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Serverless Auto Defend

iam:ListRolePolicies

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Serverless Auto Defend

iam:ListAttachedRolePolicies

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Serverless Auto Defend

iam:GetRolePolicy

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Serverless Auto Defend

iam:GetPolicy

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Serverless Auto Defend

lambda:ListLayerVersions

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Serverless Auto Defend

lambda:ListLayers

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Serverless Auto Defend

lambda:DeleteLayerVersion

PrismaCloud-Remediation-Compute-Policy-ServerlessAutoDefend

Agent-Based Workload Scan

Serverless Auto Defend

kms:Decrypt

PrismaCloud-ReadOnly-Policy-Compute

Agent-Based Workload Scan

Serverless Auto Defend

kms:Encrypt

PrismaCloud-Remediation-Compute-Policy-AgentlessScanning

Agent-Based Workload Scan

Serverless Auto Defend

kms:CreateGrant

PrismaCloud-Remediation-Compute-Policy-AgentlessScanning

Agent-Based Workload Scan

VM Images Scan

ec2:CreateSecurityGroup

PrismaCloud-Remediation-Compute-Policy-AMIScan

Agent-Based Workload Scan

VM Images Scan

ec2:DescribeSecurityGroups

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

VM Images Scan

ec2:RevokeSecurityGroupEgress

PrismaCloud-Remediation-Compute-Policy-AMIScan

Agent-Based Workload Scan

VM Images Scan

ec2:AuthorizeSecurityGroupIngress

PrismaCloud-Remediation-Compute-Policy-AMIScan

Agent-Based Workload Scan

VM Images Scan

ec2:DeleteSecurityGroup

PrismaCloud-Remediation-Compute-Policy-AMIScan

Agent-Based Workload Scan

VM Images Scan

ec2:RunInstances

PrismaCloud-Remediation-Compute-Policy-AMIScan

Agent-Based Workload Scan

VM Images Scan

ec2:DescribeInstances

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

VM Images Scan

ec2:TerminateInstances

PrismaCloud-Remediation-Compute-Policy-AMIScan

Agent-Based Workload Scan

VM Images Scan

ec2:DescribeImages

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

VM Images Scan

ec2:CreateTags

PrismaCloud-Remediation-Compute-Policy-AMIScan

Agent-Based Workload Scan

VM Images Scan

ec2:AuthorizeSecurityGroupEgress

PrismaCloud-Remediation-Compute-Policy-AMIScan

Agent-Based Workload Scan

VM Images Scan

ec2:DescribeSubnets

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

VM Images Scan

ec2:DescribeVpcs

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

VM Images Scan

ec2:DescribeInstanceTypeOfferings

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Host Auto-Defend

ec2:DescribeImages

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Host Auto-Defend

ec2:DescribeInstances

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Host Auto-Defend

ssm:SendCommand

PrismaCloud-Remediation-Compute-Policy-HostAutoDefend

Agent-Based Workload Scan

Host Auto-Defend

ssm:DescribeInstanceInformation

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Host Auto-Defend

ssm:ListCommandInvocations

PrismaCloud-Remediation-Compute-Policy-HostAutoDefend

Agent-Based Workload Scan

Host Auto-Defend

ssm:CancelCommand

PrismaCloud-Remediation-Compute-Policy-HostAutoDefend

Agent-Based Workload Scan

Host Auto-Defend

ssm:CreateAssociation

PrismaCloud-Remediation-Compute-Policy-HostAutoDefend

Agent-Based Workload Scan

Host Auto-Defend

ec2:DescribeRegions

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Host Auto-Defend

ec2:DescribeTags

arn:aws:iam::aws:policy/SecurityAudit

Agent-Based Workload Scan

Secrets Manager

Agent-Based Workload Scan

Alert Provider

securityhub:BatchImportFindings

PrismaCloud-ReadOnly-Policy-Compute

Serverless Function Scanning

lambda:ListFunctions

arn:aws:iam::aws:policy/SecurityAudit

Serverless Function Scanning

lambda:GetFunction

PrismaCloud-ReadOnly-Policy-Compute

Serverless Function Scanning

iam:GetPolicy

arn:aws:iam::aws:policy/SecurityAudit

Serverless Function Scanning

iam:GetPolicyVersion

arn:aws:iam::aws:policy/SecurityAudit

Serverless Function Scanning

iam:GetRole

arn:aws:iam::aws:policy/SecurityAudit

Serverless Function Scanning

iam:GetRolePolicy

arn:aws:iam::aws:policy/SecurityAudit

Serverless Function Scanning

iam:ListAttachedRolePolicies

arn:aws:iam::aws:policy/SecurityAudit

Serverless Function Scanning

iam:ListRolePolicies

arn:aws:iam::aws:policy/SecurityAudit

Serverless Function Scanning

lambda:GetLayerVersion

PrismaCloud-ReadOnly-Policy-Compute

Serverless Function Scanning

kms:Decrypt

PrismaCloud-ReadOnly-Policy-Compute

Serverless Function Scanning

ec2:DescribeTags

arn:aws:iam::aws:policy/SecurityAudit

Serverless Function Scanning

AWS Agentless Permissions

The following table shows the required permissions, conditions, and resources for agentless scanning.

Go to the AWS documentation for the official list of permissions needed to support EBS encryption.

Permission

Same Account

Hub Account

Target Account

Condition

Resource

Purpose

Mandatory

Removal Effect

ec2:CreateSnapshots

Yes

Create snapshots of hosts to be scanned by the scanner instance

Yes

ec2:CreateSnapshot

Yes

Create snapshot of hosts to be scanned by the scanner instance

Yes

ec2:DeleteSnapshot

Yes

"ec2:ResourceTag/created-by": "prismacloud-agentless-scan"

Delete snapshot of hosts that were created during the scan process

Yes

ec2:TerminateInstances

Yes

"ec2:ResourceTag/created-by": "prismacloud-agentless-scan"

Terminate scanner instance

Yes

ec2:DescribeVolumes

Yes

Discovering volumes to scan

Yes

ec2:DescribeInstances

Yes

Discovering instances to scan

Yes

ec2:DescribeSnapshots

Yes

Acquire snapshot status to allow deploying the scanner only when all snapshots up and running

Yes

ec2:RunInstances

Yes

Run the scanner instance

Yes

ec2:DescribeInstanceStatus

Yes

Track scanner instance status

Yes

ec2:DescribeSubnets

Yes

Validate subnet status - ensure subnet exists

Yes

ec2:DescribeSecurityGroups

Yes

Validate security group status - ensure security group exists

Yes

ec2:CreateTags

Yes

"aws:RequestTag/created-by": "prismacloud-agentless-scan"

"arn:aws:ec2:*:*:instance/*" "arn:aws:ec2:*:*:volume/*"

Tag PCC resources created during the scan process

Yes

ec2:CreateTags

Yes

"aws:RequestTag/created-by": "prismacloud-agentless-scan"

"arn:aws:ec2:*::snapshot/*"

Tag PCC resources created during the scan process

Yes

ec2:DescribeInstanceTypes

Yes

Get available VM types on the region for grouping

Yes

sts:DecodeAuthorizationMessage

Yes

Decode UnauthorizedOperation response from the AWS API

Yes

ssm:GetParameters

Yes

Discover the scanner AMI

Yes

ec2:DescribeImages

Yes

Disocver specifc AMIs metadata

Yes

sts:GetCallerIdentity

Yes

Get metadata about the account (e.g., check for disabled regions, ec2 instances metadata)

Yes

iam:SimulatePrincipalPolicy

Yes

Validate the effective permissions granted to the Prisma Cloud role

Yes

iam:CreateServiceLinkedRole

Yes

"arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/*"

"iam:AWSServiceName": "spot.amazonaws.com"

Create a linked service role for spot instance request

Yes

ec2:DescribeVPCs

Yes

Discover the VPC to be used by the scanner instance

Yes

account:GetRegionOptStatus

Yes

Discover regions statuses

Yes

ec2:DescribeNetworkInterfaces

Yes

Discover the network interfaces to be used by the scanner instance

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:DeleteNetworkInterface

Yes

Delete the network interface used by the scanner instance. Network interface is untaggable since it is created implicitly as part of instance creation. This permission only applies to detached network interfaces, so the scope effect is minimal

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:CreateTags

Yes

"aws:RequestTag/created-by": "prismacloud-agentless-scan"

"arn:aws:ec2:*:*:vpc/*" "arn:aws:ec2:*:*:subnet/*" "arn:aws:ec2:*:*:internet-gateway/*"

Tag PCC resources created during the scan process

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:CreateVpc

Yes

"aws:RequestTag/created-by": "prismacloud-agentless-scan"

Create scanner instance VPC

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:CreateInternetGateway

Yes

"aws:RequestTag/created-by": "prismacloud-agentless-scan"

Create scanner instance internet gateway

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:CreateSubnet

Yes

"aws:RequestTag/created-by": "prismacloud-agentless-scan"

Create scanner instance subnet

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:CreateSubnet

Yes

"ec2:ResourceTag/created-by": "prismacloud-agentless-scan"

Attach the scanner subnet to the VPC

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:DeleteSubnet

Yes

"ec2:ResourceTag/created-by": "prismacloud-agentless-scan"

Delete subnet attached to scanner

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:DetachInternetGateway

Yes

"ec2:ResourceTag/created-by": "prismacloud-agentless-scan"

Detach internet gateway from scanner subnet

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:DeleteVpc

Yes

"ec2:ResourceTag/created-by": "prismacloud-agentless-scan"

Delete the VPC used by the scanner instance

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:DeleteInternetGateway

Yes

"ec2:ResourceTag/created-by": "prismacloud-agentless-scan"

Delete the internet gateway used by the scanner instance

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:AttachInternetGateway

Yes

"ec2:ResourceTag/created-by": "prismacloud-agentless-scan"

Attach internet gateway to scanner subnet

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:CreateRoute

Yes

Create route to the gateway to allow outbound traffic

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:DescribeRouteTables

Yes

Retrieve the main route table associated by default to every subnet under the VPC

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

ec2:DescribeInternetGateways

Yes

Discover the internet gateway to be used by the scanner instance

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

kms:Decrypt

Yes

Required to support EBS encryption

Denies support for encrypted volumes

kms:GenerateDataKeyWithoutPlaintext

Yes

Required to support EBS encryption

Denies support for encrypted volumes

kms:ReEncryptFrom

Yes

Required to support EBS encryption

Denies support for encrypted volumes

kms:ReEncryptTo

Yes

Required to support EBS encryption

Denies support for encrypted volumes

kms:DescribeKey

Yes

Required to support EBS encryption

Denies support for encrypted volumes

kms:CreateGrant

Yes

Required to support EBS encryption

Denies support for encrypted volumes

ec2:ModifySnapshotAttribute

Yes

"ec2:ResourceTag/created-by": "prismacloud-agentless-scan"

Share snapshot with the hub account

Yes

Denies scanning snapshots in hub mode

kms:CreateKey

Yes

"aws:RequestTag/created-by": "prismacloud-agentless-scan"

Create a new shareable (with hub) PCC KMS key to re-encrypt the snapshots

Denies support for encrypted volumes in hub mode

kms:TagResource

Yes

"aws:RequestTag/created-by": "prismacloud-agentless-scan"

Create the PCC KMS key with tags

Denies support for encrypted volumes in hub mode

ec2:CopySnapshot

Yes

Create copies of encrypted snapshots, using the PCC KMS key

Denies support for encrypted volumes in hub mode

kms:ListKeys

Yes

Discover and reuse existing PCC KMS key, also required for the cleanup process

Denies support for encrypted volumes in hub mode

GCP

Follow these instructions to scan encrypted volumes with the hub mode.

The following table shows the required permissions needed if you are using GCP. You can also review the permissions needed for agentless scanning in GCP.

Capability

Feature

Permissions

Role/Policy

Workload Discovery

Cloud Discovery

Workload Discovery

Cloud Discovery

roles/storage.objectViewer

roles/viewer

Workload Discovery

Cloud Discovery

roles/container.clusterViewer

roles/viewer

Workload Discovery

Cloud Discovery

roles/cloudfunctions.viewer

roles/viewer

Workload Discovery

Cloud Discovery

compute.instances.list

Prisma Cloud Viewer

Workload Discovery

Cloud Discovery

compute.zones.list

Prisma Cloud Viewer

Workload Discovery

Cloud Discovery

compute.projects.get

Prisma Cloud Viewer

Workload Discovery

Cloud Discovery

compute.disks.get

Prisma Cloud Viewer

Agent-Based Workload Scan

Host Auto Defend

Agent-Based Workload Scan

Host Auto Defend

osconfig.patchJobs.exec

Prisma Cloud Viewer

Agent-Based Workload Scan

Host Auto Defend

osconfig.patchJobs.list

Prisma Cloud Viewer

Agent-Based Workload Scan

Host Auto Defend

osconfig.patchJobs.get

Prisma Cloud Viewer

Agent-Based Workload Scan

Host Auto Defend

storage.buckets.create

Prisma Cloud Viewer

Agent-Based Workload Scan

Host Auto Defend

storage.buckets.delete

Prisma Cloud Viewer

Agent-Based Workload Scan

Host Auto Defend

storage.objects.create

Prisma Cloud Viewer

Agent-Based Workload Scan

Host Auto Defend

storage.objects.delete

Prisma Cloud Viewer

Agent-Based Workload Scan

Host Auto Defend

storage.objects.get

Prisma Cloud Viewer

Agent-Based Workload Scan

Host Auto Defend

storage.objects.list

Prisma Cloud Viewer

Agent-Based Workload Scan

Host Auto Defend

compute.disks.get

Prisma Cloud Viewer

Agent-Based Workload Scan

Host Auto Defend

compute.instances.list

Prisma Cloud Viewer

Agent-Based Workload Scan

Host Auto Defend

compute.zones.list

Prisma Cloud Viewer

Agent-Based Workload Scan

Host Auto Defend

compute.projects.get

Prisma Cloud Viewer

Agent-Based Workload Scan

Google Artifact Registry Scan

Agent-Based Workload Scan

Google Artifact Registry Scan

artifactregistry.repositories.list

roles/viewer

Agent-Based Workload Scan

Google Artifact Registry Scan

artifactregistry.repositories.get

roles/viewer

Agent-Based Workload Scan

Google Artifact Registry Scan

artifactregistry.repositories.downloadArtifacts

roles/viewer

Agent-Based Workload Scan

Google Artifact Registry Scan

artifactregistry.files.list

roles/viewer

Agent-Based Workload Scan

Google Artifact Registry Scan

artifactregistry.files.get

roles/viewer

Agent-Based Workload Scan

Google Artifact Registry Scan

artifactregistry.packages.list

roles/viewer

Agent-Based Workload Scan

Google Artifact Registry Scan

artifactregistry.packages.listTagBindings

roles/viewer

Agent-Based Workload Scan

Google Artifact Registry Scan

artifactregistry.repositories.listEffectiveTags

roles/viewer

Agent-Based Workload Scan

Google Artifact Registry Scan

artifactregistry.packages.list

roles/viewer

Agent-Based Workload Scan

Google Artifact Registry Scan

artifactregistry.tags.list

roles/viewer

Agent-Based Workload Scan

Google Artifact Registry Scan

artifactregistry.tags.get

roles/viewer

Agent-Based Workload Scan

Google Artifact Registry Scan

artifactregistry.versions.list

roles/viewer

Agent-Based Workload Scan

Google Artifact Registry Scan

artifactregistry.versions.get

roles/viewer

Agent-Based Workload Scan

Google Container Registry Scan

Agent-Based Workload Scan

Google Container Registry Scan

storage.objects.get

Storage Object Viewer

Agent-Based Workload Scan

Google Container Registry Scan

storage.objects.list

Storage Object Viewer

Agent-Based Workload Scan

VM Images Scan

Agent-Based Workload Scan

VM Images Scan

compute.disks.create

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.images.get

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.images.list

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.images.useReadOnly

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.instances.create

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.instances.delete

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.instances.get

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.instances.list

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.instances.setMetadata

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.instances.setTags

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.networks.get

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.networks.updatePolicy

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.networks.use

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.networks.useExternalIp

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.subnetworks.use

Prisma Cloud Viewer

Agent-Based Workload Scan

VM Images Scan

compute.subnetworks.useExternalIp

Prisma Cloud Viewer

Serverless Function Scanning

Serverless Scanning

Serverless Function Scanning

Serverless Scanning

cloudfunctions.functions.sourceCodeGet

Serverless Function Scanning

Serverless Scanning

cloudfunctions.functions.get

roles/viewer

Serverless Function Scanning

Serverless Scanning

cloudfunctions.functions.list

roles/viewer

Serverless Function Scanning

Serverless Scanning

cloudfunctions.locations.get

roles/viewer

Serverless Function Scanning

Serverless Scanning

cloudfunctions.locations.list

roles/viewer

Serverless Function Scanning

Serverless Scanning

cloudfunctions.operations.get

roles/viewer

Serverless Function Scanning

Serverless Scanning

cloudfunctions.operations.list

roles/viewer

Serverless Function Scanning

Serverless Scanning

cloudfunctions.runtimes.list

roles/viewer

NOTE:

The purpose for Microsoft.Web/sites/config/list/Action is to list Web App’s security sensitive settings, such as publishing credentials, app settings, and connection strings.
The purpose for Microsoft.ContainerInstance/containerGroups/containers/exec/action is to allow execution within a specific container, which is essential for compute workload discovery. Get/list permissions only provide external cloud object information and do not access critical node-level details like container runtime or Kubernetes version. This permission is necessary to ensure accurate and comprehensive workload discovery.

GCP Agentless Permissions

The following table shows the required permissions for agentless scanning.

Permission

Same Account

Hub Account

Target Account

Condition

Purpose

Mandatory

Removal Effect

compute.disks.create

Yes

Create disks from the snapshots to attach to the scanner instance

Yes

compute.instances.create

Yes

"expression": "(resource.name.endsWith(\"-prisma-agentless-scan\") && resource.service == \"compute.googleapis.com\") || resource.type == \"cloudresourcemanager.googleapis.com/Project\"", "description": "Grant scoped permissions only if the resource name ends with -prisma-agentless-scan and service is compute",

Create the scanner instance

Yes

compute.instances.delete

Yes

Delete the scanner instance

Yes

compute.instances.get

Yes

Retrieve information about scanner instance

Yes

compute.instances.setLabels

Yes

Set the scanner instance labels

Yes

compute.instances.setMetadata

Yes

Set the scanner instance metadata

Yes

compute.zones.list

Yes

Discover for zonal resources (e.g. iterating instances within zones)

Yes

compute.disks.get

Yes

Get disks attached to the scanner instance

Yes

compute.projects.get

Yes

Discover and get metadata of the project resource

Yes

compute.disks.createSnapshot

Yes

Create snapshots of instances to scan. If using hub mode, this permissions is required on every target that is not part of the same org as the hub account

Yes

compute.instances.list

Yes

Discover instances to scan

Yes

compute.snapshots.create

Yes

Create snapshot of hosts to be scanned by the scanner instance

Yes

compute.snapshots.delete

Yes

Delete snapshot of hosts that were created during the scan process

Yes

compute.snapshots.list

Yes

List snapshots within a project

Yes

compute.snapshots.setLabels

Yes

Set labels on a snapshot so it can be associated with the scanner instance

Yes

compute.snapshots.useReadOnly

Yes

Create a disk from read-only snapshots when creating a scanner instance

Yes

compute.subnetworks.use

Yes

When deploying a scanner with custom network resources the permission to use subnets is required

Yes

compute.networks.use

Yes

Attach network to the scanner instance

Yes

compute.networks.get

Yes

Retrieve information about the scanner instance network

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

compute.regionOperations.get

Yes

Required for regional APIs (e.g. bulk insert) and for creating regional resources (e.g. subnet)

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

compute.subnetworks.get

Yes

Retrieve the scanner instance subnet

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

compute.networks.useExternalIp

Yes

The scanner instance uses an exetrnal IP by default. Safe to remove if using custom network resources

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

compute.subnetworks.useExternalIp

Yes

The scanner instance uses an exetrnal IP by default. Safe to remove if using custom network resources

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

compute.networks.create

Yes

Create scanner instance network

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

compute.networks.delete

Yes

Delete scanner instance network

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

compute.networks.updatePolicy

Yes

Modify the scanner instance network policy

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

compute.subnetworks.create

Yes

Create scanner instance subnet

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

compute.subnetworks.delete

Yes

Delete scanner instance subnet

Denies automated creation of network infrastructure - safe to remove if configuring custom network resources

compute.subnetworks.use

Required only when using a shared VPC - to be applied on the shared VPC host project

Denies ability to use a shared VPC

compute.subnetworks.useExternalIp

Required only when using a shared VPC - to be applied on the shared VPC host project

Denies ability to use a shared VPC

Azure

The following table shows the required permissions needed if you are using Azure. You can also review the permissions needed for agentless scanning in Azure.

Capability

Feature

Permissions

Role/Policy

Workload Discovery

Microsoft.ContainerRegistry/registries/read

Reader

Workload Discovery

Microsoft.ContainerRegistry/registries/pull/read

Workload Discovery

Microsoft.ContainerRegistry/registries/metadata/read

Reader

Workload Discovery

Microsoft.ContainerService/managedClusters/read

Reader

Workload Discovery

Microsoft.Web/sites/Read

Reader

Workload Discovery

Microsoft.ContainerInstance/containerGroups/read

Reader

Workload Discovery

Microsoft.ContainerInstance/containerGroups/containers/exec/action

Prisma Cloud custom role

Workload Discovery

Microsoft.Compute/virtualMachines/read

Reader

Workload Discovery

Microsoft.Compute/hostGroups/read

Serverless Function Scanning

Microsoft.Web/sites/Read

Reader

Serverless Function Scanning

Microsoft.Web/sites/config/list/Action

Prisma Cloud custom role

Serverless Function Scanning

Microsoft.web/sites/functions/action

Prisma Cloud custom role

Serverless Function Scanning

Microsoft.web/sites/functions/read

Reader

Serverless Function Scanning

Microsoft.Web/sites/publishxml/Action

Prisma Cloud custom role

Agent-Based Workload Scan

Host Auto Defend

Agent-Based Workload Scan

Host Auto Defend

Microsoft.Compute/virtualMachines/runCommand/action

Prisma Cloud custom role

Agent-Based Workload Scan

Host Auto Defend

Microsoft.Compute/locations/operations/read

Reader

Agent-Based Workload Scan

Host Auto Defend

Microsoft.Resources/subscriptions/locations/read

Reader

Agent-Based Workload Scan

VM Images Scan

Agent-Based Workload Scan

VM Images Scan

Microsoft.Compute/locations/publishers/artifacttypes/offers/skus/versions/read

Reader

Agent-Based Workload Scan

VM Images Scan

Microsoft.Compute/images/read

Reader

Agent-Based Workload Scan

VM Images Scan

Microsoft.Compute/galleries/read

Reader

Agent-Based Workload Scan

VM Images Scan

Microsoft.Compute/galleries/images/read

Reader

Agent-Based Workload Scan

VM Images Scan

Microsoft.Compute/galleries/images/versions/read

Reader

Agent-Based Workload Scan

VM Images Scan

Microsoft.Resources/subscriptions/resourceGroups/read

Reader

Agent-Based Workload Scan

VM Images Scan

Microsoft.Resources/subscriptions/resourceGroups/write

Prisma Cloud custom role

Agent-Based Workload Scan

VM Images Scan

Microsoft.Resources/subscriptions/resourceGroups/delete

Prisma Cloud custom role

Agent-Based Workload Scan

VM Images Scan

Microsoft.Network/networkSecurityGroups/read

Reader

Agent-Based Workload Scan

VM Images Scan

Microsoft.Network/networkSecurityGroups/write

Network Contributor

Agent-Based Workload Scan

VM Images Scan

Microsoft.Network/networkSecurityGroups/join/action

Network Contributor

Agent-Based Workload Scan

VM Images Scan

Microsoft.Network/networkSecurityGroups/delete

Network Contributor

Agent-Based Workload Scan

VM Images Scan

Microsoft.Network/networkInterfaces/read

Reader

Agent-Based Workload Scan

VM Images Scan

Microsoft.Network/networkInterfaces/write

Network Contributor

Agent-Based Workload Scan

VM Images Scan

Microsoft.Network/networkInterfaces/join/action

Network Contributor

Agent-Based Workload Scan

VM Images Scan

Microsoft.Network/networkInterfaces/delete

Network Contributor

Agent-Based Workload Scan

VM Images Scan

Microsoft.Compute/disks/write

Prisma Cloud custom role

Agent-Based Workload Scan

VM Images Scan

Microsoft.Compute/disks/delete

Prisma Cloud custom role

Agent-Based Workload Scan

VM Images Scan

Microsoft.Network/virtualNetworks/subnets/read

Reader

Agent-Based Workload Scan

VM Images Scan

Microsoft.Network/virtualNetworks/subnets/join/action

Network Contributor

Agent-Based Workload Scan

VM Images Scan

Microsoft.Compute/virtualMachines/read

Reader

Agent-Based Workload Scan

VM Images Scan

Microsoft.Compute/virtualMachines/write

Prisma Cloud custom role

Agent-Based Workload Scan

VM Images Scan

Microsoft.Compute/virtualMachines/start/action

Prisma Cloud custom role

Agent-Based Workload Scan

VM Images Scan

Microsoft.Compute/virtualMachines/delete

Prisma Cloud custom role

Agent-Based Workload Scan

VM Images Scan

Microsoft.KeyVault/vaults/keys/read

Reader

Agent-Based Workload Scan

VM Images Scan

Microsoft.KeyVault/vaults/keys/wrap/action

Key Vault Crypto Service Encryption User

Agent-Based Workload Scan

VM Images Scan

Microsoft.KeyVault/vaults/keys/unwrap/action

Key Vault Crypto Service Encryption User

Azure Agentless Permissions

The following table shows the required permissions for agentless scanning.

Permission

Same Account

Hub Account

Target Account

Purpose

Mandatory

Removal Effect

Microsoft.Authorization/locks/read

Yes