> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/configure-iam-security/aws-cloud-identity-inventory.md).

# AWS Cloud Identity Inventory

Prisma Cloud surfaces detailed information on IAM access in your cloud environment to give you greater visibility into over-privileged AWS Groups and Roles. You can then take action to enforce least privileged access by removing unused privileges and restricting permissions within existing AWS Groups and Roles.

## IAM Details View

On the Prisma Cloud console, you can access the Identity menu from the **Assets** side panel. Start, by selecting the Assets side panel from the Alerts, Inventory or Investigate page. For example, you can select **Investigate** and run the following query to retrieve AWS cloud resources:

```
config from iam where source.cloud.type = 'AWS'
```

Click on any asset to view more detailed information. Choose **Identity** from the side panel navigation bar to view the following IAM information:

| Role   | <p>Trust relationships - Lists resources or services assigned to a role, includes last access permission data</p><p>Policies - Lists policies attached to the role and last access information</p><p>Trusted Entities - User, Role, SAML Provider, OIDC Provider, Lambda function, ECS, IDP</p><p>Granted Policies - Managed and Inline</p> |
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Group  | <p>Group membership - Lists users assigned to the group and last access information for users</p><p>Policies - Lists policies associated with the group and last access information</p><p>Granted Policies - Managed and Inline</p>                                                                                                         |
| Policy | <p>Role specific - Lists roles associated with a policy and last access data</p><p>Group specific - Lists groups associated with a policy and last access information</p><p>Resource specific - Lists resources (users) directly attached to the policy and last access data</p>                                                            |

## Remediate Over Privileged Access

Limit over-privileged access by right-sizing permissions for AWS Groups and Roles. The **Suggest Least Privilege Access** wizard helps you remediate overly permissive access by helping you:

* Create a new policy for a Group or Role that includes all the permissions required by its members.
* Repurpose existing policies that already contain the minimum required permissions for any given Group or Role.

Follow the steps below to use the **Suggest Least Privilege Access** wizard:

1. Select the Assets side panel from the Alerts, Inventory, or Investigate page. Click **Identity** on the side panel navigation menu and select **Suggest Least Privilege Access**.
2. The **Suggest Least Privilege Access** wizard allows you to set the period of time after which a permission will be considered be “unused”, for a particular asset. Move the slider to any defined time limit of your choice. By default, the slider is set at 90 days and options ranging 1 day to 2 years are available. Last access days are calculated from the day IAM is enabled in your environment.
3. Next, create a customized IAM policy in your preferred output format:
   1. Select **Create New AWS Policy** to generate a file with code to create a new Custom policy, including all used permissions. Supported policy types include Managed, Custom, and Inline. The following output formats are avaiable:
      * JSON
      * Terraform
      * Cloud Formation
   2. Select **Reuse Existing AWS Policy** to repurpose an existing Managed or Custom policy. Choose from one of the following output options:
      * Terraform file with existing minimum required permissions.
      * List of policies with the appropriate minimum permissions.

        Only policies with no conditions applied and the parameters `Effect = ’Allow’ and Resource = ‘*’` can be considered for reuse.
4. Select the **Summary** tab to view and download the code for your custom policy. If you opted to reuse a policy, select **Download File** to download the Terraform file or click on any listed policy to reuse it.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/configure-iam-security/aws-cloud-identity-inventory.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.