> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/configure-iam-security/context-used-to-calculate-effective-permissions.md).

# Context Used to Calculate Effective Permissions

Prisma Cloud IAM Security is powered by a two-part proprietary algorithm. First, services from multiple cloud entities are combined to compute the net effective permissions of each cloud resource. Net effective permissions data includes:

* [AWS Net Effective Permissions Calculation](#id143dfc86-2c88-40f9-81ab-7cf9fbad9e09): AWS IAM roles, policies, groups, and service control policies (SCPs).
* [Azure Net Effective Permissions Calculation](#id5104998a-a619-4b2d-b7bf-5980647df3cf): Azure managed groups, Azure subscriptions, Azure resources and Active Directory (AD).
* [GCP Net Effective Permissions Calculation](#idd30a7b13-b8e6-4f2c-af77-ffb9d821f15f): GCP users, service accounts, groups, and roles.

This information is then matched with last access data to identify when a permission was last used. To efficiently process the high volume of usage data, last access destinations are limited to 100. Each permission includes a maximum number of 100 last access rows including the latest events of each day.

## AWS Net Effective Permissions Calculation

The following AWS policy types and identities are used to calculate the net effective permissions:

* AWS IAM role
* AWS IAM policy
* AWS IAM group
* AWS service control policies (SCPs)
* Role trust relationships
* Permission boundaries
* NotAction
* Policies with wild card support

Other resource types you may have in your AWS deployment are not factored into net-effective permission calculations.

In addition, permissions can also be set by a resource-based policy. The following AWS **resource-based policies** are supported in the net effective permissions calculation:

* Lambda function
* S3 bucket
* SQS queue
* SNS topic
* ECS task definition
* Secret manager
* KMS key
* Lambda layer version

When you define permissions there are several IAM concepts that you can specify. The IAM Security module currently uses some of these concepts and ignores the following concepts:

* IAM variables
* Service linked roles
* NotResource

You can also query your results in Prisma Cloud using the following AWS concepts:

* Tags
* Conditions

Reference [IAM Query](/content-collections/search-and-investigate/permissions-queries/permissions-query-attributes.md) attributes to view AWS tag attributes and learn more about running IAM queries for AWS Tags.

Note that unlike AWS, tags in Prisma Cloud are not case-sensitive.

After the net effective permissions are calculated the actual usage (last access) is matched to determine when write events were actually used. Because the last access calculation is based on a 24-hour period for each account, you should wait at least 24 hours to see the updated last access value for any new actions in your account. Last access is supported by the majority of write events. The following AWS services and events are verified:

| Service                        | Event Name                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cloud9                         | <ul><li>CreateEnvironmentEC2</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Elastic Compute Cloud          | <ul><li>CreateImage</li><li>CreateNetworkAcl</li><li>CreateRoute</li><li>CreateSecurityGroup</li><li>CreateSubnet</li><li>CreateVpcEndpoint</li><li>DeleteFlowLogs</li><li>DeletePlacementGroup</li><li>DeleteVolume</li><li>DeleteVpnGateway</li><li>ImportKeyPair</li><li>MonitorInstances</li><li>AssociateIamInstanceProfile</li><li>ModifyVpcEndpointServicePermissions</li></ul>                                                                                          |
| Elastic Container Registry     | <ul><li>PutImage</li><li>DeleteLifecyclePolicy</li><li>DeleteRepositoryPolicy</li><li>PutLifecyclePolicy</li><li>SetRepositoryPolicy</li></ul>                                                                                                                                                                                                                                                                                                                                  |
| Elastic Container Service      | <ul><li>DeregisterTaskDefinition</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| ElastiCache                    | <ul><li>CreateCacheCluster</li><li>CreateCacheSecurityGroup</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                           |
| Elastic File System            | <ul><li>CreateFileSystem</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Elastic Load Balancing         | <ul><li>CreateListener</li><li>DeleteLoadBalancerListeners</li><li>SetLoadBalancerPoliciesOfListener</li><li>CreateLoadBalancerPolicy</li><li>DeleteLoadBalancerPolicy</li></ul>                                                                                                                                                                                                                                                                                                |
| Elastic MapReduce              | <ul><li>RunJobFlow</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Elasticsearch                  | <ul><li>CreateElasticsearchServiceRole</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                |
| Identity and Access Management | <ul><li>AddUserToGroup</li><li>CreatePolicy</li><li>CreateUser</li><li>DeleteRole</li><li>DeleteUserPolicy</li><li>UpdateAccessKey</li><li>UpdateUser</li><li>PutGroupPolicy</li><li>PutRolePolicy</li><li>PutUserPolicy</li><li>AttachGroupPolicy</li><li>AttachUserPolicy</li><li>CreatePolicyVersion</li><li>AddUserToGroup</li><li>UpdateLoginProfile</li><li>CreateAccessKey</li><li>AttachRolePolicy</li><li>SetDefaultPolicyVersion</li><li>CreateLoginProfile</li></ul> |
| Key Management Service         | <ul><li>CreateKey</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Lambda                         | <ul><li>UpdateFunctionCode20150331v2</li><li>AddPermission20150331v2</li><li>RemovePermission20150331v2</li></ul>                                                                                                                                                                                                                                                                                                                                                               |
| Relational Database Service    | <ul><li>CreateDBClusterSnapshot</li><li>DeleteDBSubnetGroup</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                           |
| Amazon Redshift                | <ul><li>CreateCluster</li><li>DeleteClusterParameterGroup</li><li>ModifyClusterIamRoles</li></ul>                                                                                                                                                                                                                                                                                                                                                                               |
| S3                             | <ul><li>PutBucketAcl</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Simple Notification Service    | <ul><li>CreateTopic</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Simple Queue Service           | <ul><li>DeleteQueue</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| AWS Certificate Manager        | <ul><li>AddTagsToCertificate</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Managed Message Broker Service | <ul><li>CreateBroker</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| AWS Batch                      | <ul><li>DeleteComputeEnvironment</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Amazon Cognito Identity Pools  | <ul><li>CreateIdentityPool</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| AWS Config                     | <ul><li>DeleteDeliveryChannel</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| AWS Database Migration Service | <ul><li>CreateReplicationInstance</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Amazon DynamoDB                | <ul><li>CreateTable</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| AWS Backup                     | <ul><li>PutBackupVaultAccessPolicy</li><li>DeleteBackupVaultAccessPolicy</li></ul>                                                                                                                                                                                                                                                                                                                                                                                              |
| AWS Organizations              | <ul><li>UpdatePolicy</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| AWS IoT                        | <ul><li>AttachPolicy</li><li>AttachPrincipalPolicy</li><li>DetachPrincipalPolicy</li><li>DetachPolicy</li><li>CreateSecurityProfile</li><li>UpdateSecurityProfile</li><li>DeleteSecurityProfile</li></ul>                                                                                                                                                                                                                                                                       |

## Azure Net Effective Permissions Calculation

When processing Azure Active Directory (AD) groups, a maximum of 1000 group members are allowed. All entities are supported including users, groups, managed identities and service principals.

See [What is Prisma Cloud IAM Security](/content-collections/administration/configure-iam-security/what-is-prisma-cloud-iam-security.md) to learn more about how the IAM Security module works.

The following Azure permission levels are supported:

* Entra ID
* Management Group
* Subscription
* Resources

When you define permissions there are several IAM concepts that you can specify. The IAM Security module currently uses some of these concepts and ignores the following concepts:

* Resource groups
* Multi-tenant access
* Conditions
* Tags

Prisma Cloud requires additional permissions to display the above-mentioned permission levels. If you are new to Prisma Cloud and used a Terraform template for [Azure account onboarding](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/administration/connect/connect-cloud-accounts/connect-azure-account.md) no additional action is required, since the template includes these permissions. If you have already associated Prisma Cloud with your Azure account, you have the option to rerun the Terraform template or manually add the required permissions.

### Enable Access Management for Azure Entra ID

If your Azure deployment uses Azure Entra ID, follow the steps below to enable access:

1. Sign in to the Azure portal as a Global Administrator in Azure AD.
2. Open Microsoft Entra ID (formerly Azure Active Drectory).
3. Select **Manage > Properties**
4. Under **Access management for Azure resources**, set the toggle to Yes.
5. Click **Save**.

### Manually add permissions for Azure Management Groups

If your Azure deployment uses management groups, follow the steps below to manually add the `Microsoft.Management/managementGroups/descendants/read` permission:

1. On your Azure account portal, navigate to the Management group.
2. Select the **Tenant/Root Management Group > Access Control (IAM)**.
3. Assign the above-mentioned permission to your Prisma Account.

### Manually add permissions for Azure Management Groups

If your Azure deployment uses subscriptions, follow the steps below to manually add the `Microsoft.Resources/subscriptions/read` permission:

1. On your Azure account portal, navigate to the Subscription group.
2. Select the Subscription for which you wish to ingest tags.
3. Click on the Access Control (IAM) tab.
4. Assign the above-mentioned permission to your Prisma Account.

You can validate that the permission levels are added by running an IAM Query. Reference [IAM Query Attributes](/content-collections/search-and-investigate/permissions-queries/permissions-query-attributes.md) to view all the Azure permission level attributes.

## GCP Net Effective Permissions Calculation

Prisma Cloud uses GCP entities, service-based policies, and IAM concepts for calculating net effective permissions. If your cloud environment has additional resource types, Prisma Cloud does not factor them into the net-effective permissions.

The list of GCP entities that are used to calculate the net effective permissions are as follows:

| Entities      |                                                                                              |
| ------------- | -------------------------------------------------------------------------------------------- |
| GCP Principal | <ul><li>User account</li><li>Service account</li><li>Group account</li></ul>                 |
| GCP Role      | <ul><li>Basic</li><li>Predefined</li><li>Custom</li></ul>                                    |
| GCP Levels    | <ul><li>Organization</li><li>Folder</li><li>Project</li><li>Service (if supported)</li></ul> |
| GCP Public    | <ul><li>All users</li><li>All authenticated users</li></ul>                                  |

Prisma Cloud leverages GCP **Deny Policies** feature to calculate net effective permissions. **Deny Policies** is a public Beta release on GCP, so **Net effective permissions calculation for denied permissions** will also be a Beta release on Prisma Cloud.

In addition, permissions can also be set by a service-based policy. The following GCP **service-based policies** are supported in the net effective permissions calculation:

| Service-based Policies       |                                                                                                                                    |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| App Engine                   | gcloud-app-engine-application                                                                                                      |
| Big Query                    | <ul><li>gcloud-bigquery-dataset-list</li><li>gcloud-bigquery-table</li></ul>                                                       |
| Cloud Bigtable               | <ul><li>gcloud-bigtable-instance-list</li><li>gcloud-bigtable-table</li></ul>                                                      |
| Cloud Compute                | <ul><li>gcloud-compute-instances-list</li><li>gcloud-compute-image</li><li>gcloud-compute-instance-disk-snapshot</li></ul>         |
| Cloud Functions              | gcloud-cloud-function                                                                                                              |
| Cloud Key Management Service | gcloud-kms-keyring-list                                                                                                            |
| Cloud Run                    | gcloud-cloud-run-services-list                                                                                                     |
| Cloud Spanner                | <ul><li>gcloud-cloud-spanner-database</li><li>gcloud-cloud-spanner-instance</li><li>gcloud-cloud-spanner-instance-backup</li></ul> |
| Cloud Storage                | gcloud-storage-buckets-list                                                                                                        |
| Cloud SQL                    | gcloud-sql-instances-list                                                                                                          |
| Dataproc                     | gcloud-dataproc-clusters-list                                                                                                      |
| Pub/Sub                      | <ul><li>gcloud-pubsub-topic</li><li>gcloud-pubsub-snapshot</li></ul>                                                               |
| Secrets Manager              | gcloud-secretsmanager-secret                                                                                                       |

When you define permissions there are several IAM concepts that you can specify. The IAM Security module currently uses some of these concepts and ignores the following concepts:

* Conditions
* GCP Project Boundaries
* Dynamic Groups
* Level for Permissions in Custom Roles
* Permissions Dependencies
* Google-Managed Service Accounts
* Google Workspace Domain
* Cloud Identity Domain
* Project Viewer
* Project Owner
* Cross-Account Support with Service Accounts
* When processing Groups, a maximum of 1000 members are allowed.
* Group permissions are displayed only if you have:
  * Onboarded your GCP Organization on Prisma Cloud. Projects do not allow you to view group permissions.
  * Added Deny Policies at the folder level.
  * Included the group.read permission in Google Workspace for the Prisma Cloud Service Account.

After the net effective permissions are calculated the actual usage (last access) is matched to determine when write events were actually used. Last access is supported by the majority of write events. Because the last access calculation is based on a 24-hour period for each account, you should wait at least 24 hours to see the updated last access value for any new actions in your account. The following GCP services and events are verified:

| Service | Event Name                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| IAM     | <ul><li>iam.roles.create</li><li>iam.roles.create</li><li>iam.roles.delete</li><li>iam.roles.undelete</li><li>iam.roles.update</li><li>iam.serviceAccountKeys.create</li><li>iam.serviceAccountKeys.delete</li><li>iam.serviceAccounts.create</li><li>iam.serviceAccounts.delete</li><li>iam.serviceAccounts.disable</li><li>iam.serviceAccounts.enable</li><li>iam.serviceAccounts.setIamPolicy</li><li>iam.serviceAccounts.undelete</li><li>iam.serviceAccounts.update</li></ul> |
| Compute | <ul><li>compute.backendServices.setIamPolicy</li><li>compute.disks.removeResourcePolicies</li><li>compute.disks.setIamPolicy</li><li>compute.images.setIamPolicy</li><li>compute.instanceTemplates.setIamPolicy</li><li>compute.instances.removeResourcePolicies</li><li>compute.instances.setIamPolicy</li><li>compute.instances.setServiceAccount</li><li>compute.machineImages.setIamPolicy</li><li>compute.snapshots.setIamPolicy</li></ul>                                    |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/configure-iam-security/context-used-to-calculate-effective-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.