Enable IAM Security

Complete the steps below to enable IAM Security in Prisma Cloud.

1. Onboard your AWS, Azure, or GCP accounts, where you manage IAM, to ensure Prisma Cloud can ingest your IAM data. In the case of Azure, this must be an Azure Active Directory tenant.

   • Follow the appropriate onboarding instructions for your cloud environment.

     • AWS: Select the AWS onboarding option that best meets your requirements.
     • Azure: Azure uses Active Directory tenants to manage IAM. Select your Azure onboarding option.
     • GCP: Choose your preferred GCP onboarding option.
   • If you have already onboarded your cloud accounts, you may need to verify that you have granted the Prisma Cloud app/service account the additional permissions required for IAM Security.

     • AWS: No additional permissions are required. The Terraform templates you used to onboard your cloud account include the required permissions.
     • Azure: Verify Azure Application permissions.
     • GCP: Grant permissions for ingesting Google Workspace Groups.

       Verify that you have onboarded with AWS CloudTrail so that you can receive excessive permissions alerts.
2. Enable the IAM Security module.

   1. Select Subscription to see all available options on your Prisma Cloud tenant.
   2. Click Learn More under the IAM Security icon.
   3. Select Start 30 Day Trial, and then click Agree & Submit.

      You can try IAM security for free for 30-days to test out all of the features such as the IAM query, SSO integration, and out-of-the-box IAM policies.
   4. Verify that IAM Security is enabled.

      
3. Investigate with RQL.

   After IAM Security is successfully activated, RQL will be extended to include the userinput:[iam] query. Enter the query for your specific cloud service provider (CSP) below in the Investigate tab to confirm that the iam module has been enabled:

   • AWS: userinput:[config from iam where source.cloud.type = 'AWS' and source.cloud.resource.type = 'user' and source.cloud.resource.name = 'my-user']
   • Azure: userinput:[config from iam where source.cloud.type = 'Azure' and source.cloud.resource.type = 'user' and source.cloud.resource.name = 'my-user']
   • GCP: userinput:[config from iam where source.cloud.type = 'GCP' and source.cloud.resource.type = 'user' and source.cloud.resource.name = 'my-user']

     A green check mark appears in the search field, to indicate that the RQL query is successful and the IAM module is enabled.

     

Grant permissions for Ingesting Google Workspace Groups

Ensure that the following prerequisites are met before you attempt to grant Prisma Cloud the required permissions:

• You must have Administrator access to Google Workspace (GSuite) to grant Prisma Cloud Service Accounts the permissions to ingest data from groups on Google Workspace (GSuite). The permissions required for ingesting data on groups is either the predefined role Group Reader, or a custom role with groups:read permission. Learn more about Google IAM Roles.
• The Cloud Asset API and the Cloud Identity API should be enabled in the project where the Prisma Cloud service account was created.

1. Log in to your Workspace.
2. Create a new custom role or use the predefined Group Reader role.

   

   

   
3. Assign the role to the Prisma Cloud service account.