Manage Roles and Permissions

Learn more about the roles and permissions when Application Security subscription is enabled. To know more about roles and permissions on Prisma Cloud see Prisma Cloud Administrator Permissions

System Administrator

Enable administrative access for all the DevSecOps and Security teams who need to add code repositories or pipelines, create policies and review scan results on Prisma Cloud.

AppSec Administrator

The Application Security practitioner manages application security, and accordingly by default, is granted full system admin permissions to the Cloud Application Security module (CAS). In addition, the AppSec Admin has permissions for Application Security and selected platform permissions such as Alerts.

Other than the specified permissions above, the AppSec Admin authority is restricted to the CAS module, and does not apply to other modules on Prisma Cloud (as opposed to a system admin).

Developer

You do not need to grant access for your developers to log in to the Prisma Cloud administrative console. However, if you would like to enable access, Prisma Cloud includes a predefined developer role with the least privilege permissions to the Prisma Cloud administrative console. The permissions for the developer role include the ability to:

• View scan results (Application Security) for repositories and perform functions to Suppress, Remediate, and Search for a specific Run or view Resource Explorer data.
• View the roles associated with the developer user account. (Settings > Access Control > Roles)
• Create and modify access keys for the developer user account. (Settings > Access Control > Access Key)
• View their own user profile
• Designated repos only for Repositories (Projects)
• Designated repos only for SBOM (SBOM)

1. Select Settings > Access Control > Add > User.

   Create a new Developer access role for Application Security on Prisma Cloud.

   

   You can assign the new role with developer access to a new or existing Prisma Cloud user.
2. Select Save and close.

   Optionally, you can choose to Save and add another to add another role or Cancel the current changes.

Add a Custom Permission Group

Administrators can create a custom permission group for Application Security on the Prisma Cloud console. Using the parameters for permissions, you can limit or enhance the responsibilities of the users.

• Code & Build Providers: You can enable user permissions to view, create, update and delete resources on Code & Build Providers. Configuring View permissions for all Application Security functions, ensures the ability to see resource vulnerabilities and make informed decisions.

  You are required to select both Create and Update permissions when onboarding new repositories.
• Code Security Configuration: Enabling permissions for Application Security Configuration helps you manage Application Security licenses, Enforcement thresholds, notifications, developer suppressions and creating rules to exclude paths for scans.

For further details see, Create Custom Prisma Cloud Groups.

Application Security currently supports Custom Permissions only for licensing types of IaC Security, Secrets Scanning and SCA Security.

View Audit Logs

Audit Logs record administrator activities on the console to help you proactively track configuration actions that impact security outcomes such as modifying Enforcement parameters and adding suppression rules which impact the scan results, or actions on Code & Build Providers , like adding, deleting or updating the repository selection, which what is being scanned and monitored using Prisma Cloud.

For further details on managing audit logs, see View Audit Logs.