> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/runtime-security/authentication/access-keys.md).
# Access Keys
Prisma Cloud keys are required to access twistcli and the Compute API. They’re also required to set up the Jenkins plugin.
It’s critical that access keys are provisioned with the minimum permissions required for the job.
Prisma Cloud Enterprise has two major security modules:
* Cloud Security Posture Management (CSPM) — Ensures continuous, correct, and compliant configuration of your resources in the public cloud.
* Cloud Workload Protection Platform (CWPP) — Provides consistent visibility and control for physical machines, virtual machines, containers and serverless workloads, regardless of location, and protects the workloads they run from attacks.
The CSPM module is accessed through Prisma Cloud’s main interface (outer management interface). The CWPP module is accessed through the **Compute** tab (inner management interface, also known as Prisma Cloud Compute, or just Compute). User management, such as integrating single sign-on, setting up custom roles, and creating access keys, is handled by the outer interface.
The RBAC models for the Prisma Cloud outer interface (CSPM) and Prisma Cloud inner interface (CWPP) have different design goals. The CSPM RBAC model controls who has access by cloud accounts. The CWPP RBAC model controls who has access by Compute functionality and views (e.g. who can set and see policy, who can set and see global settings, how to segment views/data, and so on). For example, Assigned Collections let you segment views by namespace.
When you create an access key in Prisma Cloud (outer interface), the system automatically [maps](/content-collections/runtime-security/authentication/user-roles.md) the key to one of the Prisma Cloud Compute roles.
It’s critical that keys created for automated workflows are properly privileged on both sides.
## Scanning in the CI/CD pipeline
When integrating the Jenkins plugin or twistcli into your CI/CD pipeline, configure a key with the CI User role on the Compute side. The scanner authenticates to the Compute Console’s API to assess vulnerability and compliance data. The CI User role is purpose-built for this use case. Its also the least privileged role in the system, with no access to the Console UI.
## Compute API
For other automated workflows, consult the Compute API documentation. The documentation specifies the minimum role required to access each endpoint.
## Provisioning access keys
When provisioning access keys for Compute workflows, first create a user with the appropriate Prisma Cloud role. Then log into Prisma Cloud as the limited user and create an access key.
1. Log into Prisma Cloud with a user that has the System Admin role.
Only System Admins can manage users.
2. Create a very limited role in Prisma Cloud that can’t do anything except log into Prisma Cloud.
It will have read-only permissions with no access to any cloud account. This role will be assigned to your service account.
1. In Prisma Cloud, go to **Settings > Roles**.
2. Click **Add New**.
3. In **Name**, enter an identifier, such as **compute-svc-acct-role**.
4. In **Permissions Group**, select **Account Group Read Only**.
5. Select at least one Account Group.
6. Click **Save**.
3. Create a service account.
1. In Prisma Cloud, go to **Settings > Users**.
2. Click **Add New**.
3. Enter a **First Name**, **Last Name**, and **Email**.
4. In **Assign Role**, select **compute-svc-acct-role**.
5. Select **Allow user to create API Access Keys**
6. Click **Save**.
4. (Optional) Allow your service account to authenticate directly with Prisma Cloud.
If you have integrated Prisma Cloud with a directory service, creating a new user in your underlying auth provider can be tedious in some enterprise environments. Prisma Cloud lets select users authenticate directly with Prisma Cloud using their email and a password that’s registered separately after the user account is created.
1. In Prisma Cloud, go to **Settings > SSO**.
2. Enable **Allow select users to authenticate directly with Prisma Cloud**.
3. In **Users**, select the email address you configured for your service account.
4. Click **Save**.
5. Log out of Prisma Cloud.
6. Log back into Prisma Cloud using your newly created service account.
If you’re bypassing SSO, click **Forgot Password** to set a password.
7. Create an access key for your service account.
1. Go to **Settings > Access Keys**.
2. Click **Add New**.
3. In **Name**, enter **compute-svc-acct-key**.
4. Set the expiration date based on use case.
5. Click **Create**.
6. Save your access key ID and secret key in a safe place.
## Verify your access key
After provisioning your key, you can test that it can access the Compute API. Both the Jenkins plugin and twistcli wrap the API, so hitting the API directly lets you validate that your key has the proper permissions.
The path to the Compute Console API, whether you interface with it directly (e.g. curl) or indirectly (Jenkins, twistcli) is published in Compute Console itself. Get it from **Runtime Security > Manage > System > Utilities**.
1. Get the path to your Console.
1. Go to **Runtime Security > Manage > System > Utilities**.
2. Under **Path to Console**, click **Copy**.
2. Access an endpoint for which your key is authorized.
CI Users have permission to download the twistcli binary from the API, so this is a good test when setting up your CI pipeline. You can authenticate to the API using basic auth. For the username and password, specify the access key ID and secret key respectively. Both of these were generated for you when you first created the key.
```
$ curl -k \
-u
-o twistcli
/api/v1/util/twistcli
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/runtime-security/authentication/access-keys.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.