> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/search-and-investigate/permissions-queries/permissions-query-attributes.md). # Permissions Query Attributes Learn about permissions query attributes. Review your options when using `config from iam where`. Each attribute allows you to narrow your search criteria. As you use these attributes, the auto-suggestion feature shows the available expressions and the operators that are applicable for each attribute. * **Source**—an identity that takes action on other cloud resources. A source can be any resource with permissions such as an AWS IAM Role, IAM user, Azure Active Directory user, EC2 instance, Lambda function, and Azure virtual machine. * **Destination**—any cloud resource on which an action has occurred on or is the target of the action. * **Granter**—the group, role, or policy that grants permissions to the source to interact with the destination. For example, an IAM user (source) who can add an entry to a DynamoDB table (destination) using the AWS managed policy of the group (granter entity) to which the user belongs. You can use the following attributes in the permissions query: * **source.cloud.account** Narrows down the effective permissions search to one-or-more cloud accounts that you have connected to Prisma Cloud. The following example lists all the effective permissions for all users in your AWS account, Azure tenant, or GCP account. ``` config from iam where source.cloud.account = 'Production' AND source.cloud.resource.type = 'user' ``` Use the following to find cross-account connection: ``` config from iam where source.cloud.account != dest.cloud.account ``` * **source.cloud.account.isvendor** This query retrieves all permissions granted to known vendors in the environment. ``` config from iam where source.cloud.account.isvendor = true ``` The following sample query retrieves all vendor accounts that do not start with Red. ``` config from iam where source.cloud.account DOES NOT START WITH 'Red' and source.cloud.account.isvendor = true ``` * **source.cloud.accountgroup** Narrows down the permissions to the cloud accounts in your cloud account group. The following example list permissions of all EC2 instances in any of your AWS accounts: ``` config from iam where source.cloud.accountgroup = 'All my AWS accounts' AND source.cloud.service.name = 'ec2' AND source.cloud.resource.type = 'instance' ``` Lists permissions of all Azure virtual machine instances in any of your Azure subscriptions: ``` config from iam where source.cloud.accountgroup = 'All my Azure accounts' AND source.cloud.service.name = 'Microsoft.Compute' AND source.cloud.resource.type = 'virtualMachines' ``` * **source.cloud.azure.user.isAppRegistrationOwner** Identifies user accounts that owns an Entra ID service account with the permission to add members to a group with admin privileges at the subscription/management group level: ``` config from iam where source.cloud.type = 'AZURE' AND source.cloud.azure.user.isAppRegistrationOwner = true AND grantedby.cloud.entity.type = 'Service Principal' AND dest.cloud.azure.group.isadministrative.grantedby.level.type in (('AppRoleAssignment.ReadWrite.AllRole', 'Management.ReadWrite.Directory'), ('Azure Management Group', 'Azure Subscription' ) ) ``` * **source.cloud.azure.user.isAppRegistrationAdmin** Identifies user accounts Entra ID service account administration privileges including permission to add members to a group with admin privileges at the subscription/management group level: ``` config from iam where source.cloud.type = 'AZURE' AND source.cloud.azure.user.isAppRegistrationAdmin = true AND grantedby.cloud.entity.type = 'Service Principal' AND dest.cloud.azure.group.isadministrative.grantedby.level.type in (('AppRoleAssignment.ReadWrite.AllRole', 'Management.ReadWrite.Directory'), ('Azure Management Group', 'Azure Subscription' ) ) ``` * **source.cloud.azure.user.canImpersonateAppReg** Identifies Entra ID users that can impersonate an Entra ID application with the permission to add members to a group with admin privileges at the subscription/management group level: ``` config from iam where source.cloud.type = 'AZURE' AND source.cloud.azure.user.canImpersonateAppReg = true AND grantedby.cloud.entity.type = 'Service Principal' AND dest.cloud.azure.group.isadministrative.grantedby.level.type in (('AppRoleAssignment.ReadWrite.AllRole', 'Management.ReadWrite.Directory'), ('Azure Management Group', 'Azure Subscription' ) ) ``` * **source.cloud.azure.servicePrincipal.has.machineAttached** Identifies Virtual Machines assigned with `System Managed Identity` or `User Managed Identity` and Azure Active Directory permissions: ``` config from iam where source.cloud.type = 'AZURE' AND source.cloud.service.name = 'Microsoft.Compute' and source.cloud.resource.type ='virtualMachines' AND action.name IN ('GroupMember.ReadWrite.All', 'RoleManagement.ReadWrite.Directory', 'AppRoleAssignment.ReadWrite.All', 'RoleManagement.ReadWrite.Directory', 'RoleManagement.ReadWrite.Directory') ``` * **source.cloud.azure.servicePrincipal.isGraphAdmin** Identifies user/system managed identities connected to a Virtual Machine or any other Compute resource with the permission to create credentials for a registered application with Microsoft Graph API permissions: ``` config from iam where source.cloud.type = 'AZURE' AND source.cloud.service.name = 'Microsoft.Compute' and source.cloud.resource.type ='virtualMachines' and grantedby.cloud.entity.type = 'AppRegistration' and grantedby.cloud.policy.type = 'Microsoft Graph' and action.name in ('Files.Read.All', 'Files.ReadWrite.All','Sites.Read.All','Sites.ReadWrite.All','Sites.FullControl.All','Sites.Selected','Mail.ReadWrite','Mail.Read') ``` * **source.cloud.type** Narrows down your search option to specific clouds. The following example lists all effective permissions where the sources are in your AWS cloud accounts: ``` config from iam where source.cloud.type = 'AWS' ``` Lists all effective permissions where the sources are in your Azure subscriptions: ``` config from iam where source.cloud.type = 'AZURE' ``` * **source.cloud.region** Narrows down your effective permissions search where the sources are in one or more cloud regions. The following example lists all AWS Lambda permissions for your AWS account in the Virginia region: ``` config from iam where source.cloud.region = 'AWS Virginia' AND source.cloud.service.name = 'lambda' AND source.cloud.resource.type = 'function' ``` * **source.cloud.resource.tag** Lists the effective permissions for a cloud resource with a specific tag. ``` config from iam where source.cloud.resource.tag ( 'string' ) exists ``` * **source.cloud.service.name** Queries permissions of a specific cloud service such as: IAM, S3, EC2, `Microsoft.Compute`, or `Microsoft.Storage`. The following example lists all EC2 permissions in your AWS cloud accounts: ``` config from iam where source.cloud.service.name = 'EC2' ``` The following example lists all `Microsoft.Compute` permissions in your Azure cloud accounts: ``` config from iam where source.cloud.service.name = 'Microsoft.Compute' ``` * **source.cloud.resource.id** Queries specific cloud resources by its id, such as AWS Lambda function ARN, AWS IAM user ARN, AWS EC2 instance ARN, any Azure resource ID, GCP user account or service. The following example lists all AWS Lambda function permissions: ``` config from iam where source.cloud.resource.id = 'arn:aws:lambda:us-east-2:123456789012:function:my-function' ``` The following lists permissions of a specific Azure virtual machine : ``` config from iam where source.cloud.resource.id = '/subscriptions/aaaaa-bbb-ccc-ddd-eeeee/resourceGroups/resource-group/providers/Microsoft.Compute/virtualMachines/my-machine' ``` * **source.cloud.resource.name** Lists permissions permissions of a specific cloud service such as: IAM, S3, EC2, Microsoft.Compute, or Microsoft.Storage. Lists all EC2 permissions in your AWS cloud accounts: ``` config from iam where source.cloud.service.name = 'EC2' ``` Lists all Microsoft.Compute permissions in your Azure cloud accounts: ``` config from iam where source.cloud.service.name = 'Microsoft.Compute' ``` Lists GCP compute instances permissions: ``` config from iam where source.cloud.service.name = 'compute' and dest.cloud.type = 'GCP' ``` * **source.cloud.resource.type** Queries permissions of a specific cloud type such as an IAM user, S3 bucket, EC2 instance, Azure AD user, `Microsoft.Storage` storage account, `Microsoft.compute` virtual machine, GCP Workspace user. The following example lists all AWS Lambda function permissions: ``` config from iam where source.cloud.service.name = 'lambda' AND source.cloud.resource.type = 'function' ``` The following example lists all Azure function permissions: ``` config from iam where source.cloud.service.name = 'Microsoft.Compute' and source.cloud.resource.type = 'function' ``` * **source.email** Queries permissions of a user by its email address. The following example lists all effective permissions of : ``` config from iam where source.email = 'my@email.com' ``` This feature requires IdP integration. * **source.idp.service** Narrows down the effective permissions search where the sources are in an IdP service, such as Okta. The following example lists all effective permissions of Okta users: ``` config from iam where source.idp.service = 'Okta' ``` This feature requires IdP integration. The following example lists all effective permissions of Azure AD users: ``` config from iam where source.idp.service = 'Azure Active Directory' ``` * **source.idp.email** Narrows down effective permissions search where the source is an IdP user by its email address. The following example lists all effective permissions of Okta users with the email, : ``` config from iam where source.idp.email = 'my@email.com' ``` This feature requires IdP integration. * **source.idp.group** Narrows down the effective permissions search where the source is a group defined within the IdP: ``` config from iam where source.idp.group = 'my-group' ``` This feature requires IdP integration. * **source.idp.username** List the effective permissions for a specific user within a source IdP: ``` config from iam where source.idp.username = 'my-username' ``` This feature requires IdP integration. * **source.idp.domain** Narrows down the effective permissions search where the source is an IdP user in a specific domain, such as my-domain.okta.com. ``` config from iam where source.idp.domain = 'my-domain.okta.com' ``` This feature requires IdP integration. * **source.MFAenabled** Identifies users without MFA enabled. The query returns True/False values (whether MFA is active/inactive). ``` config from iam where source.MFAenabled = true ``` * **source.public** Queries all S3 buckets that are publicly accessible. All GCP public resources with `allUsersuserinput` and/or `allAuthenticatedUsers` Principals. This attribute is supported for AWS and GCP only. ``` config from iam where source.public = true AND dest.cloud.service.name = 'S3' AND dest.cloud.resource.type = 'bucket' ``` * **grantedby.cloud.condition** Queries permissions where the policy statement contain and or doesn’t contain conditions. ``` config from iam where grantedby.cloud.policy.condition ('aws:sourceIP', 'IpAddress') exists ``` * **grantedby.cloud.type** Narrows down your search option to specific clouds. The following example lists effective permissions where the granter such as group, role, or policy is in your AWS cloud accounts: ``` config from iam where grantedby.cloud.type = 'AWS' ``` The following lists effective permissions in your Azure cloud accounts: ``` config from iam where grantedby.cloud.type = 'AZURE' ``` * **grantedby.cloud.policy.id** Queries permissions that have been granted by a specific policy by its id, such as AWS Managed Policy ARN, AWS Custom Policy, or GCP role ID. The following example lists effective permissions that have been granted by the AWS Managed Policy `AdministratorAccess`: ``` config from iam where grantedby.cloud.policy.id = 'arn:aws:iam::aws:policy/AdministratorAccess' ``` * **grantedby.cloud.policy.isExcessive** Identifies excessive access in IAM policies (AWS IAM Policies/Azure Roles/GCP Roles) when including “\*” in the action or scope sections. * **grantedby.cloud.policy.name** Queries permissions that have been granted by a specific policy such as AWS Managed Policy, AWS Inline Policy, or GCP role name. The following example lists all effective permissions that have been granted by the AWS Managed Policy `AdministratorAccess`: ``` config from iam where grantedby.cloud.policy.name = 'AdministratorAccess' ``` * **grantedby.cloud.policy.type** Queries permissions that have been granted by a specific policy type, such as AWS Managed Policy, AWS Customer Policy, AWS Inline Policy, Azure built-in role, Azure custom role, GCP basic role, GCP custom role, or GCP predefined role. The following example lists all effective permissions that have been granted to a user by any AWS Inline Policy: ``` config from iam where source.cloud.resource.type = 'user' AND grantedby.cloud.policy.type = 'Inline Policy' ``` The following example lists all effective permissions that have been granted to a user by any Azure built-in role: ``` config from iam where source.cloud.resource.type = 'user' AND grantedby.cloud.policy.type = 'Built-in Role' ``` * **grantedby.cloud.entity.id** Queries permissions that have been granted by a specific entity by its id, such as AWS IAM group ARN, AWS IAM role ARN, GCP group ID, or GCP service account ID. The following example lists all effective permissions that have been granted by the AWS IAM group, my-group: ``` config from iam where grantedby.cloud.entity.id = 'arn:aws:iam::123456789012:group/my-group' ``` * **grantedby.cloud.entity.name** Queries permissions that have been granted by a specific entity, such as AWS IAM group, AWS IAM role, GCP group name, or GCP service account name. The following example lists all effective permissions that have been granted by the AWS IAM group, my-group: ``` config from iam where grantedby.cloud.entity.name = 'my-group' ``` * **grantedby.cloud.entity.type** Queries permissions that have been granted by a specific entity type, such as AWS IAM group, AWS IAM role, GCP group, or GCP service account. The following example lists all effective permissions that have been granted to a user by any AWS IAM group: ``` config from iam where source.cloud.resource.type = 'user' AND grantedby.cloud.entity.type = 'group' ``` * **grantedby.level.id** Identifies the group role or policy by level id that grants permissions to the source to interact with the destination. For instance, roles with access to GCP organization/Folder/Project/Service ID. * **grantedby.level.name** Narrows down your effective permissions search to a group role or policy level name. For instance, roles with access to GCP organization/Folder/Project/Service name. * **grantedby.level.type** Queries permissions granted by a specific policy level type. For instance, roles with access to GCP organization, folder, project or service. * **grantedby.cloud.policy.tag** Queries permissions granted by a specific policy such as AWS Managed or Inline policy, or GCP role name with a specific tag. The following example lists all effective permissions that have been granted by the AWS policies, with the tag Severity equals High: ``` config from iam where grantedby.cloud.policy.tag ( 'Severity' ) = 'High' ``` * **grantedby.cloud.entity.tag** Queries permissions granted by a specific entity, such as AWS IAM group or role, GCP group or service account name with a specific tag. For example, the following example lists all the effective permissions granted by AWS entities, with the tag Severity equals High. ``` config from iam where grantedby.cloud.entity.tag ( 'Severity' ) = 'High' ``` * **grantedby.level.id** Identifies permissions granted by specific level ID. For example: * Azure: Groups with access to Azure management group/Subscriptions/Resources. * GCP: Users with access to GCP organization/Folder/Project/Service. * **grantedby.level.name** Identifies permissions granted by specific level name. For example: * Azure: Groups with access to Azure management group/Subscriptions/Resources. * GCP: Users with access to GCP organization/Folder/Project/Service. * **grantedby.level.type** Queries permissions granted to a specific level type. For example: * Azure: Groups with access to Azure management group/Subscriptions/Resources. * GCP: Users with access to GCP organization/Folder/Project/Service. * **dest.cloud.account** Narrows down your effective permissions search to one or more cloud accounts that you have connected to Prisma Cloud. The following example lists all effective permissions to all buckets in your AWS Production account: ``` config from iam where dest.cloud.account = 'Production' AND dest.cloud.resouce.type = 'bucket' ``` Used the following to find cross-account connection: ``` config from iam where dest.cloud.account != source.cloud.account ``` The following example uses the `LIKE` operator to display results where IAM permissions have been granted on the cloud service provider using the wildcard (\*) character to authorize access: ``` config from iam where dest.cloud.account LIKE 'account-dev-3' ``` If you use the `=` operator in the RQL query above, instead of the LIKE operator, you will view results for only cloud account named `account-dev-3` . * **dest.cloud.accountgroup** Narrows down the permissions to the cloud accounts in your cloud account group. The following example lists permissions to all EC2 instances in any of your AWS accounts: ``` config from iam where dest.cloud.accountgroup = 'All my AWS accounts' AND dest.cloud.service.name = 'ec2' AND dest.cloud.resource.type = 'instance' ``` * **dest.cloud.type** Narrows down your search option to specific clouds. The following example lists all effective permissions where the destinations are in your AWS cloud accounts: ``` config from iam where dest.cloud.type = 'AWS' ``` * **dest.cloud.region** Narrows down effective permissions search where the destinations are in one or more cloud regions. The following example lists all effective permissions to AWS Lambda in your AWS account in the Virginia region: ``` config from iam where dest.cloud.region = 'AWS Virginia' AND dest.cloud.service.name = 'lambda' AND dest.cloud.resource.type = 'function' ``` * **dest.cloud.service.name** Queries permissions to a specific cloud service such as IAM, S3, or EC2. The following example lists permissions to all EC2 instances in any of your AWS accounts: ``` config from iam where dest.cloud.service.name = 'EC2' ``` * **dest.cloud.resource.name** Queries permissions to a specific cloud service such as AWS Lambda function, AWS IAM user, and AWS EC2 instance. The following example lists all effective permissions to the AWS Lambda function: ``` config from iam where dest.cloud.service.name = 'lambda' AND dest.cloud.resource.type = 'function' AND dest.cloud.resource.name = 'my-function' ``` * **dest.cloud.resource.id** Queries permissions to a specific cloud resource by its ID, such as AWS Lambda function ARN, AWS IAM user ARN, and AWS EC2 instance ARN. The following example lists all effective permissions to the AWS Lambda function: ``` config from iam where dest.cloud.resource.id = 'arn:aws:lambda:us-east-2:123456789012:function:my-function' ``` * **dest.cloud.resource.type** Queries permissions to a specific cloud type such as an IAM user, S3 bucket, or EC2 instance. The following example lists all effective permissions to the AWS Lambda functions: ``` config from iam where dest.cloud.service.name = 'lambda' AND dest.cloud.resource.type = 'function' ``` * **dest.cloud.resource.tag** Lists the effective permissions for a cloud resource destination with a specific resource tag. ``` config from iam where dest.cloud.resource.tag ( 'string' ) exists ``` * **dest.cloud.wildcardscope** Queries all non-specific resources that include wildcards for example, resources that equal or include “\*”. ``` config from iam where action.name CONTAINS ALL ( 'ec2:RunInstances', 'ec2:DescribeInstances', 'lambda:InvokeFunction' ) and dest.cloud.wildcardscope = true ``` * **action.name** Narrows down the effective permissions search to one or more action names. The following example lists all the effective permissions to get an object from an AWS S3 Bucket: ``` config from iam where dest.cloud.service.name = 's3' AND dest.cloud.resource.type = 'bucket' AND action.name = 'S3:GetObject' ``` Only the CONTAINS ALL operator is supported for this attribute. With this operator, you can run queries with AND logic in between values. For example, you would run the following query if you want to retrieve only roles that contain all actions X, Y and Z: ``` config from iam where action.name CONTAINS ALL ( 'Microsoft.AgFoodPlatform/farmBeats/seasons/write', 'Microsoft.AgFoodPlatform/fields/delete' ) ``` * **action.lastaccess.days** Displays when a specific permission was actually last used. The following example lists all the effective permissions to get an object from an AWS S3 bucket that was not used more than 90 days ago. ``` config from iam where dest.cloud.service.name = 's3' AND dest.cloud.resource.type = 'bucket' AND action.name = 'S3:GetObject' and action.lastaccess.days > 90` ``` * Last access information is only logged for successful access. If the operation failed, for example due to lack of permissions, then the access information is not logged. * The number of results displayed for last access destinations is limited to the latest 100 results for a permission. * **action.access.level** Displays the access level at which a resource was last accessed. Access level values are limited to the following: * Data Write * Data Read * Metadata Write * Metadata Read Sample RQL: ``` config from iam where source.cloud.type = 'AWS' and source.cloud.resource.type = 'user' and action.access.level = 'Data Read' and dest.cloud.service.name = 's3' ``` * **action.access.isAdministrative** Identifies if a resource was accessed with Administrative rights. Sample RQL: ``` config from iam where source.cloud.type = 'AWS' and source.cloud.resource.type = 'user' and action.access.isadministrative = true ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/search-and-investigate/permissions-queries/permissions-query-attributes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.