Roles and Permissions

Below is a list of the roles Prisma Cloud DSPM uses to access your AWS environment and the permissions they have. Permissions are used to access different types of data, or perform actions such as creating/deleting virtual machines (VMs), exporting snapshots, etc.

IMPORTANT: If your AWS account has any firewall or network restrictions in place, it is imperative to grant access to the following:

Egress Traffic

In order to allow normal communication between Scanner VMs and the Prisma Cloud DSPM components, as well as various CSP services, make sure the following traffic is permitted:

• Outbound rule:
  • Type: HTTPS (Port 443)
  • Destination: 0.0.0.0/0

Ingress Traffic

Allow incoming traffic from the following Prisma Cloud DSPM's IP addresses to the customer’s cloud environment. This allows for API communication between Prisma Cloud DSPM’s SaaS environments to the customer’s cloud environment:

• EU:
  • 52.48.123.3
  • 99.80.210.235
  • 34.247.249.123
• US:
  • 54.225.205.121
  • 18.214.146.232
  • 3.93.120.3

Standard Deployment Required Permissions

DigSecurityReadOnlyRole

Used as a read-only access to your environment, this role enables Prisma Cloud DSPM to:

• Access your assets’ metadata such as size, name and region
• Collect CloudTrail logs for DDR capabilities

This role is installed on every account monitored by Prisma Cloud DSPM, allowing us to detect and protect your assets. Prisma Cloud DSPM’s own account assumes the DigSecurityReadOnlyRole role with a unique external ID as the best practice security measure.

Permissions

DigSecurityScannerRole

This role is installed on all the scanned (monitored) accounts in your environment, as well as on the DigSecurityReadOnlyRole.  It enables Prisma Cloud DSPM to detect and scan data for analysis and classification. This role can only be assumed by the DigSecurityOrchestratorRole

All sensitive data that is detected, scanned and classified by Prisma Cloud DSPM’s resources never leaves the client's environment.

Permissions

DigSecurityOrchestratorRole

This role is installed on the side account(s) in your AWS environment. It is used to deploy Prisma Cloud DSPM’s compute resources (e.g., EC2s for AWS) for scanning and analyzing the scanned accounts. This role is also in Prisma Cloud DSPM’s computer instances to assume the DigSecurityScannerRole.

Permissions

Custom Network Resources Deployment Required Permissions

DigSecurityReadOnlyRole

Used as a read-only access to your environment, this role enables Prisma Cloud DSPM to:

• Access your assets’ metadata such as size, name and region
• Collect CloudTrail logs for DDR capabilities

This role is installed on every account monitored by Prisma Cloud DSPM, allowing us to detect and protect your assets. Prisma Cloud DSPM’s own account assumes the DigSecurityReadOnlyRole role with a unique external ID as the best practice security measure.

Permissions

DigSecurityScannerRole

This role is installed on all the scanned (monitored) accounts in your environment, as well as on the DigSecurityReadOnlyRole.  It enables Prisma Cloud DSPM to detect and scan data for analysis and classification. This role can only be assumed by the DigSecurityOrchestratorRole

All sensitive data that is detected, scanned and classified by Prisma Cloud DSPM’s resources never leaves the client's environment.

Permissions

DigSecurityOrchestratorRole

This role is installed on the side account(s) in your AWS environment. It is used to deploy Prisma Cloud DSPM’s compute resources (e.g., EC2s for AWS) for scanning and analyzing the scanned accounts. This role is also in Prisma Cloud DSPM’s computer instances to assume the DigSecurityScannerRole.

Permissions

Note: For additional details about the architecture of Prisma Cloud DSPM, please consult with your account team.