Prisma Cloud Administrator’s Guide (Compute)
    : Permissions by feature
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Administrator’s Guide (Compute)
    5. Configure
    6. Permissions by feature
    Download PDF

    Prisma Cloud Administrator’s Guide (Compute)

    Permissions by feature

    Table of Contents

    Permissions by feature

    When you set up Prisma Cloud Compute to secure your cloud workloads, you’ll need to ensure you’ve granted Prisma Cloud the right permissions. The following tables list the permissions required for each of Compute’s protection capabilities.
    You can review the permissions needed for agentless scanning in each cloud service provider:

    AWS

    The following table shows the required permissions needed if you are using AWS. You can also review the permissions needed for agentless scanning in AWS.
    Capability
    Feature
    Permissions
    Role/Policy
    Condition
    Workload Discovery
    Workload Discovery
    Serverless Radar
    cloudwatch:DescribeAlarms
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    iam:GetPolicyVersion
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    iam:GetRole
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    iam:GetPolicy
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    iam:GetRolePolicy
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    iam:ListRolePolicies
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    iam:ListAttachedRolePolicies
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    lambda:ListFunctions
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    lambda:GetFunction
    PrismaCloud-ReadOnly-Policy-Compute
    Workload Discovery
    Serverless Radar
    lambda:ListAliases
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    lambda:ListEventSourceMappings
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    lambda:GetPolicy
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    kms:Decrypt
    PrismaCloud-ReadOnly-Policy-Compute
    Workload Discovery
    Serverless Radar
    logs:DescribeSubscriptionFilters
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    s3:GetBucketNotification
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    elasticloadbalancing:DescribeListeners
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    elasticloadbalancing:DescribeTargetGroups
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    elasticloadbalancing:DescribeListenerCertificates
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    elasticloadbalancing:DescribeRules
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    cloudfront:ListDistributions
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    events:ListRules
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    Serverless Radar
    apigateway:GET
    arn:aws:iam::aws:policy/SecurityAudit
    Workload Discovery
    VM Tags Discovery
    ec2:DescribeTags
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Agent-Based Workload Scan
    Registry Scanning
    ecr:GetAuthorizationToken
    PrismaCloud-ReadOnly-Policy-Compute
    Agent-Based Workload Scan
    Registry Scanning
    ecr:BatchCheckLayerAvailability
    PrismaCloud-ReadOnly-Policy-Compute
    Agent-Based Workload Scan
    Registry Scanning
    ecr:GetDownloadUrlForLayer
    PrismaCloud-ReadOnly-Policy-Compute
    Agent-Based Workload Scan
    Registry Scanning
    ecr:GetRepositoryPolicy
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Registry Scanning
    ecr:DescribeRepositories
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Registry Scanning
    ecr:ListImages
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Registry Scanning
    ecr:DescribeImages
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Registry Scanning
    ecr:BatchGetImage
    PrismaCloud-ReadOnly-Policy-Compute
    Agent-Based Workload Scan
    Registry Scanning
    ecr:GetLifecyclePolicy
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Registry Scanning
    ecr:GetLifecyclePolicyPreview
    PrismaCloud-ReadOnly-Policy-Compute
    Agent-Based Workload Scan
    Registry Scanning
    ecr:ListTagsForResource
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Registry Scanning
    ecr:DescribeImageScanFindings
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Serverless Auto Defend
    lambda:PublishLayerVersion
    PrismaCloud-Remediation-Compute-Policy-ServerlessAutoDefend
    Agent-Based Workload Scan
    Serverless Auto Defend
    lambda:UpdateFunctionConfiguration
    PrismaCloud-IAM-Remediation-Policy
    Agent-Based Workload Scan
    Serverless Auto Defend
    lambda:GetLayerVersion
    PrismaCloud-ReadOnly-Policy-Compute
    Agent-Based Workload Scan
    Serverless Auto Defend
    lambda:GetFunctionConfiguration
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Serverless Auto Defend
    iam:SimulatePrincipalPolicy
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Serverless Auto Defend
    lambda:GetFunction
    PrismaCloud-ReadOnly-Policy-Compute
    Agent-Based Workload Scan
    Serverless Auto Defend
    lambda:ListFunctions
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Serverless Auto Defend
    iam:GetPolicyVersion
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Serverless Auto Defend
    iam:GetRole
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Serverless Auto Defend
    iam:ListRolePolicies
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Serverless Auto Defend
    iam:ListAttachedRolePolicies
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Serverless Auto Defend
    iam:GetRolePolicy
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Serverless Auto Defend
    iam:GetPolicy
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Serverless Auto Defend
    lambda:ListLayerVersions
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Serverless Auto Defend
    lambda:ListLayers
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Serverless Auto Defend
    lambda:DeleteLayerVersion
    PrismaCloud-Remediation-Compute-Policy-ServerlessAutoDefend
    Agent-Based Workload Scan
    Serverless Auto Defend
    kms:Decrypt
    PrismaCloud-ReadOnly-Policy-Compute
    Agent-Based Workload Scan
    Serverless Auto Defend
    kms:Encrypt
    PrismaCloud-Remediation-Compute-Policy-AgentlessScanning
    Agent-Based Workload Scan
    Serverless Auto Defend
    kms:CreateGrant
    PrismaCloud-Remediation-Compute-Policy-AgentlessScanning
    Agent-Based Workload Scan
    VM Images Scan
    ec2:CreateSecurityGroup
    PrismaCloud-Remediation-Compute-Policy-AMIScan
    Agent-Based Workload Scan
    VM Images Scan
    ec2:DescribeSecurityGroups
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    VM Images Scan
    ec2:RevokeSecurityGroupEgress
    PrismaCloud-Remediation-Compute-Policy-AMIScan
    Agent-Based Workload Scan
    VM Images Scan
    ec2:AuthorizeSecurityGroupIngress
    PrismaCloud-Remediation-Compute-Policy-AMIScan
    Agent-Based Workload Scan
    VM Images Scan
    ec2:DeleteSecurityGroup
    PrismaCloud-Remediation-Compute-Policy-AMIScan
    Agent-Based Workload Scan
    VM Images Scan
    ec2:RunInstances
    PrismaCloud-Remediation-Compute-Policy-AMIScan
    Agent-Based Workload Scan
    VM Images Scan
    ec2:DescribeInstances
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    VM Images Scan
    ec2:TerminateInstances
    PrismaCloud-Remediation-Compute-Policy-AMIScan
    Agent-Based Workload Scan
    VM Images Scan
    ec2:DescribeImages
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    VM Images Scan
    ec2:CreateTags
    PrismaCloud-Remediation-Compute-Policy-AMIScan
    Agent-Based Workload Scan
    VM Images Scan
    ec2:AuthorizeSecurityGroupEgress
    PrismaCloud-Remediation-Compute-Policy-AMIScan
    Agent-Based Workload Scan
    VM Images Scan
    ec2:DescribeSubnets
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    VM Images Scan
    ec2:DescribeVpcs
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    VM Images Scan
    ec2:DescribeInstanceTypeOfferings
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Host Auto-Defend
    ec2:DescribeImages
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Host Auto-Defend
    ec2:DescribeInstances
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Host Auto-Defend
    ssm:SendCommand
    PrismaCloud-Remediation-Compute-Policy-HostAutoDefend
    Agent-Based Workload Scan
    Host Auto-Defend
    ssm:DescribeInstanceInformation
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Host Auto-Defend
    ssm:ListCommandInvocations
    PrismaCloud-Remediation-Compute-Policy-HostAutoDefend
    Agent-Based Workload Scan
    Host Auto-Defend
    ssm:CancelCommand
    PrismaCloud-Remediation-Compute-Policy-HostAutoDefend
    Agent-Based Workload Scan
    Host Auto-Defend
    ssm:CreateAssociation
    PrismaCloud-Remediation-Compute-Policy-HostAutoDefend
    Agent-Based Workload Scan
    Host Auto-Defend
    ec2:DescribeRegions
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Host Auto-Defend
    ec2:DescribeTags
    arn:aws:iam::aws:policy/SecurityAudit
    Agent-Based Workload Scan
    Secrets Manager
    Agent-Based Workload Scan
    Alert Provider
    securityhub:BatchImportFindings
    PrismaCloud-ReadOnly-Policy-Compute
    Serverless Function Scanning
    Serverless Function Scanning
    lambda:ListFunctions
    arn:aws:iam::aws:policy/SecurityAudit
    Serverless Function Scanning
    lambda:GetFunction
    PrismaCloud-ReadOnly-Policy-Compute
    Serverless Function Scanning
    iam:GetPolicy
    arn:aws:iam::aws:policy/SecurityAudit
    Serverless Function Scanning
    iam:GetPolicyVersion
    arn:aws:iam::aws:policy/SecurityAudit
    Serverless Function Scanning
    iam:GetRole
    arn:aws:iam::aws:policy/SecurityAudit
    Serverless Function Scanning
    iam:GetRolePolicy
    arn:aws:iam::aws:policy/SecurityAudit
    Serverless Function Scanning
    iam:ListAttachedRolePolicies
    arn:aws:iam::aws:policy/SecurityAudit
    Serverless Function Scanning
    iam:ListRolePolicies
    arn:aws:iam::aws:policy/SecurityAudit
    Serverless Function Scanning
    lambda:GetLayerVersion
    PrismaCloud-ReadOnly-Policy-Compute
    Serverless Function Scanning
    kms:Decrypt
    PrismaCloud-ReadOnly-Policy-Compute
    Serverless Function Scanning
    ec2:DescribeTags
    arn:aws:iam::aws:policy/SecurityAudit
    Serverless Function Scanning

    Agentless Permissions

    The following table shows the required permissions, conditions, and resources for agentless scanning.
    Permission
    Same Account
    Hub Account
    Target Account
    Condition
    Resource
    Purpose
    Mandatory
    Removal Effect
    ec2:CreateSnapshots
    Yes
    No
    Yes
    -
    *
    Create snapshots of hosts to be scanned by the scanner instance
    Yes
    ec2:CreateSnapshot
    Yes
    No
    Yes
    -
    *
    Create snapshot of hosts to be scanned by the scanner instance
    Yes
    ec2:DeleteSnapshot
    Yes
    No
    Yes
    "ec2:ResourceTag/created-by": "prismacloud-agentless-scan"
    *
    Delete snapshot of hosts that were created during the scan process
    Yes
    ec2:TerminateInstances
    Yes
    Yes
    No
    "ec2:ResourceTag/created-by": "prismacloud-agentless-scan"
    *
    Terminate scanner instance
    Yes
    ec2:DescribeVolumes
    Yes
    No
    Yes
    -
    *
    Discovering volumes to scan
    Yes
    ec2:DescribeInstances
    Yes
    Yes
    Yes
    -
    *
    Discovering instances to scan
    Yes
    ec2:DescribeSnapshots
    Yes
    No
    Yes
    -
    *
    Acquire snapshot status to allow deploying the scanner only when all snapshots up and running
    Yes
    ec2:RunInstances
    Yes
    Yes
    No
    -
    *
    Run the scanner instance
    Yes
    ec2:DescribeInstanceStatus
    Yes
    Yes
    No
    -
    *
    Track scanner instance status
    Yes
    ec2:DescribeSubnets
    Yes
    Yes
    No
    -
    *
    Validate subnet status - ensure subnet exists
    Yes
    ec2:DescribeSecurityGroups
    Yes
    Yes
    No
    -
    *
    Validate security group status - ensure security group exists
    Yes
    ec2:CreateTags
    Yes
    Yes
    No
    "aws:RequestTag/created-by": "prismacloud-agentless-scan"
    "arn:aws:ec2:*:*:instance/
    " "arn:aws:ec2:
    :*:volume/*"
    Tag PCC resources created during the scan process
    Yes
    ec2:CreateTags
    Yes
    No
    Yes
    "aws:RequestTag/created-by": "prismacloud-agentless-scan"
    "arn:aws:ec2:*::snapshot/*"
    Tag PCC resources created during the scan process
    Yes
    ec2:DescribeInstanceTypes
    Yes
    No
    Yes
    -
    *
    Get available VM types on the region for grouping
    Yes
    sts:DecodeAuthorizationMessage
    Yes
    Yes
    Yes
    -
    *
    Decode UnauthorizedOperation response from the AWS API
    Yes
    ssm:GetParameters
    Yes
    Yes
    No
    -
    *
    Discover the scanner AMI
    Yes
    ec2:DescribeImages
    Yes
    No
    Yes
    -
    *
    Disocver specifc AMIs metadata
    Yes
    sts:GetCallerIdentity
    Yes
    Yes
    Yes
    -
    *
    Get metadata about the account (e.g., check for disabled regions, ec2 instances metadata)
    Yes
    iam:SimulatePrincipalPolicy
    Yes
    Yes
    Yes
    -
    *
    Validate the effective permissions granted to the Prisma Cloud role
    Yes
    iam:CreateServiceLinkedRole
    Yes
    Yes
    No
    "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/*"
    "iam:AWSServiceName": "spot.amazonaws.com"
    Create a linked service role for spot instance request
    Yes
    ec2:DescribeVPCs
    Yes
    Yes
    No
    -
    *
    Discover the VPC to be used by the scanner instance
    Yes
    account:GetRegionOptStatus
    Yes
    Yes
    Yes
    -
    *
    Discover regions statuses
    Yes
    ec2:DescribeNetworkInterfaces
    Yes
    Yes
    No
    -
    *
    Discover the network interfaces to be used by the scanner instance
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:DeleteNetworkInterface
    Yes
    Yes
    No
    -
    *
    Delete the network interface used by the scanner instance. Network interface is untaggable since it is created implicitly as part of instance creation. This permission only applies to detached network interfaces, so the scope effect is minimal
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:CreateTags
    Yes
    Yes
    No
    "aws:RequestTag/created-by": "prismacloud-agentless-scan"
    "arn:aws:ec2:*:*:vpc/
    " "arn:aws:ec2:
    :*:subnet/
    " "arn:aws:ec2:
    :*:internet-gateway/*"
    Tag PCC resources created during the scan process
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:CreateVpc
    Yes
    Yes
    No
    "aws:RequestTag/created-by": "prismacloud-agentless-scan"
    *
    Create scanner instance VPC
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:CreateInternetGateway
    Yes
    Yes
    No
    "aws:RequestTag/created-by": "prismacloud-agentless-scan"
    *
    Create scanner instance internet gateway
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:CreateSubnet
    Yes
    Yes
    No
    "aws:RequestTag/created-by": "prismacloud-agentless-scan"
    *
    Create scanner instance subnet
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:CreateSubnet
    Yes
    Yes
    No
    "ec2:ResourceTag/created-by": "prismacloud-agentless-scan"
    *
    Attach the scanner subnet to the VPC
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:DeleteSubnet
    Yes
    Yes
    No
    "ec2:ResourceTag/created-by": "prismacloud-agentless-scan"
    *
    Delete subnet attached to scanner
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:DetachInternetGateway
    Yes
    Yes
    No
    "ec2:ResourceTag/created-by": "prismacloud-agentless-scan"
    *
    Detach internet gateway from scanner subnet
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:DeleteVpc
    Yes
    Yes
    No
    "ec2:ResourceTag/created-by": "prismacloud-agentless-scan"
    *
    Delete the VPC used by the scanner instance
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:DeleteInternetGateway
    Yes
    Yes
    No
    "ec2:ResourceTag/created-by": "prismacloud-agentless-scan"
    *
    Delete the internet gateway used by the scanner instance
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:AttachInternetGateway
    Yes
    Yes
    No
    "ec2:ResourceTag/created-by": "prismacloud-agentless-scan"
    *
    Attach internet gateway to scanner subnet
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:CreateRoute
    Yes
    Yes
    No
    -
    *
    Create route to the gateway to allow outbound traffic
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:DescribeRouteTables
    Yes
    Yes
    No
    -
    *
    Retrieve the main route table associated by default to every subnet under the VPC
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    ec2:DescribeInternetGateways
    Yes
    Yes
    No
    -
    *
    Discover the internet gateway to be used by the scanner instance
    No
    Denies automated creation of network infrastructure - safe to remove if configuring custom network resources
    kms:Decrypt
    Yes
    Yes
    Yes
    -
    *
    Required to support EBS encryption
    No
    Denies support for encrypted volumes
    kms:GenerateDataKeyWithoutPlaintext
    Yes
    Yes
    Yes
    -
    *
    Required to support EBS encryption
    No
    Denies support for encrypted volumes
    kms:ReEncryptFrom
    Yes
    Yes
    Yes
    -
    *
    Required to support EBS encryption
    No
    Denies support for encrypted volumes
    kms:ReEncryptTo
    Yes
    Yes
    Yes
    -
    *
    Required to support EBS encryption
    No
    Denies support for encrypted volumes
    kms:DescribeKey
    Yes
    Yes
    Yes
    -
    *
    Required to support EBS encryption
    No
    Denies support for encrypted volumes
    kms:CreateGrant
    Yes
    Yes
    Yes
    -
    *
    Required to support EBS encryption
    No
    Denies support for encrypted volumes
    ec2:ModifySnapshotAttribute
    No
    No
    Yes
    "ec2:ResourceTag/created-by": "prismacloud-agentless-scan"
    *
    Share snapshot with the hub account
    Yes
    Denies scanning snapshots in hub mode
    kms:CreateKey
    No
    No
    Yes
    "aws:RequestTag/created-by": "prismacloud-agentless-scan"
    *
    Create a new shareable (with hub) PCC KMS key to re-encrypt the snapshots
    No
    Denies support for encrypted volumes in hub mode
    kms:TagResource
    No
    No
    Yes
    "aws:RequestTag/created-by": "prismacloud-agentless-scan"
    *
    Create the PCC KMS key with tags
    No
    Denies support for encrypted volumes in hub mode
    ec2:CopySnapshot
    No
    No
    Yes
    -
    *
    Create copies of encrypted snapshots, using the PCC KMS key
    No
    Denies support for encrypted volumes in hub mode
    kms:ListKeys
    No
    No
    Yes
    -
    *
    Discover and reuse existing PCC KMS key, also required for the cleanup process
    No
    Denies support for encrypted volumes in hub mode

    GCP

    The following table shows the required permissions needed if you are using GCP. You can also review the permissions needed for agentless scanning in GCP.
    Capability
    Feature
    Permissions
    Role/Policy
    Workload Discovery
    Cloud Discovery
    Workload Discovery
    Cloud Discovery
    roles/storage.objectViewer
    roles/viewer
    Workload Discovery
    Cloud Discovery
    roles/container.clusterViewer
    roles/viewer
    Workload Discovery
    Cloud Discovery
    roles/cloudfunctions.viewer
    roles/viewer
    Workload Discovery
    Cloud Discovery
    compute.instances.list
    Prisma Cloud Viewer
    Workload Discovery
    Cloud Discovery
    compute.zones.list
    Prisma Cloud Viewer
    Workload Discovery
    Cloud Discovery
    compute.projects.get
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Host Auto Defend
    Agent-Based Workload Scan
    Host Auto Defend
    osconfig.patchJobs.exec
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Host Auto Defend
    osconfig.patchJobs.list
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Host Auto Defend
    osconfig.patchJobs.get
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Host Auto Defend
    storage.buckets.create
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Host Auto Defend
    storage.buckets.delete
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Host Auto Defend
    storage.objects.create
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Host Auto Defend
    storage.objects.delete
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Host Auto Defend
    storage.objects.get
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Host Auto Defend
    storage.objects.list
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Host Auto Defend
    compute.disks.get
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Host Auto Defend
    compute.instances.list
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Host Auto Defend
    compute.zones.list
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Host Auto Defend
    compute.projects.get
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    artifactregistry.repositories.list
    roles/viewer
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    artifactregistry.repositories.get
    roles/viewer
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    artifactregistry.repositories.downloadArtifacts
    roles/viewer
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    artifactregistry.files.list
    roles/viewer
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    artifactregistry.files.get
    roles/viewer
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    artifactregistry.packages.list
    roles/viewer
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    artifactregistry.packages.listTagBindings
    roles/viewer
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    artifactregistry.repositories.listEffectiveTags
    roles/viewer
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    artifactregistry.packages.list
    roles/viewer
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    artifactregistry.tags.list
    roles/viewer
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    artifactregistry.tags.get
    roles/viewer
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    artifactregistry.versions.list
    roles/viewer
    Agent-Based Workload Scan
    Google Artifact Registry Scan
    artifactregistry.versions.get
    roles/viewer
    Agent-Based Workload Scan
    Google Container Registry Scan
    Agent-Based Workload Scan
    Google Container Registry Scan
    storage.objects.get
    Storage Object Viewer
    Agent-Based Workload Scan
    Google Container Registry Scan
    storage.objects.list
    Storage Object Viewer
    Agent-Based Workload Scan
    VM Images Scan
    Agent-Based Workload Scan
    VM Images Scan
    compute.disks.create
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.images.get
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.images.list
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.images.useReadOnly
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.instances.create
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.instances.delete
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.instances.get
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.instances.list
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.instances.setMetadata
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.instances.setTags
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.networks.get
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.networks.updatePolicy
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.networks.use
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.networks.useExternalIp
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.subnetworks.use
    Prisma Cloud Viewer
    Agent-Based Workload Scan
    VM Images Scan
    compute.subnetworks.useExternalIp
    Prisma Cloud Viewer
    Serverless Function Scanning
    Serverless Scanning
    Serverless Function Scanning
    Serverless Scanning
    cloudfunctions.functions.sourceCodeGet
    Serverless Function Scanning
    Serverless Scanning
    cloudfunctions.functions.get
    roles/viewer
    Serverless Function Scanning
    Serverless Scanning
    cloudfunctions.functions.list
    roles/viewer
    Serverless Function Scanning
    Serverless Scanning
    cloudfunctions.locations.get
    roles/viewer
    Serverless Function Scanning
    Serverless Scanning
    cloudfunctions.locations.list
    roles/viewer
    Serverless Function Scanning
    Serverless Scanning
    cloudfunctions.operations.get
    roles/viewer
    Serverless Function Scanning
    Serverless Scanning
    cloudfunctions.operations.list
    roles/viewer
    Serverless Function Scanning
    Serverless Scanning
    cloudfunctions.runtimes.list
    roles/viewer

    Agentless Permissions

    The following table shows the required permissions for agentless scanning.
    Permission
    Same Account
    Hub Account
    Target Account
    Purpose
    Mandatory
    Removal Effect
    compute.disks.create
    Yes
    Yes
    No
    Create disks from the snapshots to attach to the scanner instance
    Yes
    compute.instances.create
    Yes
    Yes
    No
    Create the scanner instance
    Yes
    compute.instances.delete
    Yes
    Yes
    No
    Delete the scanner instance
    Yes
    compute.instances.get
    Yes
    Yes
    No
    Retrieve information about scanner instance
    Yes
    compute.instances.setLabels
    Yes
    Yes
    No
    Set the scanner instance labels
    Yes
    compute.instances.setMetadata
    Yes
    Yes
    No
    Set the scanner instance metadata
    Yes
    compute.zones.list
    Yes
    Yes
    Yes
    Discover for zonal resources (e.g. iterating instances within zones)
    Yes
    compute.disks.get
    Yes
    No
    Yes
    Get disks attached to the scanner instance
    Yes
    compute.projects.get
    Yes
    No
    Yes
    Discover and get metadata of the project resource
    Yes
    compute.disks.createSnapshot
    Yes
    Yes
    Yes
    Create snapshots of instances to scan. If using hub mode, this permissions is required on every target that is not part of the same org as the hub account
    Yes
    compute.instances.list
    Yes
    Yes
    Yes
    Discover instances to scan
    Yes
    compute.snapshots.create
    Yes
    Yes
    No
    Create snapshot of hosts to be scanned by the scanner instance
    Yes
    compute.snapshots.delete
    Yes
    Yes