Cloud Permissions

Reference roles and least-privilege actions for cloud discovery and active assessment.

The agent can connect without cloud permissions. Cloud permissions control discovery and active assessment coverage.

Permission Levels

Goal	Access
Connect the agent	No provider read or administrator role is required.
Run discovery	Use a standard provider read role or the least-privilege actions below.
Run selected active tests	Add the temporary actions required by the approved test categories.
Run a full active scan in an isolated test environment	Use an approved administrator-equivalent role and remove it after cleanup.

Standard read roles are convenient baselines, not minimum permission sets. AWS ReadOnlyAccess and Google Cloud roles/viewer cover many services. Use custom roles when the customer requires tighter access.

No single provider role covers every test. Data-plane, Microsoft Entra, organization-level, and service-specific permissions can require separate grants.

AWS Discovery Actions

The bounded AWS inventory uses:

sts:GetCallerIdentity
ec2:DescribeVpcs
ec2:DescribeVpcPeeringConnections
ec2:DescribeSubnets
ec2:DescribeFlowLogs
ec2:DescribeSnapshots
ec2:DescribeInstances
ec2:DescribeSecurityGroups
ec2:DescribeInstanceAttribute
iam:GetInstanceProfile
secretsmanager:ListSecrets
sqs:ListQueues
sqs:GetQueueAttributes

Several EC2 Describe actions require Resource: "*". The collector still limits imported resources to the detected region and configured resource-name prefixes.

Set SECAGENT_AWS_RESOURCE_NAME_PREFIXES to a non-empty JSON list of literal prefixes:

["security-test-", "approved-lab-"]

Empty prefixes, spaces around a prefix, *, and ? are rejected.

Azure Discovery Access

Azure discovery requires Resource Manager read access at the VM resource-group scope. The built-in Reader role is the standard baseline. A custom role can limit access to the approved resource providers.

Depending on the environment, discovery can read metadata for:

• identities, role assignments, and role definitions;

• virtual machines, disks, networking, DNS, and snapshots;

• Automation, Functions, Logic Apps, and Container Apps;

• deployments, diagnostics, locks, Key Vault, and Storage.

Key Vault and Storage have separate data planes. Add narrow data-plane list access only for resources approved for discovery.

Microsoft Entra tests can require Microsoft Graph application permissions or directory roles. These are not included in Azure Resource Manager Reader or Owner.

Google Cloud Discovery Access

Grant list and get access for approved project services. Discovery can use:

• Cloud Resource Manager and IAM;

• Compute Engine, Cloud DNS, Cloud KMS, Logging, and Security Command Center Management;

• Secret Manager, Cloud Storage, BigQuery, and Cloud SQL;

• Cloud Build, GKE, Artifact Registry, Cloud Functions, Cloud Run, Eventarc, and Pub/Sub.

Enable the APIs required for the approved inventory. Google Cloud evaluates both VM access scopes and service-account IAM roles. A restricted VM access scope can block an API even when IAM grants the action.

Active Assessment Access

After discovery:

1. Select the authorized test categories.

2. Grant the required provider actions or the approved broad role.

3. Confirm the identity can perform any required rollback actions.

4. Record temporary grants and their removal time.

Remove temporary active permissions after the assessment and cleanup are complete.