topic Exception for IAM policy in Prisma Cloud Discussions

Exception for IAM policy

CLimachi1 — Thu, 14 Sep 2023 16:35:33 GMT

Hi,

We have a dev/PoC project that is testing some flows that create and delete VMs, so every week for a couple of hours we had some alerts for an IAM Policy "VM instance with data destruction permissions" when it is a permanente VM we ask to follow the recommendations.

How would I be able to except the specific project from this policy or I need to make a custom one?

Re: Exception for IAM policy

JScheel1 — Fri, 15 Sep 2023 00:50:35 GMT

Hello Climachi1,

One way you could make an exception for that project from the policy would be by putting that policy in it's own standalone Alert Rule with only that policy selected, and excluding that specific project from the Alert Rule. Even if you were able to edit the policies RQL to ignore that project(which I don't think you can) the policy engine would ignore that input as Prisma Cloud is designed to ignore specific accounts/projects via Alert Rule configuration. If you do take that route , be mindful of removing that policy from any other Alert Rules or you will continue to get alerted for that project.

Hope this helps!

Re: Exception for IAM policy

JNeytchev — Fri, 15 Sep 2023 13:24:41 GMT

To add to what JScheel1 said:

It seems you are using overly permissive IAM policy to spin up VMs, even if they are temporary. Please consider the possibility of someone breaking into your temporary VM and from there deleting all data / storage your policy has access to.

With that said, you can adjust your reporting to only look / enforce your production account
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/iam-query/iam-query-attributes