topic Curious why Prisma Cloud needs "kms:decrypt" permission for "*" in AWS in Prisma Cloud Discussions

Curious why Prisma Cloud needs "kms:decrypt" permission for "*" in AWS

JSchneiderhan — Thu, 18 Aug 2022 13:59:01 GMT

While onboarding our AWS account using this template, I had a developer ask why "kms:decrypt" is granted on all "*" resources. I'm wondering if anyone knows the reason so that I can relay it to them.

Re: Curious why Prisma Cloud needs "kms:decrypt" permission for "*" in AWS

musiddiqui — Wed, 07 Sep 2022 00:44:51 GMT

Hi, I hope you are doing well. The "kms:decrypt" permission is needed to extract serverless function environment variables (part of lambda:ListFunctions query). I've seen while working with customers, that the function scans fail because of a lack of access to kms resources. It might seem like more than should be needed, but sometimes the artifact simply can't be fully observed without it.

It is sometimes also needed to read encrypted images in ECR. I hope this answers your question.

Re: Curious why Prisma Cloud needs "kms:decrypt" permission for "*" in AWS

JSchneiderhan — Fri, 09 Sep 2022 15:10:01 GMT

Thank you very much!