Prisma Cloud CIEM Security Best Practices

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.
L1 Bithead

Written by John Chavanne and Rob Baccus




In today's cloud world there are a number of challenges in securing the resources and applications running in the cloud. One of these is the permissions that both users and objects have to sensitive information and access to others' resources. How do you, as a security professional, know when an attacker can use your own over permissive roles and accounts to access an S3 bucket containing personal customer information? Palo Alto Networks Unit 42 team has done extensive research in this area as well as helped customers who have suffered from breaches in the cloud. The Cloud Threat Report, Volume 7: Navigating the Expanding Attack Surface highlights examples where attackers exfiltrated cloud credentials, escalated privileges, and exfiltrated data from many database tables and storage buckets. In this article, we will focus on some of the most important best practices for Cloud Infrastructure Entitlement Management (CIEM) and Identity Access Management (IAM) Security for cloud applications, resources, and services.


What the Reader Will Learn/Gain


This blog will provide you with:


  • An overview of how to create a clear cloud IAM strategy
  • A list of key cloud IAM best practices
  • How Prisma Cloud implements these best practices


Why is Cloud IAM Strategy Important?


Managing cloud IAM is complex and challenging for any organization. Having a very clear cloud IAM strategy that can be communicated across the organization can go a long way to establishing proper rules and guardrails for how all identities will be managed in the cloud.


It is important to work with various teams in your organization to establish Cloud Infrastructure Entitlement Management (CIEM) and Identity Access Management (IAM) Security best practices and strategies for future changes.  Your cloud IAM best practices will need to align with your cloud IAM Strategy such that both security and development teams agree on the best way to secure roles, permissions, and resource access across cloud environments.


The risks that your company will incur if you don't adequately tackle cloud CIEM and IAM Security could be significant, from fines and/or jail time from the SEC (given the new reporting requirements), to brand damage and loss of significant customer trust, to loss of revenue.


An example of neglecting the implementation of an IAM strategy and best practices may lead to the existence of overly permissive roles in source code repositories, such as public GitHub, allowing attackers to discover and exploit credentials for purposes like introducing malware or engaging in nefarious activities within your cloud environments. Catching these risky permissions and roles earlier in the application lifecycle can prevent alerts to the security teams downstream.


Another example of a strong business objective addressed by a cloud IAM Best Practice is the incorporation of Multi-Factor Authentication (MFA) for IAM users. This strategic measure serves as a robust defense, preventing unauthorized access to user accounts and the potential compromise of critical data and infrastructure. Neglecting these best practices could lead to substantial consequences, including downtime for mission critical applications, as illustrated and witnessed during the breaches at MGM and Caesars in late 2023.

Diagram 1 is an example approach to help your teams simplify and visualize a cloud IAM strategy based on your company's unique risks. This approach demonstrates how you can simplify a complex and difficult subject by creating a clear visual representation of the potential risks based on specific business needs and easily share it with other teams.


Diagram 1: Define IAM Strategy based on RiskRBaccus_0-1706125130540.jpeg

In Table 1: Cloud IAM Best Practices, we have provided some key best practices and how to implement them with Prisma Cloud to help define your own team's cloud IAM Strategy.In Table 1: Cloud IAM Best Practices, we have provided some key best practices and how to implement them with Prisma Cloud to help define your own team's cloud IAM Strategy.


Table 1: Cloud IAM Best Practices:

NOTE: Examples in italics are Prisma Cloud RQL examples.


Best Practice Category

Best Practices

Prisma Cloud Specific Implementation of Best Practices


IAM Controls

Enforce MFA for cloud identities

OOB config MFA policies

  • AWS MFA not enabled for IAM users
  • Azure AD MFA is not enabled for the user

IAM Controls

Enforce password policies for cloud users

OOB config Password policies

  • AWS IAM password policy does not expire in 90 days

IAM Controls

Ensure all Users belong to Groups and mitigate use of any directly attached roles or policies.

Run query in Investigate for all clouds or a specific cloud for granted by entity type of user.

  • config from iam where = 'user'

IAM Scope Visibility

Central IdP Visibility across multi-cloud environments

Support of direct IdP integration

Inactive Access

Identify inactive cloud users.

OOB config policies & Custom policies.

  • AWS Inactive users for more than 30 days

Inactive Access

Identify inactive access keys/long-standing credentials.

OOB config policies & Custom policies.

  • AWS access keys not used for more than 45 days
  • config from cloud.resource where cloud.type = 'gcp' AND = 'gcloud-iam-service-accounts-keys-list' AND json.rule = 'name contains and (_DateTime.ageInDays($.validAfterTime) > 90) and keyType equals USER_MANAGED' addcolumn validAfterTime

Inactive Access

Identify unused machine accounts (i.e. service accounts, managed identities).

Custom config policies

  • config from cloud.resource where = 'gcloud-recommender-iam-service-account-insight' AND json.rule = '_DateTime.ageInDays(content.lastAuthenticatedTime) > 90'

Risk Prioritization

Mitigate high priority attack path risks with comprehensive context

OOB & custom attack path policies

  • Attack Path Policies
  • Data exfiltration or destruction risk due to a publicly exposed and vulnerable Azure Virtual Machine with hazardous Storage account permissions
  • Unauthorized access or account actions risk due to a publicly exposed and vulnerable AWS EC2 instance with sensitive IAM 'write' permissions

Permissions Risk

Mitigate usage of highly privileged CSP Managed/Built-in roles.

OOB high privilege role policies.

  • GCP service accounts with 'Editor' role on org level
  • Azure AD user with the Azure built-in roles of Contributor

Permissions Risk

Mitigate unnecessary usage of high risk permissions/privileges for both human and machine identities.

OOB risky permission policies.

  • Okta user with effective permissions to create AWS IAM users
  • AWS Lambda Function with data destruction permissions

Permissions Risk

Mitigate toxic combination of privilege escalation permissions for both human and machine identities.

OOB & custom privilege escalation permission policies.

  • AWS role having iam:PassRole and lambda:InvokeFunction permissions attached to EC2 instance

Least Privilege

Mitigate unused permissions/privileges and create least-privilege access policies & roles for both human and machine identities.

OOB unused permission policies for each CSP for 90 and 7 days and automated generation of least privilege access policies & roles.

  • Cloud Identity Inventory
  • AWS IAM effective permissions are over-privileged (90 days)
  • Azure IAM effective permissions are over-privileged (90 days)

Least Privilege

Mitigate wildcard/broad resource access for both human and machine identities.

OOB wildcard access policies.

  • Okta User with IAM wildcard resource access
  • AWS EC2 with IAM wildcard resource access
  • Azure Service Principals with broad Key Vault management access

Least Privilege

Manage resource access to lower level scopes and avoid role assignments at broad levels (i.e. Orgs, subscriptions, folders, etc.)

OOB permissions & Custom policies.

  • config from iam where = 'AZURE' and grantedby.level.type IN ( 'Azure Management Group', 'Azure Subscription' )
  • config from iam where = 'GCP' and grantedby.level.type IN ( 'GCP Organization', 'GCP Folder' )

Cross Account Access

Mitigate and control cross-account access for both human and machine identities.

OOB permissions & Custom policies to discover and mitigate identities that have access to accounts/subscriptions/projects/organizations that do not belong to those same entities.

  • Azure Managed Identity with permissions to other subscriptions
  • config from iam where != 'MyAccount' AND = 'MyAccount'
  • config from iam where != 'MyOrg' AND = 'MyOrg'

Cross Account Access

Mitigate and control access with organizational conditions

Custom permission policies

  • config from iam where ('aws:PrincipalOrgID') does not exist
  • config from iam where ('aws:PrincipalOrgID') not-in ('my-ord-id')


Manage and enforce IAM access by tags.

Custom config & permission policies

  • config from cloud.resource where = 'aws-iam-list-roles' AND json.rule = role.tags[*] exists
  • config from iam where = 'role' and ( 'env') = 'prod'

Identity Anomalies

Detect & mitigate identity based anomalies

OOB Anomaly policies

  • Account hijacking attempts
  • Azure Compute workload deleting network security groups
  • Unusual usage of Workload Credentials from outside the Cloud


Ensure cloud IAM access and configuration meets compliance standards

Robust OOB compliance standards with identity controls


Provides IAM compliance reports for auditing

OOB compliance reporting


Provides reports on top identity risks

Autogenerate reports from the Command Center




Managing identities has always been a challenge for companies, and it becomes even more complex in the cloud. Taking proactive steps, like creating and implementing a cloud IAM strategy, helps define controls and guidelines for the organization as it transitions to the cloud. Adopting cloud IAM best practices further reduces risk. Utilizing a powerful tool like Prisma Cloud enables successful implementation and maintenance of the strategy and best practices.


This blog post was intended to help get you started on improving your security posture when it comes to managing your cloud identities. Your cloud identity security journey should not end here though. Identities and their credentials are used throughout cloud environments, to access sensitive data, run CI/CD pipelines, automation activities, and can be found embedded in code, VMs, containers, code repositories. Prisma Cloud has the most robust and comprehensive approach when it comes to protecting your applications, data, and identities. Attackers continue to become more sophisticated and use automation and AI to launch their attacks at faster and faster speeds. Taking an in-depth approach such as described in the blog: Mitigate Cloud Breaches With a Holistic Approach to Cloud Identity and Access will help you continue to learn more about how you can further protect your company from a breach.


Register or Sign-in
Top Liked Authors