Exception for IAM policy

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Exception for IAM policy

L1 Bithead

Hi,

 

We have a dev/PoC project that is testing some flows that create and delete VMs, so every week for a couple of hours we had some alerts for an IAM Policy "VM instance with data destruction permissions" when it is a permanente VM we ask to follow the recommendations. 

 

How would I be able to except the specific project from this policy or I need to make a custom one?

2 REPLIES 2

L0 Member

Hello Climachi1,

One way you could make an exception for that project from the policy would be by putting that policy in it's own standalone Alert Rule with only that policy selected, and excluding that specific project from the Alert Rule. Even if you were able to edit the policies RQL to ignore that project(which I don't think you can) the policy engine would ignore that input as Prisma Cloud is designed to ignore specific accounts/projects via Alert Rule configuration. If you do take that route , be mindful of removing that policy from any other Alert Rules or you will continue to get alerted for that project.

Hope this helps!

L2 Linker

To add to what JScheel1 said:

It seems you are using overly permissive IAM policy to spin up VMs, even if they are temporary. Please consider the possibility of someone breaking into your temporary VM and from there deleting all data / storage your policy has access to.

With that said, you can adjust your reporting to only look / enforce your production account
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/iam-q...

Helping protect our customers' digital way of life.
  • 909 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!