09-14-2023 09:35 AM
Hi,
We have a dev/PoC project that is testing some flows that create and delete VMs, so every week for a couple of hours we had some alerts for an IAM Policy "VM instance with data destruction permissions" when it is a permanente VM we ask to follow the recommendations.
How would I be able to except the specific project from this policy or I need to make a custom one?
09-14-2023 05:50 PM
Hello Climachi1,
One way you could make an exception for that project from the policy would be by putting that policy in it's own standalone Alert Rule with only that policy selected, and excluding that specific project from the Alert Rule. Even if you were able to edit the policies RQL to ignore that project(which I don't think you can) the policy engine would ignore that input as Prisma Cloud is designed to ignore specific accounts/projects via Alert Rule configuration. If you do take that route , be mindful of removing that policy from any other Alert Rules or you will continue to get alerted for that project.
Hope this helps!
09-15-2023 06:24 AM
To add to what JScheel1 said:
It seems you are using overly permissive IAM policy to spin up VMs, even if they are temporary. Please consider the possibility of someone breaking into your temporary VM and from there deleting all data / storage your policy has access to.
With that said, you can adjust your reporting to only look / enforce your production account
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/iam-q...
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
