Least Privilege Policies and Roles

Grant identities the minimum privileges needed to perform required tasks by generate on-demand, fine-grained policies within the supported resources.

IAM policies and custom roles (GCP and Azure) generated via the API are also available in the Console (see the relevant documentation to learn more).

AWS: Generate least privilege policy

📘
Note
On-demand policy generation becomes available 24 hours after user/role creation.

You can use the AwsResources query to obtain an Id value for use in the EntityId field. The Id must be that of an AWS IAM role or user. The policy output will include data from the defined StartDate until the date that you generate the policy.

mutation {
  GenerateAwsLeastPrivilegePolicy(
    input: {
        StartDate: "10/25/2023"
        EntityId: "*********************"
    }
  ) {
    PolicyDocuments
  }
}

Sample response

{
  "data": {
    "GenerateAwsLeastPrivilegePolicy": {
      "PolicyDocuments": [
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "iam:PassRole",
              "Resource": "*"
            }
          ]
        }
      ]
    }
  }
}

Azure: Generate least custom roles

📘
Note
On-demand policy generation becomes available 24 hours after user/application/managed identity creation.

You can use the InventoryReport query to obtain an Id value for use in the EntityId field. The Id must be that of Azure managed identity or an Entra ID user or application. The role output will include data from the defined StartDate until the date that you generate the policy.

mutation {
  GenerateAzureLeastPrivilegeRoleDefinition(
    input: {
        StartDate: "11/20/2024"
        EntityId: "*****************************"
      	ScopeIds: ["****************************"]
    }
  ) {
    RoleDefinitions
  }
}

Sample response

{
 "data": {
    "GenerateAzureLeastPrivilegeRoleDefinition": {
      "RoleDefinitions": [
        {
          "properties": {
            "assignableScopes": [
              "/****************************"
            ],
            "description": "",
            "id": "/providers/Microsoft.Authorization/roleDefinitions/****************************",
            "name": "****************************",
            "permissions": [
              {
                "actions": [
                  "Wandisco.Fusion/operations/read"
                ],
                "notActions": [],
                "dataActions": [
                  "Microsoft.ContainerService/managedClusters/apiextensions.k8s.io/customresourcedefinitions/write"
                ],
                "notDataActions": []
              }
            ],
            "roleName": "LeastPrivilegeRoleDefinition",
            "roleType": "CustomRole"
          }
        }
      ]
    }
  }
}

GCP: Generate least custom roles

📘
Note
On-demand policy generation becomes available 24 hours after user/service account creation.

You can use the InventoryReport query to obtain an Id value for use in the EntityId field. The Id must be that of a GCP service account or Google Workspace user. The role output will include data from the defined StartDate until the date that you generate the role.

mutation {
  GenerateGcpLeastPrivilegeRole(
    input: {StartDate: "11/20/2023", 
            EntityId: "User/*************", 
            ScopeIds: ["****************"]
            IncludeSpecialGroupPermissions:true
}
  ) {
    Roles
  }
}

Sample response

{
  "data": {
    "GenerateGcpLeastPrivilegeRole": {
      "Roles": [
        {
          "roleId": "LeastPrivilegeRole",
          "role": {
            "title": "Least Privilege Role",
            "stage": "GA",
            "includedPermissions": [
              "storage.objects.list"
            ]
          }
        }
      ]
    }
  }
}

Supported resources

The following resource types are supported:

AWS:
- IAM users
- IAM roles
- EC2 instances
- Lambda functions
- DynamoDB
Azure:
- Managed identities
Microsoft Entra ID:
- Users
- Applications
GCP:
- Service accounts
- Google Workspace Group
- Google Workspace Group (external)
Google Workspace:
- Users