A cloud security architect is integrating a new Azure subscription into Prisma Cloud. They need to ensure that Prisma Cloud can perform continuous monitoring of resources, identify misconfigurations, and receive security alerts. What is the MINIMUM required access level and type for onboarding an Azure subscription to enable these core CSPM functionalities?
- AContributor role at the subscription level.
- BReader role with 'Log Analytics Contributor' permissions.
- COwner role with 'Write' permissions on all resource groups.
- DCustom role with 'Microsoft.Authorization/roleAssignments/read' and 'Microsoft.Resources/subscriptions/read' permissions.
Show answer & explanationAnswer & explanation
Correct answer: B. Reader role with 'Log Analytics Contributor' permissions.
For core CSPM functionalities like continuous monitoring and identifying misconfigurations, Prisma Cloud primarily needs read access to resource configurations and access to activity logs. The 'Reader' role provides read-only access to resources, and 'Log Analytics Contributor' (or similar log-reading permissions on diagnostic settings) is crucial for ingesting activity logs for security alerts and behavioral analysis.
Why the other options are wrong
- A. Contributor role grants write access, which is more than the minimum required for core CSPM monitoring and alerts, violating the principle of least privilege.
- C. Owner role is excessive and grants administrative privileges, violating the principle of least privilege.
- D. These specific permissions are too granular and insufficient for comprehensive CSPM monitoring across all required resource types.
Prisma Cloud Azure Onboarding Access
For Azure subscription onboarding, Prisma Cloud requires read-only access to resource configurations and permissions to ingest activity logs to perform continuous security monitoring, identify misconfigurations, and generate alerts.
- Principle of Least Privilege is key.
- Requires read access to resources.
- Needs permissions to access activity logs (e.g., Log Analytics Contributor).
Memory trick: To monitor and alert, read and log are enough.