[ Engagements ]
Cloud permissions
The read-only access a cloud credential needs for PENOPS to inventory and scan your AWS, Azure or GCP environment.
Overview
PENOPS scans your cloud with read-only access. It never changes anything in your cloud. Each provider has a required set of grants, and optional grants that unlock more coverage.
- Required access is checked on every account, subscription or project the credential can see, when you connect it and on every re-sync.
- One that lacks it is still listed with the permissions it is missing, but cannot be put in an engagement's scope until a re-sync finds the access granted.
- A credential that lacks the required access everywhere is refused.
- Every scan checks again and refuses to run while something in scope lacks the required access. A credential that can sign in but read nothing would otherwise report a clean cloud.
AWS
PENOPS signs in with an access key and, by default, assumes the PenOpsReadOnlyScan role in each account with your external id.
Required
- The AWS managed policies
SecurityAuditandViewOnlyAccess, attached to the role (or to the key's user in single-account mode). - The PENOPS cloud scanner inline policy, provided during setup. It covers container image, Lambda, Bedrock, CodeBuild and API Gateway inventory.
Optional
| Grant | Unlocks |
|---|---|
| Run from the management account or a delegated administrator | AWS Organizations structure and IAM Identity Center users, groups, permission sets and account assignments. |
AWSResourceExplorerReadOnlyAccess | A complete list of deployed resources, including untagged ones the inventory would otherwise miss. |
Azure
PENOPS signs in as an app registration (client id and secret).
Required
Readerat subscription scope.- The PENOPS cloud scanner custom role, provided during setup, at subscription scope.
Optional
| Grant | Unlocks |
|---|---|
Microsoft Graph Directory.Read.All, Policy.Read.All and AuditLog.Read.All, with admin consent | Entra ID checks and inventory: directory roles and the users, groups and service principals that hold them. A permission added without admin consent is still refused. |
Microsoft Graph Member.Read.Hidden, with admin consent | Members of groups whose membership is hidden. |
| Key Vault Reader, or a list access policy for keys, secrets and certificates | Names of keys, secrets and certificates in each vault. Values are never read. |
| Synapse Artifact User on each Synapse workspace | Synapse pipelines and linked services. |
Reader on the tenant root management group | The management group hierarchy and role assignments made above the subscription. |
GCP
PENOPS signs in with a service account JSON key or an ADC credentials file.
Required
- Viewer (
roles/viewer) and Security Reviewer (roles/iam.securityReviewer) on each project.
Optional
| Grant | Unlocks |
|---|---|
Cloud Asset Viewer (roles/cloudasset.viewer) and serviceusage.services.use, with the Cloud Asset API enabled | IAM policy bindings, who can reach which resource, and a complete list of deployed resources. Grant it on the organization to include inherited bindings. |
Artifact Registry Reader (roles/artifactregistry.reader) | Container images and packages in Artifact Registry. |
| Viewer on the organization | Checks that read organization-level logging, IAM and access settings. A project-only credential is refused these on every scan, and the run shows it. |
Good to know
- Access granted after the last sync counts once you re-sync the integration. Use Re-sync now on the engagement's Scope tab, or re-sync from Integrations.
- Anything a scan or inventory could not read is shown on the finished run.
- An engagement covers one provider. Create separate engagements for multi-cloud.