Prisma Cloud RQL query to find IAM users that have IAM access key permissions for other IAM users
3161
Created On 07/31/22 11:25 AM - Last Modified 11/20/24 16:58 PM
Question
- What is the Prisma Cloud RQL query to find IAM users that have IAM access key permissions for other IAM users?
Environment
- Prisma Cloud
- Public Cloud
Answer
- Finding users with access key permissions to another users in the same account is not supported as of today.
- Meanwhile, to return all IAM resources with the listed permissions, run the following RQL query:
config from iam where dest.cloud.service.name = 'iam' AND action.name IN ( 'iam:CreateAccessKey' , 'iam:DeleteAccessKey', 'iam:UpdateAccessKey')
Example