Azure LPA Usage

Using the Azure LPA feature for InsightCloudSec

📘

IAM License

With InsightCloudSec version 22.10.5, the following features no longer require the IAM license:

Note: To use these features, Self-hosted customers will need to add at least one AWS EC2 P3 worker to their InsightCloudSec environment (see Access Explorer - Setup for more information). Workers are automatically managed for SaaS customers, so these features will be available after you upgrade to version 22.10.5. In a future release (November 2022), this requirement will be removed and these features will rely on an existing worker pool.

After completing the setup and configuration for Azure LPA, InsightCloudSec offers a principal activity view that is accessible from the Resources page in your installation.

To launch Azure LPA, navigate to “Resource → Resources” on your InsightCloudSec platform, then navigate to the "Identity & Management" tab. The principal activity view can only be accessed on the Cloud User and Cloud Role resources.

Once you've selected the desired resource, click the vertical three dots to open the context menu, then select "Principal Activity".

16001600

User Activity

This opens a side pane listing all of the actions taken by the selected user or role.

🚧

Activity Availability

It is possible that there may be no new user or role activity within the timeframe chosen by the page (default is the last seven days).

13831383

List of User Actions

Principal Activity Details

The Principal Activity pane contains permissions (or Policy Actions) that have been used within the selected time frame (7, 30, 60, or 90 days). This will provide useful information to support remediation of risk but should be used in conjunction with additional context of the Principal being assessed.

🚧

Considerations Before Editing

Prior to making changes to a policy based on this information we recommend the following:

  • Have the information assessed by a qualified reviewer with knowledge of your specific infrastructure and implementation to avoid unwanted impacts (e.g. loss of required permission)
  • Ensure that you have an existing process to revert or remediate issues prior to making changes

Detailed Permission Usage (JSON)

The Detailed Permission Usage JSON file includes the following information for the given principal:

  • The action name
  • The count or number of times an action was invoked (if at all)
  • The last executed date for the action
  • The name of the Azure permission the action maps to
  • The status of the permission (used, unused, or un-assessed)

Information provided by InsightCloudSec on used or un-assessed permissions for a given Principal are based on the information available from the relevant Cloud Service Provider (CSP) and the data is accurate based on usage data. The data can be used by a customer to determine which permissions to keep or remove from their policy stack. Used and un-assess permissions in the context of this feature and InsightCloudSec are described below.

Note: If you want to programmatically collect this information, review the List Principal Activity and List Principal Permissions endpoints.

Used Permissions
Used Permissions are based on API actions which we have visibility of through the configured data collection (see Azure LPA Setup documentation). There is a 1 to 1 mapping of User Activity to Permission for Azure, so we present Used Permissions based on that activity which is logged via Event Hub.

Un-assessed Permissions
When a Permission appears in a Principal's effective access but we are unable to assess it, we will highlight this as an Un-assessed Permission to ensure it’s not confused with an unused permission.

📘

Service Limitation

There are certain Azure services that InsightCloudSec cannot assess usage for. This may be due to the service not logging via the relevant method, and this is a limitation. We are currently exploring options on how to support these services with alternative approaches.