Skip to main content

Agentless Workload Scanning for Google Cloud - IAM Permissions Used during Operation

Overview​

This article contains the permissions used during an Agentless Workload Scanning operation in Google Cloud.

Understand the operational roles, permissions, and service accounts that ensure a secure scanning process.

note

This article is informational, and does not contain any required actions as part of the Agentless Workload Scanning integration.

Project Integration​

Roles and Permissions​

You can use the following link to view/download all these roles and permissions in JSON format:

The tabs below lists all roles and permissions.

Role Name
projects/<GCP_PROJECT>/roles/lacework_awls_orchestrate_<UNIQUE_ID>
IAM Permissions
[
    "compute.disks.create",
    "compute.disks.delete",
    "compute.disks.list",
    "compute.disks.setLabels",
    "compute.disks.use",
    "compute.instances.create",
    "compute.instances.delete",
    "compute.instances.list",
    "compute.instances.setIamPolicy",
    "compute.instances.setMetadata",
    "compute.instances.setServiceAccount",
    "compute.machineTypes.get",
    "compute.snapshots.create",
    "compute.snapshots.delete",
    "compute.snapshots.list",
    "compute.snapshots.setLabels",
    "compute.snapshots.useReadOnly",
    "compute.subnetworks.use",
    "compute.subnetworks.useExternalIp",
    "compute.zoneOperations.get",
    "storage.objects.create",
    "storage.objects.delete",
    "storage.objects.get",
    "storage.objects.list"
]

Service Accounts​

You can use the following link to view/download all these service accounts in JSON format:

The tabs below lists all service accounts used for this type of integration.

Service Account Name
projects/<GCP_PROJECT>/serviceAccounts/lacework-awls-orchestrate-<UNIQUE_ID>@<GCP_PROJECT>.iam.gserviceaccount.com
Membership
[
    "projects/<GCP_PROJECT>/roles/lacework_awls_orchestrate_<UNIQUE_ID>",
    "roles/run.invoker",
    "projects/<GCP_PROJECT>/roles/lacework_awls_snapshot_<UNIQUE_ID>",
    "roles/iam.serviceAccountUser"
]

Organization Integration​

Roles and Permissions​

You can use the following link to view/download all these roles and permissions in JSON format:

The tabs below lists all roles and permissions.

Role Name
projects/<GCP_PROJECT>/roles/lacework_awls_orchestrate_<UNIQUE_ID>
IAM Permissions
[
    "compute.disks.create",
    "compute.disks.delete",
    "compute.disks.list",
    "compute.disks.setLabels",
    "compute.disks.use",
    "compute.instances.create",
    "compute.instances.delete",
    "compute.instances.list",
    "compute.instances.setIamPolicy",
    "compute.instances.setMetadata",
    "compute.instances.setServiceAccount",
    "compute.machineTypes.get",
    "compute.snapshots.create",
    "compute.snapshots.delete",
    "compute.snapshots.list",
    "compute.snapshots.setLabels",
    "compute.snapshots.useReadOnly",
    "compute.subnetworks.use",
    "compute.subnetworks.useExternalIp",
    "compute.zoneOperations.get",
    "storage.objects.create",
    "storage.objects.delete",
    "storage.objects.get",
    "storage.objects.list"
]

Service Accounts​

You can use the following link to view/download all these service accounts in JSON format:

The tabs below lists all service accounts used for this type of integration.

Service Account Name
projects/<GCP_PROJECT>/serviceAccounts/lacework-awls-orchestrate-<UNIQUE_ID>@<GCP_PROJECT>.iam.gserviceaccount.com
Membership
[
    "projects/<GCP_PROJECT>/roles/lacework_awls_orchestrate_<UNIQUE_ID>",
    "roles/run.invoker",
    "roles/iam.serviceAccountUser",
    "organizations/<GCP_ORG_ACCOUNT>/roles/lacework_awls_snapshot_<UNIQUE_ID>"
]

Next Steps​

  1. Ensure that you have met all Integration Requirements.
  2. Proceed with the Agentless Workload Scanning integration: