Cloud Security Posture Management (CSPM) service roles

With CSPM service roles, you can manage user access to the CSPM resources and their settings, as well as to the results of configuration compliance checks with security standards.

cspm.workercspm.worker

The cspm.worker role allows the user to view the organization info, view the list of clouds and folders and their info as controlled resources of a Security Deck workspace.

The role is issued to the service account to perform checks for compliance with security standards configured in CSPM settings and extends to an organization, cloud, or folder.

cspm.auditorcspm.auditor

The cspm.auditor role allows the user to view info on cloud infrastructure checks for compliance with security standards configured in CSPM settings.

cspm.viewercspm.viewer

The cspm.viewer role allows the user to view info on cloud infrastructure checks for compliance with security standards configured in CSPM settings, the results of such checks, and exceptions from related rules.

This role includes the cspm.auditor permissions.

cspm.editorcspm.editor

The cspm.editor role allows the user to manage cloud infrastructure checks for compliance with CSPM security standards and exceptions from related rules.

Users with this role can:

• View info on cloud infrastructure checks for compliance with security standards configured in CSPM settings.
• View the results of CSPM checks.
• Create, suspend, resume, update, and delete CSPM checks.
• View exceptions from CSPM check rules, create and delete such exceptions.

This role includes the cspm.viewer permissions.

cspm.admincspm.admin

The cspm.admin role allows the user to manage cloud infrastructure checks for compliance with CSPM security standards and exceptions from related rules.

Users with this role can:

• View info on cloud infrastructure checks for compliance with security standards configured in CSPM settings.
• View the results of CSPM checks.
• Create, suspend, resume, update, and delete CSPM checks.
• View exceptions from CSPM check rules, create and delete such exceptions.

This role includes the cspm.editor permissions.