Data Security Posture Management (DSPM) service roles

With DSPM service roles, you can manage user access to the DSPM resources and their settings, as well as to the results of scans of sources for sensitive information.

dspm.workerdspm.worker

The dspm.worker role enables viewing info on an organization, viewing the list of clouds, folders, and buckets in a scan zone specified by the user and info on them, as well as viewing data in buckets being scanned.

The role is granted to the service account that will be used to perform scans for an organization, cloud, folder, or bucket.

The role does not enable viewing data in encrypted buckets. To scan an encrypted bucket, additionally grant the kms.keys.decrypter role to your service account either for the encryption key at hand or for the folder, cloud, or organization hosting this key.

dspm.inspectordspm.inspector

The dspm.inspector role enables creating DSPM data sources using the specified Yandex Cloud resources. To create a DSPM data source, assign this role to a user for the appropriate cloud resource.

The dspm.inspector role is deprecated and no longer in use.

dspm.auditordspm.auditor

The dspm.auditor role enables viewing info on DSPM resources, as well as on scan jobs and the number of detected security threats. This role does not enable viewing masked and unprocessed data.

Users with this role can:

• View info on DSPM profiles.
• View info on DSPM data analysis results.
• View info on DSPM data sources and their scan areas.
• View info on DSPM data types and categories.
• View info on sensitive data scan jobs.
• View info on sensitive data scan jobs.
• View info on results of and errors relating to sensitive data scans (unmasked data only).
• Download and export sensitive data scan results (unmasked data only).

To export scan results, you also need the storage.uploader role for the bucket to save the results in and the kms.keys.encrypter role for the encryption key if the bucket is encrypted.

dspm.viewerdspm.viewer

The dspm.viewer role enables viewing info on DSPM resources, as well as on scan jobs and the number of detected security threats. This role does not enable viewing masked and unprocessed data.

Users with this role can:

• View info on DSPM profiles.
• View info on DSPM data sources and their scan areas.
• View info on DSPM data types and categories.
• View info on sensitive data scan jobs.
• View info on sensitive data scan jobs.
• View info on results of and errors relating to continuous update scans and regular sensitive data scans (unmasked data only).
• Download and export sensitive data scan results (unmasked data only).
• Estimate the cost of using DSPM (drawing on Yandex Object Storage bucket metadata in data sources).

This role includes the dspm.auditor permissions.

To export scan results, you also need the storage.uploader role for the bucket to save the results in and the kms.keys.encrypter role for the encryption key if the bucket is encrypted.

dspm.editordspm.editor

The dspm.editor role enables using DSPM profiles and managing data sources and sensitive data scans. This role does not enable viewing masked and unprocessed data.

Users with this role can:

• View info on DSPM profiles and use them.
• View info on DSPM data sources and their scan areas, as well as create, modify, use, and delete such sources.
• View info on DSPM data types and categories.
• View info on sensitive data scan jobs, as well as create, run, suspend, resume, modify, and delete such jobs.
• View info on sensitive data scans, as well as create, suspend, resume, modify, and delete them.
• View info on results of and errors relating to continuous update scans and regular sensitive data scans (unmasked data only).
• Download and export sensitive data scan results (unmasked data only).
• Estimate the cost of using DSPM (drawing on Yandex Object Storage bucket metadata in data sources).

This role includes the dspm.viewer permissions.

To export scan results, you also need the storage.uploader role for the bucket to save the results in and the kms.keys.encrypter role for the encryption key if the bucket is encrypted.

dspm.admindspm.admin

The dspm.admin role enables using DSPM profiles and managing data sources and sensitive data scans, which includes viewing masked and unprocessed data in scan results.

Users with this role can:

• View info on DSPM profiles and use them.
• View info on DSPM data sources and their scan areas, as well as create, modify, use, and delete such sources.
• Use Yandex Cloud resources in DSPM data sources.
• View info on DSPM data types and categories.
• View info on sensitive data scan jobs, as well as create, run, suspend, resume, modify, and delete such jobs.
• View info on sensitive data scans, as well as create, suspend, resume, modify, and delete them.
• View info on results of and errors relating to continuous update scans and regular sensitive data scans, including masked and unprocessed data.
• Download and export sensitive data scan results, including masked and unprocessed data.
• Estimate the cost of using DSPM (drawing on Yandex Object Storage bucket metadata in data sources).

This role includes the dspm.editor permissions.

To export scan results, you also need the storage.uploader role for the bucket to save the results in and the kms.keys.encrypter role for the encryption key if the bucket is encrypted.