> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/achieve-the-principle-of-least-privilege-access.md).

# Achieve the principle of least privilege access

#### Overview

Cortex Cloud Identity Security uses audit logs to detect unused permissions. The Review Unused Permissions feature can help you analyze audit logs in order to identify and revoke excessive permissions. This allows you to generate precise IAM policies based on actual usage, reducing your attack surface and strengthening your overall security posture. You can customize the time frame for used permissions according to your specific operational needs.

The Review Unused Permissions feature is supported for these platform entities:

* **Amazon AWS:**
  * IAM roles
  * IAM groups
* **Microsoft Azure:**
  * Service principals
  * IAM groups
* **Google Cloud Platform (GCP):**
  * GCP groups
  * Service accounts

Cortex Cloud Identity Security does the following:

* Analyzes last access data in order to detect the permissions that are being used.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>In the case of Amazon AWS, Cortex Cloud Identity Security also uses AWS Identity and Access Management (IAM) Access Advisor insights to expand the coverage of supported actions.</p></div>
* Recommends the removal of unused permissions, displaying recommended actions, such as **Keep** and **Remove**.
* Generates downloadable policies in:
  * **Amazon AWS:** IAM Policy (JSON), HashiCorp® Terraform, CloudFormation
  * **Microsoft Azure:** Role Definition and Role Assignment (JSON), HashiCorp® Terraform
  * **Google Cloud Platform (GCP):** IAM Policy (JSON), HashiCorp® Terraform

#### Reviewing Unused Permissions

1. In the Cortex Cloud Identity Security module, under **Identity Asset Inventory**, on the **Cloud Identities** tab, select an identity in the list whose permissions you want to review.
2. On the **Overview** tab, in the **Review Unused Permissions** area, click **Analyze Permissions Usage**, and select a time period in the list.
3. Click **Start Analysis**.
4. On the **Permission Checkup Results** screen, a summary of permissions usage is displayed according to the time period you selected, with the suggested **Remove** number in red and the recommended **Keep** number in blue.
5. If you want to proceed with seeing the recommended changes and how you could reduce unused permissions, click **Adjust Policy**, and select one of these formats in the list:
   * JSON
   * Terraform
   * CloudFormation (for AWS only)
6. A code block with the format you chose now appears. You can do one of the following:
   * Click **Download File** to save a copy of the file.
   * Click **Copy to clipboard** and then paste the code into a file of your choice.
7. You can now click **Back to Checkup Result** to return to the previous screen. You can review the policy list to see and consider the **Cortex Recommendation** column, which displays either **Remove** or **Keep** for each policy file.

{% hint style="info" %}

### Important

If you turn off the audit logs, even briefly, this temporarily impacts the accuracy of the Last Access data, potentially showing permissions as unused when actually they were active. Full accuracy is restored 90 days after you re-enable the audit logs.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cortex-cloud-identity-security/achieve-the-principle-of-least-privilege-access.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.