> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cloud-security-permissions.md).
# Cloud Security permissions
You can edit Cloud Security policies and rules permissions by selecting CLOUDSEC when creating or editing a role.
Users manage Cloud Security Policies and Rules by going to Posture Management → Rules & Policies and then selecting Cloud Security either under Policies or Rules.
Requires Cloud Posture Security or Cloud Runtime Security license.
**Rules**
Control Cloud Security Rules, which are individual security detection rules that Cloud Security Policies reference. They define specific configuration checks and compliance requirements, such as checking specific cloud resource settings, mapping specific compliance requirements, and pre-defined security best practice rules.
For more information, see [Cloud Security Rules](/cortex-cloud-posture-management/cloud-security-rules-and-policies/cloud-security-rules-and-policies.md).
| Permission | Description | Roles Example |
| ---------- | --------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to Cloud Security Rules. | SOC Tier-1 Analyst: Focus on issue triage, not policy management. |
| View | Read-only access to Cloud Security Rules, but can't take any action. | - SOC Tier 2 and 3 Analysts: Reference policy configurations during investigations/deep analysis of policy effectiveness.
- Threat Hunter: Understand policy coverage for threat hunting.
|
| View/Edit | Full edit access, including creating, editing, and deleting, copying, and enabling or disabling Cloud Security Rules. | Security Engineer: Create and maintain cloud security rules. |
**Policies**
Cloud Security Policies allow administrators to define and manage configuration and compliance policies for cloud infrastructure, such as checking cloud resource configurations, mapping compliance frameworks, and identifying security misconfigurations.
For more information, see [Cloud Security Policies](/cortex-cloud-posture-management/cloud-security-rules-and-policies/cloud-security-rules-and-policies.md).
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to Cloud Security Policies. | SOC Tier-1 Analyst: Focus on issue triage, not policy management. |
| View | Users can access Cloud Security Policies, but can't take any action. | - SOC Tier 2 and 3 Analysts: Reference policy configurations during investigations/deep analysis of policy effectiveness.
- Threat Hunter: Understand policy coverage for threat hunting.
|
| View/Edit | Full edit access, including creating, editing, and deleting Cloud Security Policies. | Security Engineer: Create and maintain cloud security rules. |
Required and recommended permissions
Consider adding the following permissions:
| Permissions | Permission Level | Reason |
| ----------------------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cloud Security Command Center | View or View/Edit | - View: Strongly recommended. Provides access to the CloudSec Command Center dashboard, which gives a high-level overview of cloud security posture, including asset class views, ingestion data, and value metrics.
- View/Edit: Recommended. Allows editing CloudSec dashboards. Recommended for Security Engineers and Security Admins who need to customize posture dashboards.
|
| Cloud Security Operations | View or View/Edit | - View: Strongly recommended. Provides access to the CloudSec SecOps dashboard, which shows operational metrics like open action plans, burndown charts, MTTR, top impacted assets/accounts, and action plan breakdowns by category and age. Essential for understanding the operational state of cloud security posture.
- View/Edit: Recommended. Allows editing CloudSec SecOps dashboards. Recommended for Security Engineers and Security Admins who need to customize operational dashboards.
|
| Asset Inventory | View | Strongly recommended. Provides access to the Unified Asset Inventory, which is the foundation for viewing cloud assets that rules and policies evaluate. Without this, users cannot see the cloud assets that are in scope for policies. |
| Compliance | View or View/Edit | - View: Recommended. Provides access to Cloud Workload Protection policies. Recommended for users who need a holistic view of both CSPM and CWP posture configurations.
- View/Edit: Recommended. Allows editing Cloud Workload Protection policies. Recommended for Security Engineers and Admins managing both CSPM and CWP.
|
| Compliance | View | - Catalog & Assessment Profiles: View. Recommended for access to the Compliance module (standards, controls, assessment profiles), as CloudSec rules map to compliance standards, and users benefit from seeing the compliance context.
- Reports: View. Recommended to access for compliance assessment results and reports. Recommended for understanding how rule findings impact compliance posture.
|
| Query Center | View | Recommended. Provides access to XQL query capabilities. Recommended for SOC analysts and threat hunters who need to query cloud security data for investigation. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cloud-security-permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.