> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/achieve-the-principle-of-least-privilege-access.md).

# Achieve the principle of least privilege access

Use Cloud Identity Security in Cortex XSIAM to achieve least privilege access.

{% hint style="info" %}
Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license.
{% endhint %}

#### Overview

Cloud Identity Security uses audit logs to detect unused permissions. The Review Unused Permissions feature can help you analyze audit logs in order to identify and revoke excessive permissions. This allows you to generate precise IAM policies based on actual usage, reducing your attack surface and strengthening your overall security posture. You can customize the time frame for used permissions according to your specific operational needs.

The Review Unused Permissions feature is supported for these platform entities:

* **Amazon AWS:**
  * IAM roles
  * IAM groups
* **Microsoft Azure:**
  * Service principals
  * IAM groups
* **Google Cloud Platform (GCP):**
  * GCP groups
  * Service accounts

Cloud Identity Security does the following:

* Analyzes last access data in order to detect the permissions that are being used.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>In the case of Amazon AWS, Cloud Identity Security also uses AWS Identity and Access Management (IAM) Access Advisor insights to expand the coverage of supported actions.</p></div>
* Recommends the removal of unused permissions, displaying recommended actions, such as **Keep** and **Remove**.
* Generates downloadable policies in:
  * **Amazon AWS:** IAM Policy (JSON), HashiCorp® Terraform, CloudFormation
  * **Microsoft Azure:** Role Definition and Role Assignment (JSON), HashiCorp® Terraform
  * **Google Cloud Platform (GCP):** IAM Policy (JSON), HashiCorp® Terraform

#### Reviewing Unused Permissions

1. In the Cloud Identity Security module, under **Identity Asset Inventory**, on the **Cloud Identities** tab, select an identity in the list whose permissions you want to review.
2. On the **Overview** tab, in the **Review Unused Permissions** area, click **Analyze Permissions Usage**, and select a time period in the list.
3. Click **Start Analysis**.
4. On the **Permission Checkup Results** screen, a summary of permissions usage is displayed according to the time period you selected, with the suggested **Remove** number in red and the recommended **Keep** number in blue.
5. If you want to proceed with seeing the recommended changes and how you could reduce unused permissions, click **Adjust Policy**, and select one of these formats in the list:
   * JSON
   * Terraform
   * CloudFormation (for AWS only)
6. A code block with the format you chose now appears. You can do one of the following:
   * Click **Download File** to save a copy of the file.
   * Click **Copy to clipboard** and then paste the code into a file of your choice.
7. You can now click **Back to Checkup Result** to return to the previous screen. You can review the policy list to see and consider the **Cortex Recommendation** column, which displays either **Remove** or **Keep** for each policy file.

{% hint style="info" %}

### Important

If you turn off the audit logs, even briefly, this temporarily impacts the accuracy of the Last Access data, potentially showing permissions as unused when actually they were active. Full accuracy is restored 90 days after you re-enable the audit logs.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-identity-security/achieve-the-principle-of-least-privilege-access.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.