HasPermission

EFFECTIVE permission (post evaluation) of an action on a target. Produced by the permission engine / effective-permission evaluator.

identity_authz AUTHORIZATION nature: both walkable weight 1

Identity ── HasPermission ──▸ *

Source types

Identity

Target types

*

States

ACTIVE CONDITIONAL POTENTIAL BLOCKED UNKNOWN

Derivation

nature	both

Rules that emit HasPermission 62

aws-account-can-put-contact

awsexplicit

aws-account-can-put-alternate-contact

awsexplicit

aws-account-can-start-primary-email-update

awsexplicit

aws-account-can-leave-org

awsexplicit

aws-account-can-remove-from-org

awsexplicit

aws-gd-explicit-delete-detector

Principal holds effective IAM permission to delete GuardDuty detector.

awsexplicit

aws-gd-explicit-update-detector

Principal holds effective IAM permission to update GuardDuty detector (including Enable=false).

awsexplicit

aws-gd-explicit-create-filter

Principal holds effective IAM permission to create GuardDuty filters.

awsexplicit

aws-gd-explicit-update-filter

Principal holds effective IAM permission to update GuardDuty filters.

awsexplicit

aws-gd-explicit-create-ipset

Principal holds effective IAM permission to create GuardDuty trusted-IP sets.

awsexplicit

aws-gd-explicit-update-ipset

Principal holds effective IAM permission to update GuardDuty trusted-IP sets.

awsexplicit

aws-gd-explicit-update-publishing-destination

Principal holds effective IAM permission to update GuardDuty publishing destination.

awsexplicit

aws-gd-explicit-update-findings-feedback

Principal holds effective IAM permission to update GuardDuty findings feedback (mark as FALSE_POSITIVE).

awsexplicit

aws-gd-explicit-disassociate-from-admin

Principal holds effective IAM permission to disassociate from GuardDuty delegated administrator (member account action).

awsexplicit

aws-gd-explicit-disassociate-members

Principal holds effective IAM permission to disassociate member accounts from GuardDuty (admin account action).

awsexplicit

aws-gd-explicit-list-findings

Principal holds effective IAM permission to list GuardDuty findings.

awsexplicit

aws-gd-explicit-get-findings

Principal holds effective IAM permission to retrieve GuardDuty findings details.

awsexplicit

aws-lf-admin-list

awsexplicit

aws-lf-existing-grants

awsexplicit

aws-lf-put-datalake-settings-permission

awsexplicit

aws-ram-accept-invitation

awsexplicit

azure-appconfig-has-permission-read

azureexplicit

azure-appconfig-has-permission-listkeys

azureexplicit

azure-appconfig-has-permission-write

azureexplicit

azure-cosmosdb-listkeys-permission

azureexplicit

azure-cosmosdb-listconnectionstrings-permission

azureexplicit

azure-cosmosdb-readonlykeys-permission

azureexplicit

azure-cosmosdb-sqlrole-assignment-write-permission

azureexplicit

azure-cosmosdb-account-write-permission

azureexplicit

azure-cosmosdb-data-plane-read-permission

azureexplicit

azure-cosmosdb-data-plane-write-permission

azureexplicit

azure-kv-access-policy-secret-get

azureexplicit

azure-kv-access-policy-key-crypto

azureexplicit

azure-kv-eff-secret-get

azureexplicit

azure-kv-eff-key-decrypt

azureexplicit

azure-kv-eff-key-unwrap

azureexplicit

azure-kv-eff-key-sign

azureexplicit

azure-kv-eff-accesspolicies-write

azureexplicit

azure-mg-eff-owner

azureexplicit

azure-mg-eff-write

azureexplicit

azure-mg-eff-subscriptions-write

azureexplicit

azure-mg-eff-policy-write

azureexplicit

azure-rediscache-effective-listkeys-permission

azureexplicit

azure-rediscache-effective-write-permission

azureexplicit

azure-rediscache-effective-firewallrules-write-permission

azureexplicit

azure-rediscache-effective-regeneratekey-permission

azureexplicit

azure-storage-listkeys-permission

azureexplicit

azure-storage-listaccountsas-permission

azureexplicit

azure-storage-blob-read-permission

azureexplicit

azure-storage-blob-write-permission

azureexplicit

azure-storage-queue-read-permission

azureexplicit

azure-storage-queue-write-permission

azureexplicit

azure-storage-table-read-permission

azureexplicit

azure-storage-file-read-permission

azureexplicit

azure-storage-generate-user-delegation-key-permission

azureexplicit

gcp-scc-explicit-settings-update

Principal holds effective securitycenter.settings.update permission at org or project scope.

gcpexplicit

gcp-scc-explicit-muteconfig-write

Principal holds effective securitycenter.muteconfigs.create or .update permission.

gcpexplicit

gcp-scc-explicit-finding-state

Principal holds effective securitycenter.findings.setState or .setMute permission.

gcpexplicit

gcp-scc-explicit-read

Principal holds effective securitycenter.findings.list permission (recon-only read).

gcpexplicit

gcp-scc-explicit-assets-list

Principal holds effective securitycenter.assets.list permission (recon-only read).

gcpexplicit

gcp-scc-explicit-notificationconfig-delete

Principal holds effective securitycenter.notificationconfigs.delete permission to delete notification routing configs.

gcpexplicit

gcp-scc-explicit-notificationconfig-update

Principal holds effective securitycenter.notificationconfigs.update permission to modify notification routing.

gcpexplicit