Permissions reference

AWS

Default connection grants: ReadOnlyAccess

Permissions still being resolved

76 call sites have an action chosen at runtime or an endpoint scope that the inventory could not establish. These calls are outside the verified default grant.

Google Cloud

Default connection grants: roles/cloudasset.viewer, roles/compute.viewer, roles/monitoring.viewer, roles/recommender.viewer, roles/logging.viewer, roles/browser, roles/bigquery.jobUser, roles/bigquery.dataViewer, roles/container.viewer, roles/cloudsql.viewer, roles/storage.bucketViewer, roles/run.viewer, roles/cloudfunctions.viewer, roles/pubsub.viewer, roles/artifactregistry.reader, roles/redis.viewer, roles/file.viewer, roles/appengine.appViewer

roles/bigquery.jobUser lets Zaysa read the query jobs it creates for billing. The scanner list calls use service-specific viewer roles, including roles/storage.bucketViewer for bucket listing. Additional viewer roles remain for dynamic scanner calls.

Permissions still being resolved

68 call sites have an action chosen at runtime or an endpoint scope that the inventory could not establish. These calls are outside the verified default grant.

Azure

Default connection grants: Reader, Cost Management Reader

Microsoft Graph Directory.Read.All is an Entra API permission, not an Azure RBAC role. It is optional: without it, principal IDs appear instead of names. Reading billing export blobs needs Storage Blob Data Reader at the storage account.

Private ACR image on a Web App or Function App

After the app and registry exist, an Owner or User Access Administrator runs this once in Azure Cloud Shell. Replace the three names before running it. For a Function App, change az webapp identity assign to az functionapp identity assign. The deploy identity uses the resulting AcrPull grant and cannot assign roles itself. If a first deploy creates the app, run this step after that deploy reports the missing grant, then rerun the deploy.

# One time, run by an owner (needs Owner or User Access Administrator): let the app pull from its private registry.
# The Zaysa deploy identity cannot assign roles, so it never does this itself; it only uses the assignment.
(
set -e
APP='YOUR-WEB-APP'
APP_RG='YOUR-RESOURCE-GROUP'
ACR_NAME='yourregistryname'
PRINCIPAL_ID="$(az webapp identity assign --name "$APP" --resource-group "$APP_RG" --query principalId -o tsv)"
ACR_ID="$(az acr show --name "$ACR_NAME" --query id -o tsv)"
HAVE="$(az role assignment list --scope "$ACR_ID" --query "[?principalId=='$PRINCIPAL_ID' && roleDefinitionName=='AcrPull'] | length(@)" -o tsv)"
if [ "$HAVE" = "0" ]; then az role assignment create --assignee-object-id "$PRINCIPAL_ID" --assignee-principal-type ServicePrincipal --role AcrPull --scope "$ACR_ID" >/dev/null; fi
echo "AcrPull assigned: $APP -> $ACR_NAME"
)

Permissions still being resolved

61 call sites have an action chosen at runtime or an endpoint scope that the inventory could not establish. These calls are outside the verified default grant.

DigitalOcean

Default connection grants: Read Only token

A Read Only token covers scans and history. AutoStopping, approved fixes and Beam changes require a Full Access token for the identity that performs them.

Permissions still being resolved

45 call sites have an action chosen at runtime or an endpoint scope that the inventory could not establish. These calls are outside the verified default grant.

Kubernetes and OpenShift

Default connection grants: none. Configure cluster access separately.

Permissions still being resolved

51 call sites have an action chosen at runtime or an endpoint scope that the inventory could not establish. These calls are outside the verified default grant.