As a Falcon Administrator, you must add access for an analyst to review cloud control...

To allow an analyst to reviewcloud control plane Indicators of Misconfiguration (IOMs)while maintaining least-privilege access, CrowdStrike recommends assigning theCSPM Misconfiguration Viewerrole.

Cloud control plane IOMs focus on identifying insecure configurations across cloud providers, such as overly permissive IAM roles, disabled logging, public exposure of services, or noncompliant security settings. The CSPM Misconfiguration Viewer role grantsread-only accessto these findings, allowing analysts to investigate risks without making configuration changes.

Other roles provide broader access than required.Cloud Security Managerincludes administrative and modification privileges, exceeding least-privilege requirements.Kubernetes and Containers Managerfocuses on container and Kubernetes security, not cloud control plane configurations.Cloud Compliance Vieweris oriented toward compliance frameworks rather than detailed misconfiguration analysis.

By assigning the CSPM Misconfiguration Viewer role, organizations ensure analysts can perform their investigative duties safely and appropriately, aligning with CrowdStrike’s role-based access control (RBAC) best practices.