Each role is associated with a single permission set. A permission set specifies a set of Aqua operations that can be performed on the resources by users with the associated role(s).

  • The resources are grouped into 4 categories: policies, assets, compliance, and system. 
  • Approximately 25 types of resources are predefined in Aqua, to provide system administrators with highly granular control. The resources are grouped into categories: Policies, Assets, Compliance, and System.
  • The permission set specifies, for each of the resources, one of the following: Edit permission, View Only permission, or no permission at all. Editing includes the creation, modification, and deletion of the item in question.

Permission set components: access selector and permissions

A permission set consists of an access selector and a detailed set of permissions.

Access selector

The access selector defines whether the permission set includes access to functionality in:

  • Both the UI and the API
  • Only the API


Checking the option Full Permission grants the permission set Edit permission on all Aqua functionality, in both the UI and the API.

If Full Permission is not granted, permissions are granted to individual items arranged in these categories: Policies, Assets, Compliance, and System. Each item is assigned any of these permissions:

  • Edit: Generally includes the viewing, listing, creation, modification, and deletion of the item in question (either in the UI or via relevant APIs). The meaning of "Edit" is slightly different in some cases, and "Edit" does not apply to every item.
  • View Only: Includes viewing only of the item in question
  • Not Set: No permissions; the item will not even appear in the UI (default)


ItemEditView Only
Assurance PoliciesCreate, modify, and delete Assurance Policies (e.g., Image Assurance Policies)View existing Assurance Policies
Image Profiles

Create, modify, and delete Image Profiles

View existing Image Profiles
Firewall PoliciesCreate, modify, and delete Firewall PoliciesView existing Firewall Policies
Runtime PoliciesCreate, modify, and delete Runtime Policies (e.g., Container Runtime Policies)View existing Runtime Policies
Response PoliciesCreate, modify, and delete Response PoliciesView existing Response Policies


ItemEditView Only
DashboardConfigure the dashboardView the dashboard
Risk ExplorerN/AView the Risk Explorer
ImagesAdd (register) images to Aqua; remove images; profile containersView images already registered to Aqua
Host imagesAdd (register) host images to Aqua; remove host imagesView unregistered host images in the Images screen (Host Images tab); view host images under Compliance / Host Images
FunctionsAdd (register) functions to AquaView functions
EnforcersAdd, modify, and remove Enforcer groups and EnforcersView existing Enforcer groups and Enforcers
ContainersN/AView containers and running workloads
ServicesAdd, modify, and remove Aqua servicesView existing Aqua services
InfrastructureView Infrastructure and run discovery of clusters and hostsView Infrastructure (clusters and hosts)


ItemEditView Only
VulnerabilitiesView and acknowledge vulnerabilities discovered during scanningView vulnerabilities discovered during scanning
CIS and DISA STIG BenchmarksView and trigger benchmark scansView benchmark scans in the UI


ItemEditView Only
Audit EventsN/AView audit events
SecretsCreate, modify, and delete secretsView existing secrets
SettingsView and modify settings, as well as Gateway, Access Management, and Application Scopes
View the Settings UI screen
IntegrationsView and modify Integrations (with exception of image registry integrations)View the Administration > Integrations UI screen
Image Registry IntegrationsView and modify image registry integrations
View the Administration > Integrations UI screen
Scanner CLIN/AThe permissions required by the Aqua Scanner on the Aqua Server
Webhook authorization APIN/APermission to use the Webhook authorization API
View the Incidents UI screen

Defining and managing permission sets

A permission set can be created, modified, and deleted. Additionally, you can view all the predefined permission sets in the console. To know more about these operations, see Permission Set Operations.