Infrastructure as Code (IaC) Security

Prisma Cloud IaC security is built on the open source project Checkov. Checkov is a policy-as-code tool with millions of downloads that checks for misconfigurations in IaC templates such as Terraform, CloudFormation, Kubernetes, Helm, ARM Templates and Serverless framework. Users can leverage hundreds of out-of-the-box policies and add custom rules. Prisma Cloud augments Checkov with simplified user experience and enterprise features.

• Check for policy misconfigurations

  Checkov checks IaC templates against hundreds of out of the box policies based on benchmarks, such as CIS, HIPAA, PCI, and community sourced checks.

• Leverage context aware policies

  Checkov’s policies include graph-based checks that allow multiple levels of resource relationships for complex policies such as higher severity levels for internet facing resources.

• Extend capabilities and integrations

  Checkov is designed to be extensible, with the ability to add custom policies and tags, as well as CLIs designed to be added to continuous integration and other DevOps tools.

• Integrate with Prisma Cloud to extend its capabilities

  Prisma Cloud augments Checkov’s open source capabilities with a history of scans, additional integrations, auto-fixes, Smart Fixes and more

When developers are moving as fast as possible to meet deadlines, providing policy violations without explanation just causes frustration. Prisma Cloud includes automatic remediations for many policies along with guidelines for all policies to provide the details to get misconfigurations fixed.

• Context aware visibility and policies

  Prisma Cloud surfaces policy violations for resources and the dependencies, and policies can be based on context such as higher severity for internet exposed violations, helping with prioritization.

• Provide actionable guidance

  Each policy violation comes with actionable guidelines about the misconfiguration along with guidance to remediate the issue.

• Trace cloud to code with code owners for faster remediation

  Cloud resources are traceable back to IaC templates with the code modifier, to find the right resource and team to remediate issues fast.

• Enable GitOps workflows

  Tracing cloud misconfigurations back to code enables issues identified in runtime to be fixed in code to maintain the benefits of scalability and auditability of IaC templates.