Terraform Cloud (Run Tasks)
Integrate Prisma Cloud with Terraform Cloud (Run Tasks) to allow dynamic, automated, and context-specific scans in your Terraform workspace.
With the integration of Terraform Cloud, Prisma Cloud, scans your Terraform frameworks to identify misconfigurations based on Prisma Cloud’s default policies, as well as custom policies created by your organization for specific needs. This scanning process occurs whenever changes are pushed or triggered in your workflow, ensuring security checks are integrated seamlessly. Prisma Cloud identifies issues such as misconfigurations in your infrastructure-as-code (IaC) files, software composition analysis (SCA) vulnerabilities*, exposed secrets, and license non-compliance as soon as they are introduced.
*Prisma Cloud performs 'Image Referencer' scans to analyze the contents, dependencies, and configurations of container images in order to detect known vulnerabilities, as full SCA scans are not supported for Terraform Cloud (Run Tasks).
Runs in Terraform are performed within a workspace, or a working directory when running Terraform locally. The workspace provides providing the configuration, state, and variables for the run. Terraform Enterprise maintains a run queue, processing runs sequentially. Each run progresses through multiple run stages; pending, plan, cost estimation, policy check, apply, and completion.
Users can monitor the run status (pass/fail) and remediate issues directly on the Prisma Cloud console. Prisma Cloud offers automated shift-left actions such as notifying developers or creating tickets, based on scan results. In addition, you can track the run status on Terraform Enterprise through streamlined run task reviews, which offer detailed descriptions of violations and fixes provided by Prisma Cloud within their Terraform deployment environment. For more information about streamlined tasks, refer to https://www.hashicorp.com/blog/terraform-cloud-adds-streamlined-run-task-reviews.
The following integration includes workflows involving third party tools such as Terraform and GitHub. These are general guidelines only, intended to help you. You must always follow the official third party documentation.
Before you begin.
Procure a license for Prisma Cloud that includes the Application Security module
Procure a Terraform cloud license that is either a trial license or a TF Cloud license at the TEAM & GOVERNANCE level
Permissions: Grant the user or team the following permissions: Manage run tasks permission at the organization level, and either: Manage Workspaces permissions at the organization level or Administrator permissions on the workspace(s) that will be integrated. Manage run tasks is required to create and manage the run task in the organization, and the workspace permissions are required to attach and manage the run task on workspaces.
Create a Terraform Organization.
For information on creating Terraform organizations, refer to the Terraform documentation.
Create a Terraform Workspace.
For information on creating Terraform workspaces, refer to the Terraform documentation.
On Terraform Cloud, create a Terraform api token for your user.
Select your user/profile icon > User Settings.
Select the Tokens section from the left side menu.
Click Create an API token and provide a description > Select Create API token.
Copy and save the token > Done.
Skip this step if you plan on using an existing token.
On the Prisma Cloud Application Security console.
In Application Security, select Home > Settings > Connect Provider > Code & Build Providers.
Select Terraform Cloud (Run Tasks) (under CI/CD Runs) in the catalog that is displayed.
The Configure Account step of the integration wizard is displayed.
Provide your Terraform 'User' or 'Team' token generated in step 1 above > Next.
The Select Organization step of the integration wizard is displayed.
Select a Terraform organization from the menu to establish webhook integrations with Prisma Cloud for Terraform > Next.
The Select Workspace step of the integration wizard is displayed.
Select a Terraform workspace to scan during the Terraform Cloud run lifecycle.
You can select multiple workspaces for Prisma Cloud to scan during the Terraform Cloud run lifecycle. Each integration can only be associated with a single Terraform Cloud organization at any given time. However, you can create multiple integrations with multiple Terraform Enterprise organizations from a single Prisma Cloud account.
Select an option from the Run Stage list:
Post-plan: The scan runs after Terraform generates the plan
Pre-plan: The scan runs before Terraform generates the plan
Prisma Cloud performs a scan of Terraform templates on selected workspaces based on the Run Stage.
Select Next.
The Status step of the integration wizard opens, displaying an integration status message.
Select Done.
On completing the integration, an event hook is created in the Terraform organization to receive run task notifications on Prisma Cloud.
Verify integration: In Application Security, select Home > Settings > CI/CD Runs tab.
Your integrated Terraform repositories will be displayed.
A Terraform Enterprise run may fail if a Run Task configuration for a workspace is set at Mandatory. You can re-configure the severity level using Enforcement.
Next step: Monitor and manage scan results.
Following the integration, the subsequent Terraform scan will automatically incorporate the selected repositories.
To view scan results and resolve issues, select Application Security > Projects > CI/CD Runs tab. Refer to Monitor Code Build Issues for more information.
Manage Integrations
You can view, modify, delete and add integrations. Additionally, it’s important to regularly rotate integration tokens for security purposes.
Access Integration Management
To access integration management, in Application Security, select Settings > Connect Provider > Code & Build Providers > Terraform Cloud (Run Tasks) (under CI/CD Runs).
The Terraform Cloud Run Tasks popup opens, displaying a list of configured accounts.
Modify Integrations
Modify existing integrations by choosing an alternative workspace.
Select the menu under the Actions column of an account.
Click Reselect workspaces.
The Select Workspace step of the integration wizard is displayed.
Select a workspace and complete the remaining steps in the integration wizard.
Add Integrations
Add additional integrations as needed to expand your workflow.
Select the menu under the Actions column of an account.
Select Add an account.
The Configure Account step of the integration wizard is displayed.
Repeat the integration process above.
View Integrations
View a list of integrations on a single console.
The Terraform Cloud Run Tasks popup displays a list of integrations, including their organization and workspace.
Delete Integrations
Select the menu under the Actions column of an organization.
Click Delete integration.
If you have a single integration within the account, deleting the existing integration will delete the account configuration on Prisma Cloud console.
Rotate Integration Tokens
Rotate integration tokens to enhance security and prevent unauthorized access.
Create a PUT request: PUT /code/api/v1/integration/token/<integration_id> with the following body:
To find your <integration_id>:
Select the menu under the Actions column of an organization account.
The integration ID is displayed in the URL bar on the Configure Account step of the integration wizard.
Last updated
Was this helpful?