AWS CodeCommit
Integrate Prisma Cloud with your AWS CodeCommit version control system (VCS) to gain visibility into, and monitor the systems, technologies, configurations, and pipelines that make up the AWS CodeCommit platform. This integration enables security scans to identify Infrastructure-as-Code (IaC) misconfigurations, Software Composition Analysis (SCA) vulnerabilities, license non-compliance, exposed secrets and CI/CD pipeline risks in your AWS CodeCommit platform, allowing you to contextualize, prioritize and mitigate issues as soon as they are detected, resulting in an enhanced security posture for your organization.
Authorization Process Overview
During integration, Prisma Cloud provides you with a CloudFormation (CFN) template for deploying your AWS account. Once deployed, the CFN template will establish the following components in your environment:
An IAM role configured with access to AWS CodeCommit
An Simple Notification Service (SNS) topic with an HTTP subscription to the Prisma Cloud webhook URL
Subsequently, every CloudFormation event occurring in your account, including 'Creation', 'Update' and 'Deletion', will trigger an SNS event. This event will be sent to the Prisma Cloud AWS account.
Before you begin.
Grant the Prisma Cloud user the necessary permissions for integrating Prisma Cloud with your AWS CodeCommit VCS, as specified in User Permissions below.
Add the Prisma Cloud IP addresses and hostname for Application Security to an allow list to enable access to the Prisma Cloud Console.
Due to CloudFormation’s constraints, SNS events for creations, deletions and other actions must reside in the same region as the stack. To accommodate situations where a customer’s Prisma Cloud account and stack are in different regions, an SNS topic must be generated for each accessible region.
In the context of AWS, a 'stack' refers to a collection of AWS resources that are created, updated, and deleted together as a single unit. This allows for the management of related resources as a cohesive unit, making it easier to provision and manage complex infrastructure deployments.
On the Prisma Cloud console.
In Application Security, select Settings > Connect Provider > Code & Build Providers.
Select AWS CodeCommit (under Code Repositories) in the catalog that is displayed.
The AWS CodeCommit integration wizard is displayed, providing instructions to perform the next integration steps in your AWS console.
Create a stack on the AWS console.
Open CloudFormation or copy and send the link to your administrator.
A stack template pre-prepared by Prisma Cloud is displayed.
Provide the stack name.
The Resource Name Prefix and ExternalID fields are pre-populated. You can modify the Resource Name Prefix, but DO NOT change the ExternalID!
Select Create Stack.
Verify successful integration with Prisma Cloud. There are two options.
Option 1: On Prisma Cloud. Access the wizard: In Application Security, select Home > Settings > Connect Provider > Code & Build Providers > AWS CodeCommit.
Confirm that the integration is displayed.
Option 2: On AWS. Open Cloudformation > Stacks. Verify in the list that that the integration is displayed with a success status.
Select the repositories to be scanned from the Prisma Cloud console.
Navigate to Settings > Connect Provider > Code & Build Providers > AWS CodeCommit.
Click Select repositories in the menu under the integration’s Actions column.
The Add Repositories step of the integration wizard is displayed.
Select an option:
Permit all existing repositories
Permit all existing and future repositories. This is the recommended option to ensure complete coverage and successful operation of all features.
Choose from repository list > Select repositories
Select Done to complete the integration.
Next step: Monitor and manage scan results.
View your selected AWS CodeCommit repositories on the Repositories page. The next AWS CodeCommit scan will include these repositories
View scan results and resolve issues in the Projects page: In Application Security select Home > Projects. See Monitor and Manage Code Build Issues for more information about mitigating issues
Support for Multiple Integrations
Prisma Cloud supports multiple integrations for multiple AWS CodeCommit accounts.
Multiple integrations from a single Prisma Cloud account enables you to:
View a list of integrations on a single console
Add additional integrations
Delete an existing integration
Selecting a repository for a specific integration will restrict you from selecting the same repository in another integration.
In Application Security, select Home > Settings > Connect Provider > Code & Build Providers > AWS CodeCommit (under Code Repositories).
Select Add Integration in the wizard.
Execute the AWS CodeCommit integration process above.
Next step: Monitor and manage scan results - see step 7 of the integration process above.
Manage Integrations
You can reselect repositories or delete an integration.
In Application Security, select Settings > Code & Build Providers > AWS CodeCommit.
Select the menu under the 'Actions' column of the required integration.
Perform an action:
Reselect repositories: Access and modify the list of repositories to be scanned
Delete integration: Delete an integration
User Permissions
Authorize the user integrating Prisma Cloud with your AWS CodeCommit instance with the following permissions.
CodeCommit Permissions
These permissions pertain to various actions and operations within AWS CodeCommit.
codecommit:GitPull: Allows users to pull Git repository changes
codecommit:ListBranches: Grants the ability to list branches within a repository
codecommit:GetBranch: Required to get details about a branch in a repository
codecommit:GetPullRequest: Enables fetching details of a specific pull request
codecommit:GetFolder: Required to view the contents of a specified folder in a repository from the CodeCommit console
codecommit:GetFile: Required to view the encoded content of an individual file and its metadata in a repository from the CodeCommit console
codecommit:GetBlob: Allows fetching of an object (such as a file) from a repository
codecommit:GetCommitsFromMergeBase: Grants access to commits from the merge base of a branch
codecommit:GetCommentsForPullRequest: Allows retrieval of comments associated with a pull request
codecommit:PostCommentReply: Required to create a reply to a comment on a comparison between commits or on a pull request
codecommit:UpdateComment: Allows updating of comments on pull requests
codecommit:PostCommentForPullRequest: Required to post a comment on a pull request in a repository
codecommit:GetComment: Permits retrieval of a specific comment on a pull request
codecommit:GetCommit: Allows fetching details of a specific commit
codecommit:GetDifferences: Grants access to differences (changes) between commits, branches, and so on
codecommit:BatchGetRepositories: Enables batch retrieval of repository details
codecommit:GetRepository: Permits fetching details of a specific repository
codecommit:ListRepositories: Grants the ability to list repositories within an account
codecommit:GetRepositoryTriggers: Allows fetching of triggers configured for a repository
codecommit:PutRepositoryTriggers: Enables configuration of repository triggers
codecommit:TestRepositoryTriggers: Allows testing of repository triggers
codecommit:GetTree: Required to view the contents of a specified tree in a repository from the CodeCommit console. This is an IAM policy permission only, not an API action that you can call
codecommit:GetReferences: Permits fetching of references (branches, tags, etc.) in a repository
codecommit:GetObjectIdentifier: Grants access to object identifiers within a repository
codecommit:GetCommitHistory: Allows fetching of commit history for a repository
codecommit:BatchGetPullRequests: Required to return information about one or more pull requests in a repository. This is an IAM policy permission only, not an API action that you can call
codecommit:BatchGetCommits: Enables batch retrieval of commit details
codecommit:GetCommentsForComparedCommit: Required to return information about comments made on the comparison between two commits in a repository
codecommit:PostCommentForComparedCommit: Required to create a comment on the comparison between two commits in a repository
codecommit:PostCommentReply: Enables posting replies to comments on pull requests
codecommit:ListPullRequests: Required to return information about the pull requests for a repository
codecommit:DeleteCommentContent: Required to delete the content of a comment made on a change, file, or commit in a repository. Comments cannot be deleted, but the content of a comment can be removed if the user has this permission
codecommit:CreateBranch: Permits creation of branches within a repository
codecommit:GetBranch: Permits retrieval of branch details
codecommit:CreateCommit: Allows creation of commits in a repository
codecommit:CreatePullRequest: Enables creation of pull requests in a repository
codecommit:PutFile: Required to add a new or modified file to a repository from the CodeCommit console, CodeCommit API, or the AWS CLI
codecommit:ListAssociatedApprovalRuleTemplatesForRepository: Grants access to associated approval rule templates for a repository
codecommit:ListApprovalRuleTemplates: Allows listing of approval rule templates
codecommit:GetApprovalRuleTemplate:Required to return information about an approval rule template in an Amazon Web Services account
codecommit:ListRepositoriesForApprovalRuleTemplate: Permits listing of repositories associated with an approval rule template
CI/CD Module Permissions
These permissions are essential for the CI/CD module in order to manage access control, user permissions, and organizational policies within the AWS environment through IAM.
iam:ListPolicies: Allows listing of IAM policies within the AWS account
iam:ListGroupPolicies: Permits listing of group policies attached to IAM groups
iam:ListPoliciesGrantingServiceAccess: Enables listing of policies granting access to specific AWS services
organizations:ListPolicies: Grants access to listing of policies within AWS Organizations
organizations:ListDelegatedAdministrators: Allows listing of delegated administrators within AWS Organizations
organizations:ListAccounts: Permits listing of member accounts within AWS Organizations
iam:ListRoles: Enables listing of IAM roles within the AWS account
iam:ListGroupsForUser: Allows listing of IAM groups that a specified user belongs to
iam:ListUsers: Permits listing of IAM users within the AWS account
iam:ListGroups: Grants access to listing of IAM groups within the AWS account
iam:ListRolePolicies: Allows listing of policies attached to IAM roles
iam:GetAccountAuthorizationDetails: Permits fetching of details related to account authorization within IAM
Last updated
Was this helpful?