VS Code

Integrate the Prisma Cloud Code Security plugin (plugin) for VS Code IDE (IDE) to seamlessly enhance security while coding, allowing you to identify issues before you commit your code, reducing the risk of pull requests failing due to undetected issues. Prisma Cloud scans for security policy violations based on both default, out-of-the-box and custom policies.

Choose Your Security Level

• Enhanced Security with Prisma Cloud Integration (Recommended): For comprehensive security analysis, connect the plugin to Prisma Cloud using your Prisma Cloud Access Key and Secret Key. This unlocks the full power of Prisma Cloud’s security features.
• Basic Open Source Functionality: If you prefer not to use an access credentials, you can still benefit from the plugin’s basic open-source features. These features provide a foundational level of security analysis, helping you identify common vulnerabilities. However, you will not have access to Prisma Cloud.

For default policies, refer to the Policies documentation.

For information on creating custom policies, refer to Custom Build Policies.

Supported Scan Categories

The plugin utilizes Prisma Cloud’s capabilities to scan these security categories:

• IaC misconfigurations in IaC templates such as Kubernetes and Terraform. For a list of supported IaC frameworks see Supported Technologies
• SCA vulnerabilities: Includes security issues in both direct and transitive open-source dependencies
• Secrets: Security vulnerabilities in your base images
• Licenses: Software license noncompliance

Prerequisites

1. Permissions.

   1. To integrate the plugin, Developer, AppSec Admin or System Administrator roles are required.
   2. For GRBAC, provide the following permissions in a Permission Group.

      • Policies: Policies - 'View' permissions
      • Application Security: Projects - 'View' permissions
      • Settings: Providers - ('View' and 'Create') OR ('View' and 'Update') permissions

        For information about roles and permissions on Prisma Cloud, refer to Prisma Cloud Administrator Permissions.
2. Environment Setup.

   • On Mac: Install Python 3.9.x to 3.12.x, Pipenv, or a running Docker daemon
   • On Windows: Install Python 3.9.x to 3.12.x or a running Docker daemon

     The plugin automatically invokes the latest version of Prisma Cloud Code Security.
3. On Prisma Cloud.

   • Add the Prisma Cloud IP addresses and hostname for Application Security to an allow list to enable access to the Prisma Cloud console
   • Generate and copy the Prisma Cloud access key to enable access to Prisma Cloud. The access key includes a key ID and secret
   • Retrieve your Prisma Cloud API URL, which varies depending on the region and cluster on which your tenant is deployed

     For Prisma Cloud API URL, replace app in the URL with api.

Installation

You can install the plugin directly through your IDE or the Visual Studio Marketplace.

After completing the installation, restart your IDE if prompted.

Install through VS Code IDE

1. In your IDE, open the Extensions panel > search for Prisma Cloud > Install.

Install from the Visual Studio Marketplace Website

1. Option #1: Access the Prisma Cloud extension directly on the Visual Studio Marketplace

   Option #2: Access the Marketplace from the Prisma Cloud console:

   In Application Security, select Settings > Connect Provider > Code & Build Providers > VScode (under IDEs).
2. In the Marketplace, search for Prisma Cloud > select the Prisma Cloud plugin.
3. Select Install > Open Visual Studio Code.app. You are redirected to the Prisma Cloud extension on VS Code.
4. Click Install.

Configure Plugin Settings

This section guides you through configuring the plugin. The configuration process depends on whether you’re using the open-source or proprietary version. For the proprietary version, to establish a secure connection between your environment and Prisma Cloud, you are required to provide the following credentials: Access Key, Secret Key and Prisma URL values. The open-source project does not require these settings.

Enforcement rules and CA certificates are not applicable to the open-source project.

1. Navigate to the bottom menu bar of your VS Code editor and select the Prisma Cloud tab to access Settings or click the Settings icon.

   
2. Fill in the provided fields:

   • Access Key: The Prisma Cloud access key ID generated as part of the Prisma Cloud prerequisites above
   • Secret Key: The Prisma Cloud secret key generated as part of the Prisma Cloud prerequisites above
   • Prisma URL: Your Prisma URL - see Prisma Cloud prerequisites above
   • Checkov Version: Leave blank to use the latest Checkov version (or enter 'latest'), or specify a version like 2.0.123
   • Disable Error Message Popups: Hide error message popups
   • Certificate: Add the CA certificate. Format: .pem file
   • Use Enforcement Rules: Enforce soft-fail thresholds set by Enforcement apply for VS Code scans

     Hard-fail and comment bot are not supported by the IDE. For more information on Enforcement, refer to the Enforcement documentation.
   • External Checks Directory: Provide the path to a folder containing custom security checks
   • Skip SSL Verification: Bypass SSL certificate verification for troubleshooting purposes in test environments ONLY. This is highly discouraged in production environments as it exposes you to potential security risks, since invalid and falsified certificates will not be detected
   • Specific Frameworks: Scan specific frameworks such as arm json secrets serverless. You can add multiple frameworks using spaces between the values in the command. Refer to Checkov CLI Command Reference for more information
   • SAST Full Scan Size Limit: Set a threshold (in MB), above which SAST scans will not run on a repository. This setting is currently available for Beta customers only.

UI Layout

Select the Prisma Cloud icon from the extension panel to access the plugin. The UI includes the following sections:

• Left pane: The Navigation panel featuring a tree structure displaying issues by security category (IaC misconfigurations, Secrets, Vulnerabilities (SCA), and Licenses). Each category expands to reveal folders containing specific issues detected during a scan
• Middle pane: The Code editor. Allows you to review your codebase, and view a list of findings related to a resource (for IaC misconfigurations) or file, along with remediation options
• Right pane: The Problems Tool. Provides a detailed view of a selected issue, including information such as the code difference when available, and Remediation options

Usage

The Prisma Cloud Security extension allows you to conduct comprehensive scans, manage findings efficiently, and remediate issues, all within your coding environment. You can prioritize findings and address the most critical issues by filtering the scan results based on category and severity.

Scans

Code scans can be performed on an entire project or selected files.

• Full scan: Click the Play button in any of the security categories (IaC, Secrets and so on) in the Navigation panel to initiate a scan of the entire project

  Initiating a scan from a specific category scans all security categories.
• File scan: Open or save a specific file to trigger a scan exclusively for that file

Findings

You can manage findings through either the Code editor or the Problems Tool. Findings are grouped by security category in the Navigation panel for easy browsing. Click on a specific folder or subsequent subfolders to view all the findings within that folder. Select an issue to reveal details in both the Code editor and Problems Tool. You can filter findings in the Navigation panel by severity, by selecting the filter icon next to a security category. Severity values: 'Critical', 'High', 'Medium', 'Low' amd 'Info'.

Manage Findings through the Code editor

• IaC misconfigurations: A red mark beside a line number indicates an issue within a resource. Hover over the mark to display the detected issue and its severity. If multiple issues are detected in a resource, you can scroll to view all of them. Available remediation options are displayed. To display a detailed view of the issue in the Problems Tool, click Console

  
• SCA vulnerabilities: A red mark next to a line number indicates a vulnerability within a package on that line. A list of vulnerabilities is displayed if more than one vulnerability has been detected. Hover over the marker to reveal detailed information about the first CVE vulnerability, including the CVE identifier, severity, vulnerable package and version, fixed version, and root package and version. Remediation options are also displayed. To display a detailed view of the issue in the Problems Tool, click Console

  
• Licenses: A red mark next to a line number indicates license non-compliance within a package on that line, and the severity of the issue. Remediation options are displayed. To display a detailed view of the issue in the Problems Tool, click Console
• Secrets: A red mark next to a line number indicates a secret detected in the file, including the severity of the finding. Remediation options are displayed. To display a detailed view of the issue in the Problems Tool, click Console

Manage Findings through the Problems Tool

The Problems Tool provides a detailed view of selected issues, including available remediation options. For more details on each type of finding see Code editor findings above.

You can access the Problems Tool by selecting an issue in the navigation bar or through the Console option in the Code editor

You may need to scroll down the Problem Tools pane to access remediation options.

Remediation

You can mitigate issues directly through both the Code editor or the Problems Tool. Options include Fix, Suppress, or Documentation.

Not all types of remediation are available for all issues.

Fixes

When selecting an issue in either the Code editor and Problems Tool, a suggested fix is displayed when available. Fixes are automatically applied to the code upon selection. The following list displays the type of fix available for the different categories of issues.

• IaC misconfigurations: The fix modifies the configuration. The Problems Tool displays the code difference to be fixed
• SCA vulnerabilities: The fix bumps the package version. You can directly fix the specific CVE vulnerability that has been detected during the scan by upgrading the package to the version that includes a fix
• Secrets issues: Follow the policy guidelines
• License mis-compliance: Follow the policy guidelines

Suppression

Suppress an issue to temporarily hide or ignore an issue without fixing it, allowing you to concentrate on more important issues.

The suppression is scoped to the file.

1. Before you begin, enable Developer Suppressions on the Prisma Cloud console.

   1. In Application Security, select Settings > Application Security under 'Configure' in the left navbar.
   2. Scroll down to Developer Suppressions and toggle the switch button ON.
2. In the IDE, select an issue from the Navigation bar > Suppress from either the Code editor or Problems Tool.
3. Provide a justification for the suppression> press Enter to confirm.

   The justification will be added as a commented annotation to your source code.

After suppressing an issue, the file will not be scanned for two minutes. This is to prevent the issue from being re-triggered. Saving the file during the hold period will not trigger a scan.

For more information on Suppression, refer to the Suppression documentation.

Documentation

If automated fixes are not available, policy documentation can provide guidance on how to address the issue: Select an issue > Documentation. You are redirected to the relevant policy documentation which includes suggested guidelines on how to solve the issue.