> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/ides/connect-vscode.md).
# VS Code
Integrate the Prisma Cloud Code Security plugin (plugin) for VS Code IDE (IDE) to seamlessly enhance security while coding, allowing you to identify issues before you commit your code, reducing the risk of pull requests failing due to undetected issues. Prisma Cloud scans for security policy violations based on both default, out-of-the-box and custom policies.
## Choose Your Security Level
* **Enhanced Security with Prisma Cloud Integration** (Recommended): For comprehensive security analysis, connect the plugin to Prisma Cloud using your Prisma Cloud Access Key and Secret Key. This unlocks the full power of Prisma Cloud’s security features.
* **Basic Open Source Functionality**: If you prefer not to use an access credentials, you can still benefit from the plugin’s basic open-source features. These features provide a foundational level of security analysis, helping you identify common vulnerabilities. However, you will not have access to Prisma Cloud.
For default policies, refer to the [Policies](https://docs.prismacloud.io/en/enterprise-edition/policy-reference/get-started-code-sec-policies/get-started-code-sec-policies) documentation.
For information on creating custom policies, refer to [Custom Build Policies](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/governance/custom-build-policies/custom-build-policies.md).
## Supported Scan Categories
The plugin utilizes Prisma Cloud’s capabilities to scan these security categories:
* IaC misconfigurations in IaC templates such as Kubernetes and Terraform. For a list of supported IaC frameworks see [Supported Technologies](/content-collections/application-security/supported-technologies.md)
* SCA vulnerabilities: Includes security issues in both direct and transitive open-source dependencies
* Secrets: Security vulnerabilities in your base images
* Licenses: Software license noncompliance
## Prerequisites
1. Permissions.
1. To integrate the plugin, **Developer**, **AppSec Admin** or **System Administrator** roles are required.
2. For **GRBAC**, provide the following permissions in a [Permission Group](https://docs.prismacloud.io/en/enterprise-edition/content-collections/administration/create-custom-permission-groups).
* *Policies*: **Policies** - 'View' permissions
* *Application Security*: **Projects** - 'View' permissions
* *Settings*: **Providers** - ('View' and 'Create') OR ('View' and 'Update') permissions
For information about roles and permissions on Prisma Cloud, refer to [Prisma Cloud Administrator Permissions](/content-collections/administration/prisma-cloud-admin-permissions.md).
2. Environment Setup.
* On **Mac**: Install [Python](https://www.python.org/downloads/) 3.9.x to 3.12.x, [Pipenv](https://docs.pipenv.org/), or a running [Docker](https://www.docker.com/products/docker-desktop) daemon
* On **Windows**: Install Python 3.9.x to 3.12.x or a running Docker daemon
The plugin automatically invokes the latest version of Prisma Cloud Code Security.
3. On Prisma Cloud.
* Add the Prisma Cloud IP addresses and hostname for Application Security to an [allow list](/content-collections/get-started/console-prerequisites.md) to enable access to the Prisma Cloud console
* [Generate and copy the Prisma Cloud access key](/content-collections/administration/create-access-keys.md) to enable access to Prisma Cloud. The access key includes a key ID and secret
* Retrieve your Prisma Cloud API URL, which varies depending on the region and cluster on which your tenant is deployed
For Prisma Cloud API URL, replace **app** in the URL with **api**.
## Installation
You can install the plugin directly through your IDE or the Visual Studio Marketplace.
After completing the installation, restart your IDE if prompted.
### Install through VS Code IDE
1. In your IDE, open the **Extensions** panel > search for **Prisma Cloud** > **Install**.
### Install from the Visual Studio Marketplace Website
1. **Option #1**: Access the [Prisma Cloud extension](https://marketplace.visualstudio.com/items?itemName=PrismaCloud.prisma-cloud) directly on the Visual Studio Marketplace
**Option #2**: Access the Marketplace from the Prisma Cloud console:
In **Application Security**, select **Settings** > **Connect Provider** > **Code & Build Providers** > **VScode** (under IDEs).
2. In the Marketplace, search for **Prisma Cloud** > select the Prisma Cloud plugin.
3. Select **Install** > **Open Visual Studio Code.app**. You are redirected to the Prisma Cloud extension on VS Code.
4. Click **Install**.
## Configure Plugin Settings
This section guides you through configuring the plugin. The configuration process depends on whether you’re using the open-source or proprietary version. For the proprietary version, to establish a secure connection between your environment and Prisma Cloud, you are required to provide the following credentials: **Access Key**, **Secret Key** and **Prisma URL** values. The open-source project does not require these settings.
**Enforcement** rules and **CA certificates** are not applicable to the open-source project.
1. Navigate to the bottom menu bar of your VS Code editor and select the **Prisma Cloud** tab to access **Settings** or click the **Settings** icon.
2. Fill in the provided fields:
* **Access Key**: The Prisma Cloud access key ID generated as part of the **Prisma Cloud prerequisites** above
* **Secret Key**: The Prisma Cloud secret key generated as part of the **Prisma Cloud prerequisites** above
* **Prisma URL**: Your Prisma URL - see **Prisma Cloud prerequisites** above
* **Checkov Version**: Leave blank to use the latest Checkov version (or enter 'latest'), or specify a version like 2.0.123
* **Disable Error Message Popups**: Hide error message popups
* **Certificate**: Add the CA certificate. Format: `.pem` file
* **Use Enforcement Rules**: Enforce soft-fail thresholds set by Enforcement apply for VS Code scans
Hard-fail and comment bot are not supported by the IDE. For more information on Enforcement, refer to the [Enforcement documentation](/content-collections/application-security/risk-management/monitor-and-manage-code-build/enforcement.md).
* **External Checks Directory**: Provide the path to a folder containing custom security checks
* **Skip SSL Verification**: Bypass SSL certificate verification for troubleshooting purposes in test environments ONLY. This is highly discouraged in production environments as it exposes you to potential security risks, since invalid and falsified certificates will not be detected
* **Specific Frameworks**: Scan specific frameworks such as `arm json secrets serverless`. You can add multiple frameworks using spaces between the values in the command. Refer to [Checkov CLI Command Reference](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html) for more information
* **SAST Full Scan Size Limit**: Set a threshold (in MB), above which SAST scans will not run on a repository. This setting is currently available for Beta customers only.
## UI Layout
Select the Prisma Cloud icon from the extension panel to access the plugin. The UI includes the following sections:
* Left pane: The **Navigation** panel featuring a tree structure displaying issues by security category (IaC misconfigurations, Secrets, Vulnerabilities (SCA), and Licenses). Each category expands to reveal folders containing specific issues detected during a scan
* Middle pane: The **Code editor**. Allows you to review your codebase, and view a list of findings related to a resource (for IaC misconfigurations) or file, along with remediation options
* Right pane: The **Problems Tool**. Provides a detailed view of a selected issue, including information such as the code difference when available, and [Remediation](#remediation) options
## Usage
The Prisma Cloud Security extension allows you to conduct comprehensive scans, manage findings efficiently, and remediate issues, all within your coding environment. You can prioritize findings and address the most critical issues by filtering the scan results based on category and severity.
### Scans
Code scans can be performed on an entire project or selected files.
* **Full scan**: Click the **Play** button in any of the security categories (IaC, Secrets and so on) in the **Navigation** panel to initiate a scan of the entire project
Initiating a scan from a specific category scans all security categories.
* **File scan**: Open or save a specific file to trigger a scan exclusively for that file
## Findings
You can manage findings through either the **Code editor** or the **Problems Tool**. Findings are grouped by security category in the **Navigation** panel for easy browsing. Click on a specific folder or subsequent subfolders to view all the findings within that folder. Select an issue to reveal details in both the Code editor and Problems Tool. You can filter findings in the Navigation panel by severity, by selecting the filter icon next to a security category. Severity values: 'Critical', 'High', 'Medium', 'Low' amd 'Info'.
### Manage Findings through the Code editor
* **IaC** misconfigurations: A red mark beside a line number indicates an issue within a resource. Hover over the mark to display the detected issue and its severity. If multiple issues are detected in a resource, you can scroll to view all of them. Available remediation options are displayed. To display a detailed view of the issue in the Problems Tool, click **Console**
* **SCA vulnerabilities**: A red mark next to a line number indicates a vulnerability within a package on that line. A list of vulnerabilities is displayed if more than one vulnerability has been detected. Hover over the marker to reveal detailed information about the first CVE vulnerability, including the CVE identifier, severity, vulnerable package and version, fixed version, and root package and version. Remediation options are also displayed. To display a detailed view of the issue in the Problems Tool, click **Console**
* **Licenses**: A red mark next to a line number indicates license non-compliance within a package on that line, and the severity of the issue. Remediation options are displayed. To display a detailed view of the issue in the Problems Tool, click **Console**
* **Secrets**: A red mark next to a line number indicates a secret detected in the file, including the severity of the finding. Remediation options are displayed. To display a detailed view of the issue in the Problems Tool, click **Console**
### Manage Findings through the Problems Tool
The Problems Tool provides a detailed view of selected issues, including available remediation options. For more details on each type of finding see **Code editor** findings above.
You can access the Problems Tool by selecting an issue in the navigation bar or through the **Console** option in the Code editor
You may need to scroll down the Problem Tools pane to access remediation options.
### Remediation
You can mitigate issues directly through both the **Code editor** or the **Problems Tool**. Options include **Fix**, **Suppress**, or **Documentation**.
Not all types of remediation are available for all issues.
### Fixes
When selecting an issue in either the Code editor and Problems Tool, a suggested fix is displayed when available. Fixes are automatically applied to the code upon selection. The following list displays the type of fix available for the different categories of issues.
* **IaC misconfigurations**: The fix modifies the configuration. The Problems Tool displays the code difference to be fixed
* **SCA vulnerabilities**: The fix bumps the package version. You can directly fix the specific CVE vulnerability that has been detected during the scan by upgrading the package to the version that includes a fix
* **Secrets** issues: Follow the policy guidelines
* **License** mis-compliance: Follow the policy guidelines
### Suppression
Suppress an issue to temporarily hide or ignore an issue without fixing it, allowing you to concentrate on more important issues.
The suppression is scoped to the file.
1. Before you begin, enable **Developer Suppressions** on the Prisma Cloud console.
1. In **Application Security**, select **Settings** > **Application Security** under 'Configure' in the left navbar.
2. Scroll down to **Developer Suppressions** and toggle the switch button **ON**.
2. In the IDE, select an issue from the Navigation bar > **Suppress** from either the Code editor or Problems Tool.
3. Provide a justification for the suppression> press **Enter** to confirm.
The justification will be added as a commented annotation to your source code.
After suppressing an issue, the file will not be scanned for two minutes. This is to prevent the issue from being re-triggered. Saving the file during the hold period will not trigger a scan.
For more information on Suppression, refer to the [Suppression](/content-collections/application-security/risk-management/monitor-and-manage-code-build/suppress-code-issues.md) documentation.
### Documentation
If automated fixes are not available, policy documentation can provide guidance on how to address the issue: Select an issue > **Documentation**. You are redirected to the relevant policy documentation which includes suggested guidelines on how to solve the issue.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/ides/connect-vscode.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.