License Compliance in Software Composition Analysis (SCA)
Open source software licenses define the terms under which open source software can be used, modified, and distributed. Therefore, when selecting an open source package, it’s crucial to understand the types of licenses and the associated user restrictions to mitigate any potential compliance issues.
In Prisma Cloud, licenses are scanned as part of the Software Composition Analysis (SCA) vulnerability scan for open source packages. License restrictions for each package are determined either at the root package (direct dependent package) or at the sub-dependent package level.
By default, license policies are disabled. To enable them, refer to Enable/Disable License Policies below.
License Types
Prisma Cloud offers three types of default license policies out of the box, providing comprehensive coverage for managing license compliance within your environment. Within each license type, SPDX identifiers are organized and sorted based on their characteristics and attributes. This sorting method helps effectively categorize and identify software packages distributed under each specific license type, enabling precise management of license compliance.
Weak Copyleft Licenses policies (Medium severity): Identifies software packages distributed under weak copyleft licenses. These licenses permit combining code with other licenses, including proprietary licenses, without mandating the entire derivative work to be released under the same copyleft license
Strong Copyleft Licenses policies (High severity): Identifies software packages distributed under strong copyleft licenses, such as the GNU General Public License (GPL). These licenses require derivative works to be distributed under the same copyleft license terms as the original work. This ensures broader access and modification rights
Non Permissive Licenses policies (High severity): Identifies software packages distributed under non-permissive or restrictive licenses. These licenses restrict how you can use, modify, and distribute the software. They might limit your ability to integrate the software into certain projects or require you to purchase a commercial license for specific uses
For more information on default license policies refer to License Policies.
In addition, you can create custom license policies to suit your organization’s requirements. See Create Custom License Policies below for more information.
Permissions
For permissions required to view, create, modify policies, and more, refer to Prisma Cloud Administrator Permissions.
GRBAC for License Policy Permissions
GRBAC (Granular Role-Based Access Control) is used to manage permissions for License policies, as well as all Build policies. You can define the policy permissions as required for each Permission Group.
In Application Security, select Settings > Access Control in the left side-bar menu.
The Permission Groups tab is selected by default.
Create or edit a Permission Group according to requirements.
Refer to the Create Custom Permission Groups documentation for more information.
In the 'Assign Permissions' step of the 'Add Permission Group' wizard, select your required permissions in the Policies menu under the Assign Permission step > complete the Group Permission setup.
View License Policies
Access the Governance page to review license policies. To narrow a search, select Config under Policy Type and Build under Policy Subtype filters. Apply additional filters from the Add Filter menu to further narrow your search.
To view custom license policies, select the Custom tab on the Governance page, and then use filters to narrow your search.
Manage License Policies
You can edit, clone, view Alert rules, delete license policies and more to suit your organizations requirements.
Locate your License policies - see View License Policies above.
Select the edit icon under the Actions column of a license policy, and edit the values that are displayed in the wizard.
For more information on custom policies, refer to Create Custom License Policies below.
Enable/Disable License Policies
Enable/disable individual license policies based on your organization’s specific needs to maintain flexibility in compliance management.
On the Governance page, select a policy > toggle the button under the Status column ON/OFF .
Enforcement
Enforce license violations by severity and policy labels, ensuring developers are promptly notified during pull requests if they introduce a package with an unapproved license. For further details on Enforcement rules, refer to Enforcement.
Create Custom License Policies
Create custom License policies to align compliance measures with your organization’s unique requirements.
On Prisma Cloud console, select Governance > Add Policy > Config.
The Add Details step of the 'Create New Config Policy' wizard is displayed.
Fill in the provided fields.
Policy Name (Required): The name of the custom license policy
Description (Optional): A description of the custom policy
Policy Subtype: Select Build to enable scanning code repositories
Severity (Required): The policy severity level. Values: 'Critical', 'High', 'Medium', 'Low', 'Informational'
Labels (Optional): Assigning labels to your policies is an optional but highly recommended practice. Labels act like tags, allowing you to easily filter and find specific policies later. This can save you significant time when managing a large number of policies. You can choose from existing labels by clicking on the 'Labels' field or create a custom label by typing a value in this field.
Select Next.
The Create Query step of the wizard is displayed.
Create a query.
Select License Policy from the menu.
The License Policy fields are displayed.
Select a license/ multiple licenses from the menu in the License Type field (Required).
These licenses are the SDPX licenses supported by Prisma Cloud.
Click Next.
The Compliance Standards step of the wizard is displayed.
Configure a Compliance standard (Optional).
Compliance standards ensure your policies align with established security or industry regulations. Additionally, compliance standards serve as a filtering criterion, allowing you to easily filter your policies based on the assigned standard.
Select the required compliance Standard, Requirement, and Section values from their respective fields.
Click (+) to add additional standards as required.
Select Next.
The Remediation step of the wizard is displayed.
Provide steps to remediate the license violation (optional) > Submit.
The custom license is created and can be viewed on the Governance page.
View and Remediate Non-Compliant License Findings
View and mitigate non-compliance license findings through the Projects page.
In Application Security, select Home > Projects > Licenses tab.
Use filters to locate and prioritize findings.
(Optional) To filter by License type: Select Add Filter > License type > Select a license policy type from the list, which includes both default and custom License policy types.
You can select multiple policy types.
Select a package from the list in the table containing a non-compliant license.
Select the Details and Issues tab in the sidecar that is displayed to view additional details about the license and non-compliance issues.
For more information on mitigating license policy issues, refer to Monitor and Manage Code Build Issues.
Suppress License Violations
You can suppress license violations to exclude the license from the scope of future scans on a global scale. All license compliance issues associated with this package and version will no longer be considered in future scans across your entire environment.
On the Projects page, select a non-compliant license policy> click to open the sidecar.
Under the Issues tab, select Suppress.
Create a Suppression rule in the popup that is displayed > Save.
For more information on Suppression, refer to the Suppress Code Issues documentation.
License scans in Checkov CLI
License scans are supported in Checkov CLI.
Checkov License policies use the following YAML query syntax:
For more information on Checkov CLI License scans, refer to the Checkov CLI documentation.
License Scans in IDE Environments
License scans are supported in IDE environments. For more information on License scans through IDEs, refer to the IDE documentation.
Integrations
You can view License non-compliance scan results for packages in your VCS repositories.
Pull Request Comment Support for License Policies
Prisma Cloud supports Pull Request (PR) comment notifications for license policy violations. These violations are detected during scans of PRs. If violations are found, the system generates comments on the PR to notify the developer about the detected issues.
Last updated
Was this helpful?