Unused Resources

Integrating Infrastructure as Code (IaC) can significantly enhance operational efficiency and development pace. It helps tackle issues during build time, preventing problems in the cloud runtime. Yet, even with IaC, some resources in your default branch might never be deployed.

It’s crucial to identify undeployed IaC resources for:

• Cost optimization: Undeployed resources don’t cost anything. Spotting and deleting them before deployment prevents unnecessary expenses.
• Organization: Recognizing non-deployed resources aids in infrastructure management.
• Security: Undeployed resources can be security risks. Identifying them ensures they’re secured before potential deployment.

Prisma Cloud offers Unused Resource Detection, pinpointing build time resources not deployed to runtime. The best approach is to review these resources: either deploy or remove them to avoid unintended costs or security concerns.

By linking your CSP accounts and repositories to Prisma Cloud, you can pinpoint unused resources for potential future deployment, ensuring all resources deploy as intended.

Prisma Cloud currently detects unused resources from Terraform and CloudFormation for AWS, Azure, and GCP.

Discovering Unused Resources with Prisma Cloud

Information and fix suggestions for unused resources are available via the Projects, Inventory and Governance pages.

Projects

Prerequisites

To be able to access issues in unused resources on the Projects page, ensure the following:

• You have integrated your runtime accounts with Prisma Cloud so that they can be scanned.
• You have integrated VCS repositories storing the relevant IaC files code for selected runtime accounts.
• You have Traceability enabled via yor_trace in your Terraform resources and deployed to your infrastructure. Unused resource detection is also supported for CloudFormation environments without yor_trace tagging and works out-of-the-box. For more details on how to enable traceability, see Traceability and Tagging.

Unused Resources Findings

In Projects, the relevant policy for unused sources is: Buildtime resource is not deployed to cloud runtime environments. You can access it by searching for it within a single repository.

Click the unused resource to view the Errors tab in its Resource Explorer sidecar.

Inventory

From the Inventory > IaC Resource Inventory, selecting a resource that is not yet deployed will include an Issue for the policy above with details about that resource.

Governance

You can use the Search function to find the Buildtime resource is not deployed to cloud runtime environments policy, view its guidelines and turn if off or on.