Update an Onboarded AWS Account
After you add your cloud account to Prisma Cloud, you may need to update the Prisma Cloud stack to provide additional permissions for new policies that are frequently added to help you monitor your cloud account and ensure that have a good security posture. When you update the CFT stack, Prisma Cloud can ingest data on new services that are supported. These CFTs are available directly from the Prisma Cloud administrative console.
In addition to updating the CFT stack for enabling permissions for new services, you can use this workflow to update the account groups that are secured with Prisma Cloud or to enable or disable the security capabilities and permissions. If you enable a security capability that you had not enabled during the initial onboarding, make sure you Download IAM Role CFT again and complete the required steps in order for the updated permissions to be granted to Prisma Cloud.
For instruction on updating your AWS Organization, see Update an Onboarded AWS Organization.
Log in to the Prisma Cloud administrative console.
Select the AWS cloud account you want to modify.
Select Settings > Providers > Cloud Accounts and click the Edit Cloud Account icon for the cloud account to manage from the list of cloud accounts.
From Configure Account, Download IAM Role CFT.
While updating configuration of the AWS account, under Advanced Settings if you select the Use Tenant Specific External ID (optional) checkbox, the downloaded CFT will include a tenant level external ID. For continuous ingestion after selecting Use Tenant Specific External ID:
Make sure you create a new cloud formation stack in the AWS console for new role ARN creation.
Next, make sure to enter the new role ARN in the IAM Role ARN field in the Prisma Cloud console.
tt:[(To change permissions for the Prisma Cloud role)] Update the Prisma Cloud App using the CFT you downloaded in the above step. You can update the stack either using the AWS console or the AWS CLI.
Log in to AWS console.
Select Services > CloudFormation > Stacks.
Select the PrismaCloudApp stack to update and select Update.
Select Replace current template and Upload a template file you downloaded earlier.
If you decide to create a new stack instead of updating the existing stack, you must copy the PrismaCloudRoleARN value from the CFT outputs tab.
Configure stack options.
Click Next and verify the settings.
Preview your changes to the CloudFormation template for the role you updated.
Update your CFT.
If you created a new stack, you must log in to the Prisma Cloud administrative console, select your cloud account on Settings > Cloud Accounts, click the Edit icon, navigate to Configure Account, and enter the PrismaCloudRoleARN value from the AWS CFT output in the IAM Role ARN field.
If you want to use AWS Command Line Interface to deploy the updated Prisma Cloud App stack. Using the AWS CLI tool, enter the following command to deploy the CFT that you downloaded.
aws cloudformation deploy --template-file /tmp/prisma-cloud-aws-iam-role.template --stack-name <Stack Name> --parameter-overrides PrismaCloudRoleName=<Role ARN> --capabilities CAPABILITY_NAMED_IAMCheck the status to verify that Prisma Cloud can successfully retrieve information on your cloud assets.
Last updated
Was this helpful?