Offboarding AWS

Overview

Offboarding involves stopping the monitoring of a cloud account in Prisma Cloud Data Security Posture Management (DSPM) and deleting it from the DSPM console. This process removes all data associated with the specified cloud account.

Important: If you want to temporarily disable DSPM without offboarding, please refer to the Monitoring an Account article.

Prerequisites

Before proceeding with the offboarding process, ensure that you have the necessary permissions to manage your AWS account and CloudFormation resources.

Offboarding Procedure

Important: Perform the Offboarding Procedure in the order described below. Performing the procedure in a different order may cause issues such as resources being left in the account.

Step 1: Offboarding an Account from the Prisma Cloud Console

Before initiating the offboarding process, review the cloud account information in the Prisma Cloud DSPM console.

Important: The offboarding process is irreversible; once initiated, it cannot be canceled, and all data will be permanently deleted.

Deleted Data

When offboarding is initiated, the following data will be deleted:

• Assets
• Classification findings
• Risk findings
• Activity log entries
• Dynamic resources used for scans

The following resources are not deleted (they are deleted in the next steps):

• Static resources created by Prisma Cloud DSPM for scanning purposes
• Third-party integrations
• Prisma Cloud DSPM deployment resources, including::

  • Roles
  • Service accounts
  • Bindings

1. Sign in to Prisma Cloud Console..
2. From the DSPM Preferences tab, navigate to the AWS Accounts page.
3. Navigate to the DSPM project you want to offboard.
4. Click its gear icon on the far right side of the Cloud Accounts table, and select Offboard Project.

1. Read the information provided and click Offboard to confirm.

During the offboarding process, the following occurs:

• Cloud account monitoring will disabled.
• An 'Offboarding' tag will be applied to the cloud account.
• All data associated with the cloud account will be deleted within 72 hours. Note that data may still appear in the console during this period.

Important

The cloud infrastructure deployed by DSPM will not be deleted during the offboarding process. For more details, refer to the specific offboarding documentation. This process is irreversible, so proceed with caution.

Step 2: Wait for Resource Deletion

• After disabling monitoring, wait for 48 hours. During this time, all resources created in AWS as part of the scanning procedures will be scheduled for deletion.
• Important: If you proceed with the offboarding process before this period concludes, some resources may remain in your environment and cannot be deleted.

Step 3: Access the CloudFormation Page

1. Sign in to your AWS account.
2. Navigate to the CloudFormation page.

Step 4: Locate and Delete the Dig Security Stack

1. Search for the stack originally created to onboard DSPM, typically named dig-security-stack.

   • Tip: If you cannot find the stack in the current region, check other AWS regions.
2. Once located, select the stack and click Delete to remove it.

Prisma Cloud DSPM resources are identifiable by the “dig-security”:”true” cloud tag. If the stack fails to delete and resources persist, use this tag to locate and manually remove them from your environment.

Manual Deletion of Tagged Resources

To delete resources in specific regions, use the “dig-security”:”true” cloud tag to manually locate and remove them. This manual process must be repeated for every AWS region where Prisma Cloud DSPM resources were deployed.

Procedure for Manual Network Resource Deletion:

1. Sign in to your AWS account.
2. Select the Region: In the AWS Management Console, use the region selector dropdown to switch to the specific region where you were attempting to delete resources.
3. Check Relevant Service Consoles: Since there is no single "Delete by Tag" feature across all of AWS, you must manually check the consoles for services where DSPM typically deploys resources. Common services include:

   1. VPC
   2. VPC Endpoints
   3. Internet Gateway
   4. Security Groups
   5. S3 Bucket
   6. Private Subnet
   7. Public Subnet
   8. Route
   9. Elastic IP Address
   10. NAT Gateway
4. Filter by Tag: In each service console (where filtering by tags is supported):

   1. Navigate to the resource list (e.g., S3 Buckets, IAM Roles).
   2. Use the Filter or Search function to filter resources by the tag:

      1. Key: dig-security
      2. Value: true
5. Manually Delete Filtered Resources:

   1. Carefully review the list of resources filtered by the tag.
   2. Select each resource and choose the appropriate Delete or Remove action.
   3. Important: Ensure you are only deleting resources with the “dig-security”:”true” tag to avoid impacting other infrastructure in your AWS account.
6. Repeat: Repeat this process for all relevant AWS regions to ensure all resources created by the DSPM deployment are removed from your environment.

Conclusion

Upon successful completion of the above steps, DSPM will be offboarded from your cloud account, and associated roles will be removed. If you have any questions or require further assistance, please consult your technical support team.