Visual Editor

The Visual Editor supports custom build policies for IaC, Secrets, and Licenses using attribute-based checks with AND/OR logic. IaC policies support both AND/OR logic, while Secrets and License policies currently only support OR logic.

1. Under Governance, select Add Policy > Config.
2. Fill in the fields in the Add Details step of the wizard (refer to Custom Build Policies)> Next.

   The IaC Policy Code Editor is displayed by default in the Create query step of the wizard.
3. Select Visual Editor from the menu next to the 'Scan' button.
4. Select a policy type.
5. Configure the policy by selecting values in the provided fields.

   • For Licenses, select a license type. Multiple types are supported
   • For Secrets, add a Regular expression. Multiple 'OR' expressions are supported
   • For IaC, see Configure Iac Custom Build Policies below.
6. Verify the policy’s functionality. Note that test scans are only supported for IaC policies.
7. Select Next to access Compliance Standards, and complete the process for creating a custom Build-time check policy (refer to Custom Build Policies).

Configure IaC Custom Build Policies

Limitations:

• The Visual Editor supports policy creation for cloud service providers supported by Prisma Cloud. For unsupported providers, use the Code Editor
• The 'Resource Type' and 'Attribute' fields are selection-based, not free text
• For more advanced policies requiring custom attributes, such as tagging rules with tags.<tag_key>, use the Code Editor
• The Visual Editor does not support connected resources; use the Code Editor for these policies

1. Repeat steps 1-4 above, selecting IaC as the policy type.
2. Select Category Type.

   Policies are categorized by type. Options include Elasticsearch, General, IAM, Kubernetes, Logging, Monitoring, Networking, Public, Secrets, Serverless, Storage, and Vulnerabilities.
3. Select the target Framework.

   Supported frameworks include Terraform, Kubernetes, CloudFormation, Bicep, and ARM. You can assign multiple frameworks to a single policy. For example, a policy can be configured to support both Bicep and ARM.
4. Select a Cloud Provider.
5. Select a Resource Type.

   The Cloud Provider selection determines the available Resource Types and their corresponding syntax.
6. Create a query: Select an Attribute, Operator and add a Value.

   This query defines the matching condition to check if a resource contains a specific value or if a specific value exists.

   This query type allows users to build complex search criteria using multiple attribute-operator-value combinations. The initial query supports both AND and OR conditions for flexible filtering. You can further refine results by applying additional logic, providing granular control over data retrieval.
7. Select Scan to verify your custom IaC code.

   If your custom IaC code contains no errors, Prisma Cloud will display up to 30 resource results.

   The following screenshot displays an example of results returned by a verified IaC policy.

   

   The same policy could be defined using the Code Editor as follows:

metadata:
  guidelines: "Example policy"
  category: "general"
scope:
  provider: "aws"
definition:
  cond_type: "attribute"
  resource_types: "aws_instance"
  attribute: "ami"
  operator: "equals"
  value: "foo"