Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Configure VM Image Scanning

Prisma Cloud supports scanning VM images on AWS, Azure, and GCP.

On AWS, Prisma Cloud can scan Linux Amazon Machine Images (AMIs). On Azure, Prisma Cloud supports Managed, Gallery, and Marketplace images. On GCP, Prisma Cloud supports Public and Custom images (including Premium images).

VM image scanning is handled by the Console and does not require Defenders. The Prisma Cloud Console scans a VM image by launching or creating a VM instance that is running the VM image that you want to scan. When you set up Prisma Cloud to scan VM images, you can choose how many scanners to use. For scanning a large number of VM images, increase the number of scanners to scan multiple VM images simultaneously for improved throughput and reduced scan time. The VM instances created for scanning VM Images come with default tags: Key - Name, Value - prismacloud-scan-*

AWS

The following AMIs aren’t supported:

  • Images that don’t use cloud-init for bootstrapping, such as Red Hat Enterprise Linux CoreOS (CoreOS for OpenShift). RHCOS uses Ignition.

  • Images that use paravirtualization.

  • Images that only support old TLS protocols (less than TLS 1.1) for utilities such as curl. For example, Ubuntu 12.10.

Prerequisites

  • Access from the VPC to the Prisma Cloud Compute Console.

  • The service account Prisma Cloud uses to scan AMIs must have at least the following policy:

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PrismaCloudComputeAMIScanning",
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:CreateSecurityGroup",
                "ec2:CreateTags",
                "ec2:DeleteSecurityGroup",
                "ec2:DescribeImages",
                "ec2:DescribeInstances",
                "ec2:DescribeSecurityGroups",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:RunInstances",
                "ec2:TerminateInstances"
            ],
            "Resource": "*"
        }
    ]
}

    • Prisma Cloud requires the permissions listed above for VM image scanning. To restrict permissions for creating and deleting resources, you can use conditional clauses in AWS IAM policy for the security groups and instances that have the prefix "prismacloud-scan".

    • It is strongly recommended to make sure the images scanned have DeleteOnTermination attribute enabled.

Azure

Prisma Cloud supports the following image types:

  • Marketplace images (publicly available images)

  • Managed (custom) images

  • Shared image galleries

  • Encrypted images

  • Azure Linux images

Prisma Cloud doesn’t support the following image types:

  • Azure paid images

Prerequisites

  • The service account Prisma Cloud uses to scan Azure images must have at least the following policy:

To scan encrypted images, use the Azure Key Vault Crypto Service Encryption User built-in role.

If you have managed and gallery images limited to specific regions, Prisma Cloud skips the scan when the region defined in the scope doesn’t match the region defined for the image.

GCP

Prisma Cloud supports the following image types:

  • Public images (including Premium images)

  • Custom images

  • Encrypted images

Prerequisites

You can only scan encrypted images that use a customer-managed encryption key (CMEK). Customer-supplied encryption keys (CSEK) are not supported.

  • The service account Prisma Cloud uses to scan GCP VM images must have at least the following policy:

  • Verify that the Compute Engine Service Agent service account in the target image project has the Cloud KMS CryptoKey Decrypter role or equivalent.

  • If you use a shared VPC, verify that the service account in the target image project has the compute.subnetworks.use permission in the project containing the subnetwork. For a shared VPC, the project containing the shared VPC is the host project.

    This built-in service account ends with compute-system.iam.gserviceaccount.com. The service agent has these permissions by default since it used these permissions to encrypt the images.

VM Image Scans

If you remove a VM image, or it becomes unavailable, Prisma Cloud maintains the scan results for 30 days. After 30 days, the scan results are automatically deleted. When a scan is canceled, it might take a few minutes for the scan to stop completely.

On Console upgrade, VM image scanning results from the previous Console version are deleted.

  1. Open Console.

  2. Go to Defend > Vulnerabilities/Compliance > Hosts > VM Images.

  3. Select Add Scope.

    Define the scan settings.

Field
Description

Provider

Specify the cloud provider. The supported providers are AWS, Azure, and GCP.

Credential

Specify the credential required to access the VM images and launch the VM instance on the Cloud Service Provider.

As a best practice, onboard the cloud account on Prisma Cloud and select the credential associated with that cloud service provider from the drop-down. Ensure that either the Agentless Workload Scanning or the Agent-Based Workload Protection capability is enabled for the service account or role to have adequate permissions for VM Image scanning. To scan VM Images, Prisma Cloud requires permissions to create a VM instance, along with the networking components to communicate the scan results back to the Console.

If you choose to add the credentials on Compute> Manage > Cloud Account:

  • For AWS you can use Access Keys for authentication: IAM role is not supported.

  • For Azure, you can use the Service Key or Certificate.

  • For GCP, you can use the Service Account credentials.

Project ID (GCP only)

Specify the project ID where the service account was created.

Image type (Azure only)

Specify the relevant image type. Prisma Cloud supports three image types: Managed, Gallery, and Marketplace.

Images

Specify the VM images to scan. Leave * to scan all images.

ON AWS: When the image field contains a string and a wildcard (e.g. Amazo*), only private AMIs are scanned. When using explicit image names, AWS Marketplace, and community AMIs are scanned as well. Only the AMI names are permitted in the image field. AMI IDs are not supported.

Use the label field in the referenced collection to restrict the scan for the specified label on the VM Image. Use the key-value pattern 'key:value'.

All supported resource fields support pattern matching.

Excluded VM images

Specify VM images to exclude from the scan. This field supports pattern matching.

Region (AWS and Azure)

Specify the region to scan.

Console address

Specify the Console URL for the scanner VM instance to use.

Zone (GCP only)

Specify the Zone where scan instances will be deployed.

Number of scanners

Specify the number of VM images to concurrently scan. Increase the number of scanners to increase throughput and reduce scan time.

Cap

Choose the maximum number of VM images you want to scan, and they will be sorted based on their 'Creation Date.' Scanning begins with the most recently created VM images and proceeds in descending order of creation date.

In the case of Azure Marketplace and Managed images, the images are scanned according to their resource ID, in descending lexicographic order (i.e., ID3, then ID2, then ID1).

To scan all VM images, set value to 0.

VPC ID and Subnet ID (AWS only)

If you want a custom VPC for the scanner VM instance, specify the VPC id to use (e.g., vpc-xxxxx). If you want a custom subnet for the scanner VM instance, specify the subnet id to use (e.g., subnet-xxxxx).

VPC ID and subnet ID are mapped 1:1. You can only scope one VPC and subnet for a rule.

Subnet (GCP only)

If you want a custom subnet for the scanner VM instance, specify the subnet name.

Subnet Resource ID (Azure only)

Specify the Resource ID of the subnet where scan instances should be deployed.

Instance Type

For AWS, the default is m4.large. For Azure, the default is standard_D2s_v4. For GCP, the default is e2-standard-2.

Enable Secure boot (GCP only)

Enable the option to verify the digital signature with secure boot for the temporary VM instance created for VM image scanning.

Add Rule for Scanning VM Images

To define which VM images to scan, create a new VM images scan rule.

  1. Open Console.

  2. Go to Defend > Vulnerabilities/Compliance > Hosts > VM Images.

  3. Select Add Rule.

  4. Specify the thresholds for vulnerabilities or compliance.

  5. Select Save.

Additional scan settings

Additional scan settings can be found under Manage > System > Scan, where you can set the VM images scan interval.

PreviousTrigger Registry Scan with WebhooksNextScan for Malware

Last updated

Was this helpful?