> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/classic-releases/prisma-cloud-code-security-release-information/features-introduced-in-code-security-january-2023.md).

# Features Introduced in January 2023

Learn about the new Code Security capabilities on Prisma® Cloud Enterprise Edition (SaaS) in January 2023.

The following new features or enhancements are available for Prisma Cloud Code Security. These capabilities help agile teams add security checks to their existing IaC (Infrastructure-as-Code) model and enforce security throughout the build lifecycle.

* [New Features](#new-features)
* [New Policies and Policy Updates](#new-policies-and-policy-updates)
* [Changes in Existing Behavior](#changes-in-existing-behavior)

## New Features

| FEATURE                              | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Terraform Enterprise (Run Tasks)** | <p>Integrate <a href="https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-code-security/get-started/connect-your-repositories/add-terraform-enterprise-run-tasks">Terraform Enterprise (Run Tasks)</a>(<strong>Settings >Repositories > Add Repository > Terraform Enterprise Cloud (Run Tasks)</strong>) to seamlessly add policy-as-code checks to your Terraform pipelines for completely automated security guardrails and enable you to collect feedback or directly block insecure deployments.</p><p><img src="/files/Y4mo9HvEjFBiFvkzHtez" alt="" data-size="original"></p>                                                                                                                                                                                                                                                                                                                                        |
| **CVE Severity**                     | <p>The CVEs with Moderate and Important severity will now be mapped as Medium and Important, respectively. With this change, if you have set the <strong>Enforcement</strong> threshold to Medium or above for detecting violations or failing the build for CVEs in your source code, the volume of violations will be higher than before.</p><p>For any VCS or CI/CD integrations where the hard fail is implemented for CVEs that are Medium or above in severity, the builds that were passing earlier will now fail.</p>                                                                                                                                                                                                                                                                                                                                                                                                                   |
| **Terraform Cloud ( Run Tasks)**     | <p>With this release, for <a href="https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-code-security/get-started/connect-your-repositories/add-terraform-run-tasks">Terraform Cloud ( Run Tasks)</a>(<strong>Settings > Repositories > Add Repository > Terraform Cloud (Run Tasks)</strong>) integration you can enable specific configuration run tasks scan during <strong>Pre-plan</strong> and <strong>Post-plan</strong> phase for selected or all workspaces. Using your preferential configuration, Prisma Cloud will perform a run tasks scan on your selected (or all) workspaces before or after Terraform Cloud generates a plan.</p><p>This change does not impact your existing configuration. You can continue to review and manage the scan results on <strong>Projects</strong> (<strong>Code Security > Projects</strong>)</p><p><img src="/files/zX3NvJP56279yXyEZiE3" alt="" data-size="original"></p> |

## New Policies and Policy Updates

| New Policy                                                          | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| ------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **New Configuration Build Policies**                                | <p>The following new build policy is available on Prisma Cloud Code Security module:</p><ul><li>Cleartext credentials over unencrypted channel should not be accepted for the operation</li><li>GCP Firewall with Inbound rule overly permissive to All Traffic</li><li>Rules used could create a double pipeline</li><li>Detect images within GitLab CI workflows</li><li>Container job does not use a non latest version tag</li><li>Pipeline image version is referenced via an arbitrary tag</li><li>Pipeline uses mutable development orbs</li><li>Pipeline uses unversioned volatile orbs</li><li>Pipeline uses netcat with an IP address</li><li>Pipeline uses run command that is vulnerable to shell injection</li><li>Pipeline uses curl in a suspicious way</li><li>Detect images within circleCI workflows</li><li>Container job does not use a non latest version tag</li><li>Container job uses a version digest</li><li>Set variable is marked as a secret"</li><li>RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding</li><li>Granting <code>create</code> permissions to <code>nodes/proxy</code> or <code>pods/exec</code> sub resources allows potential privilege escalation</li><li>No ServiceAccount/Node should have <code>impersonate</code> permissions for groups/users/service-accounts</li><li>ServiceAccounts and nodes that can modify services/status may set the <code>status.loadBalancer.ingress.ip</code> field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster</li><li>No ServiceAccount/Node should be able to read all secrets</li><li>GitHub branch protection does not dismiss stale reviews</li><li>GitHub branch protection does not restrict who can dismiss a PR</li><li>GitHub branch protection does not require code owner reviews</li><li>GitHub branch protection does not require status checks</li><li>GitHub branch protection does not require conversation resolution</li><li>GitHub branch protection does not require push restrictions</li><li>GitHub branch protection rules allow branch deletions</li></ul> |
| **Addition of Build Checks to Existing Configuration Run Policies** | <p>The following configuration policies now include build time checks. With this change, these policies perform checks for Run, Build configuration issues:</p><ul><li>AWS CloudFront attached WAFv2 WebACL is not configured with AMR for Log4j Vulnerability</li><li>AWS Cloudfront Distribution with S3 have Origin Access set to disabled</li><li>AWS CloudFront web distribution with default SSL certificate</li><li>AWS Config must record all possible resources</li><li>AWS Config Recording is disabled</li><li>AWS Database Migration Service endpoint do not have SSL configured</li><li>AWS EC2 Instance IAM Role not enabled</li><li>AWS ElastiCache Redis cluster with Multi-AZ Automatic Failover feature set to disabled</li><li>AWS route table with VPC peering overly permissive to all traffic</li><li>AWS S3 buckets are accessible to any authenticated user</li><li>GCP Cloud Function HTTP trigger is not secured</li><li>GCP Firewall with Inbound rule overly permissive to All Traffic</li><li>GCP GCR Container Vulnerability Scanning is disabled</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |

## Changes in Existing Behavior

| FEATURE                       | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Terraform Cloud Run Tasks** | <p>For Terraform Cloud Run Tasks, the Enforcement Settings for IaC Scans were enforced only when you had enabled the checkbox to <strong>Make Prisma Cloud’s run tasks mandatory</strong>. The <strong>Make Prisma Cloud’s run tasks mandatory</strong> is now removed, to make this behavior consistent with other VCS, IDE, and CI/CD pipeline integrations for Code Security.</p><p><strong>Impact-</strong> If you have an existing Terraform Cloud Run Task integration on Prisma Cloud that was not set to mandatory, and have set the Enforcement Settings threshold for Hard Fail to anything other than <strong>Off</strong> such as Low or above for IaC Scan, the run tasks will now be mandatory. Builds that were passing earlier will now fail when there is a violation above the severity threshold detected in your IaC files.</p> |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/release-notes/prisma-cloud-release-information/classic-releases/prisma-cloud-code-security-release-information/features-introduced-in-code-security-january-2023.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.