Prisma Cloud (Palo Alto Networks) covers cloud security posture management (CSPM), workload protection and code scanning. The first step is read-only visibility into the account.
- In Settings, Cloud Accounts, Add Cloud Account, choose AWS and pick the Monitor mode (read-only; Monitor and Protect adds remediation).
- Download the CloudFormation template it generates. It creates a cross-account IAM role that Prisma Cloud assumes, with an external ID.
- Deploy the stack in the account:
aws cloudformation deploy --template-file prisma-role.yaml \
--stack-name prisma-cloud-role --capabilities CAPABILITY_NAMED_IAM --region us-east-1- Paste the role ARN back into the console and select the compliance standards (CIS AWS Foundations, PCI DSS and others).
After the first scan, findings appear under Inventory and Compliance. Triage by severity and exposure: a public S3 bucket or security group open to 0.0.0.0/0 for SSH comes first. Use an AWS Organization onboarding to cover all accounts at once.