mrvitej.in

Archive · DevOps

Prisma Cloud: Image Scanning and IaC Checks

Scan container images with twistcli and catch Terraform or CloudFormation problems before deploy.

1 min read

  • Prisma Cloud Compute
  • twistcli
  • Checkov 2.3

Posture management finds what already exists. Shift left by scanning before deployment.

Images with twistcli (downloaded from your console) in a pipeline:

./twistcli images scan --address $PC_CONSOLE --user $PC_USER --password $PC_PASS \
  --details shop-api:1.4.2

The command exits non-zero when findings exceed the policy you set (for example, no critical CVEs with a fix available), so it can fail the build. Runtime protection uses Defenders, deployed as a DaemonSet on Kubernetes clusters from the console-generated manifest.

Infrastructure as code is scanned by Checkov, the open source engine behind Prisma Cloud’s code security:

pip install checkov
checkov -d terraform/ --framework terraform
checkov -f template.yaml --framework cloudformation

It flags issues such as unencrypted volumes, public buckets and missing logging, with a rule ID for each. Suppress an accepted risk inline with a reason (#checkov:skip=CKV_AWS_18: access logs in central bucket) so exceptions stay visible in review.