Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Governance] Custom Build Policies - Added Bicep framework #842

Merged
merged 15 commits into from
Aug 21, 2024
Merged
Show file tree
Hide file tree
Changes from 4 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -386,15 +386,15 @@ For every test, the console displays up to 30 results. Each time you test your c
//+
//image::governance/code-editor-3.png
+
You also review the results for more details on the impacted resource and misconfiguration.
+
In this example you see the contextualized information about an impacted resource from your custom code.
You can also review the results for more details on the impacted resource and misconfiguration.
//+
//In this example you see the contextualized information about an impacted resource from your custom code.
//+
//image::governance/code-editor-4.png
+
If there are errors in your custom code during a test, the console displays a solution.
+
In this example, you see solution for the errors from your code.
//+
//In this example, you see solution for the errors from your code.
//+
//image::governance/code-editor-5.png

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ Prisma Cloud includes out-of-the-box policies that enable you to detect misconfi
You can create custom build policies for the following frameworks:

* *Terraform* - Policies written using Terraform attributes will apply for Terraform (.tf and plan files).
* *Bicep*: Policies defined using Bicep syntax for tailored Azure resource governance
JBakstPaloAlto marked this conversation as resolved.
Show resolved Hide resolved
* *CloudFormation* - Policies written using CloudFormation attributes will apply for CloudFormation, AWS Serverless Application Model (SAM), and Cloud Development Kit (CDK).
* *Kubernetes* - Policies written using Kubernetes attributes will apply for Kubernetes, Helm, and Kustomize.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,59 @@

To create code-based policies for your infrastructure, use these examples as guidance. They showcase how to use different attributes for working with IaC templates.

* <<bicep-example,Bicep Example>>
* <<terraform-examples, Terraform Examples>>
* <<cloudformation-examples, Cloud Formation Examples>>
* <<kubernetes-examples,Kubernetes Examples>>
* <<ss-examples,Secrets Security Examples >>
* <<#resource-blocklist,Resource Control - Blocklist Example>>

[#bicep-example]
=== Bicep Example

The following example demonstrates how to create a Bicep policy.

----
metadata:
name: "Ensure that auditing is set to on for SQL servers"
guidelines: "..."
category: "logging"
definition:
and:
- cond_type: filter
attribute: resource_type
operator: within
value:
- Microsoft.Sql/servers
- Microsoft.Sql/servers/databases
- or:
- and:
- cond_type: connection
resource_types:
- Microsoft.Sql/servers
connected_resource_types:
- Microsoft.Sql/servers/auditingSettings
operator: exists
- cond_type: attribute
resource_types:
- Microsoft.Sql/servers/auditingSettings
attribute: properties.state
operator: equals
value: Enabled
- and:
- cond_type: connection
resource_types:
- Microsoft.Sql/servers/databases
connected_resource_types:
- Microsoft.Sql/servers/databases/auditingSettings
operator: exists
- cond_type: attribute
resource_types:
- Microsoft.Sql/servers/databases/auditingSettings
attribute: properties.state
operator: equals
value: Enabled
----

[#terraform-examples]
=== Terraform Examples
Expand Down Expand Up @@ -729,4 +776,4 @@ definition:
resource_types:
- "aws_sagemaker_model"
operator: "not_exists"
----
----
Original file line number Diff line number Diff line change
Expand Up @@ -29,9 +29,13 @@ Code Editor appears as a default view.
//+
//image::governance/visual-editor-2.png

. Select the target *Framework*.
+
NOTE: Framework options include: Terraform, Kubernetes, CloudFormation and Bicep.

. Select *Cloud Provider*.
+
You can create rules only for Cloud Service Providers that are supported on Prisma Cloud.
You can only create rules for Cloud Service Providers that are supported on Prisma Cloud.
JBakstPaloAlto marked this conversation as resolved.
Show resolved Hide resolved
//+
//image::governance/visual-editor-3.png

Expand Down
Loading