topic Re: Automate Newly created cloud account in Prisma cloud in Prisma Cloud Discussions

Automate Newly created cloud account in Prisma cloud

Retired Member — Wed, 02 Sep 2020 17:59:26 GMT

Hi,

Can anyone direct me to a document or script that can be used to automate account onboarding whenever a new AWS account is created in the organisation. I have this on github but the seems to be the entire process of onboarding Prisma cloud;

https://github.com/PaloAltoNetworks/PrismaCFNOnboarding

Re: Automate Newly created cloud account in Prisma cloud

FranciscoBreijo — Mon, 23 Mar 2020 13:40:40 GMT

Currently, there is no automated onboarding mechanism for AWS, which mimics our GCP capability.

This is in the works, but a timeframe has not been defined at this moment.

Re: Automate Newly created cloud account in Prisma cloud

BCastillo — Fri, 23 Sep 2022 16:43:32 GMT

Hello,

Thank you for your question. Its been a while since you have asked but I wanted to make sure that I can answer this question for you.
Prisma Cloud now automatically updates your AWS Org by adding on the Cloud Accounts (child account) once the account has been added or created under your AWS Org.

During the process of an AWS Org onboarding, on the Select Member Accounts section. Make sure to select all. This will include all member accounts under your organization to be added to Prisma Cloud every time you update your ORG with child accounts. This choice can also be changed later as well.

Please note that when you remove an account from your Organization, that will also update on Prisma Cloud as well.

Hope this helps.

Regards,

Re: Automate Newly created cloud account in Prisma cloud

TommyHunt — Fri, 23 Sep 2022 18:02:25 GMT

It's documented here. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/connect-your-cloud-platform-to-prisma-cloud/onboard-your-aws-account/add-aws-organization-to-prisma-cloud

I like BCastillo's advice too.

Don't forget to deploy an AWS Managed StackSet to your AWS master account.

That StackSet will be an AWS CloudFormationTemplate containing the twistlock IAM user and policy.

The StackSet should be configured to deploy with the AWSStackSetAdministrativeRole.