topic Re: PCC/Manage/Defenders/Deploy/Defender/Single Defender/Container Defender - App Embedded/Fargate task generates JSON unacceptable to AWS in Prisma Cloud Discussions

PCC/Manage/Defenders/Deploy/Defender/Single Defender/Container Defender - App Embedded/Fargate task generates JSON unacceptable to AWS

TommyHunt — Wed, 12 Oct 2022 21:27:12 GMT

Given that I navigate to PCCConsole/Manage/Defenders/Deploy/Defender/Single Defender/Container Defender - App Embedded/Fargate task

And I paste the Fargate Task Definition JSON produced by AWS ECS

When I push the 'Generate protected task' button

And Copy Prisma's generated JSON

And Paste it into the new revision of an existing Task Definition

Then I get many error, 'Should only contain 'family', 'containerDefinitions', 'volumes', 'taskRoleArn', 'networkMode', 'requiresCompatibilities', 'cpu', 'memory', 'inferenceAccelerators', 'executionRoleArn', 'pidMode', 'ipcMode', 'proxyConfiguration', 'tags', 'runtimePlatform', 'placementConstraints'.'

And I have to eliminate json objects in order for AWS to accept the definition.

JSON zipped and attached; you can use a diff tool to see what JSON had to be deleted.

Why isn't Prisma's generated JSON acceptable to AWS?

What am I doing wrong?

Are the modifications that I made accpetable?

After making the modifications, is my Task protected?

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Re: PCC/Manage/Defenders/Deploy/Defender/Single Defender/Container Defender - App Embedded/Fargate task generates JSON unacceptable to AWS

CloudEngineer — Thu, 13 Oct 2022 13:51:33 GMT

Hi Tommy,

This happens when a task definition is exported / copied from AWS and then pasted into Compute's protected task generation field. If you copy solely the original Fargate task and use that in Compute's protected task generator, and then use the result in a new Fargate task definition, you won't receive those errors.

Regards,

Re: PCC/Manage/Defenders/Deploy/Defender/Single Defender/Container Defender - App Embedded/Fargate task generates JSON unacceptable to AWS

TommyHunt — Thu, 13 Oct 2022 18:50:49 GMT

Thanks Brandon; choosing that version of a task definition was a poor choice. Given the dynamic nature of task definitions, the task definition is always a template where fields are populated with values and the transformed json is submitted via automation, for example terraform modules or CloudFormationTemplates. Thus the original JSON Task Definition is never seen by the developer, it is neither handled by a developer nor checked into a version-control-system. Bottom-line: unless the developer manually codes it, they can't submit the version of JSON that the API was made to consume.

Re: PCC/Manage/Defenders/Deploy/Defender/Single Defender/Container Defender - App Embedded/Fargate task generates JSON unacceptable to AWS

TommyHunt — Thu, 13 Oct 2022 18:52:31 GMT

Thanks again, I am grateful for your help.

Re: PCC/Manage/Defenders/Deploy/Defender/Single Defender/Container Defender - App Embedded/Fargate task generates JSON unacceptable to AWS

CloudEngineer — Fri, 14 Oct 2022 14:42:13 GMT

You're welcome! I'm happy to help. I understand your feedback and I just wanted to inform you that we do have an RFE (Request for Enhancement) process. I believe that you will just need an account in our customer support portal to submit this, The more unique company votes it receives, the more visibility it will receive.

https://prismacloud.ideas.aha.io/ideas/new

Regards,

Re: PCC/Manage/Defenders/Deploy/Defender/Single Defender/Container Defender - App Embedded/Fargate task generates JSON unacceptable to AWS

TommyHunt — Tue, 01 Nov 2022 19:29:14 GMT

@CloudEngineer dude, you were correct the whole time. The Prisma Cloud Compute SecurityHub Alert Provider works perfectly fine.

I got misinformation from support case 02326773. Here is how I determined that the Registry Scanned CVEs and Compliance vulnerabilities were generating Alerts and propogating them to AWS SecurityHub/Findings Console. I entered this Filter criteria and then I could see the CVE-Alerts.

I still have NO explanation for those errors that I cited at the beginning of this

Re: PCC/Manage/Defenders/Deploy/Defender/Single Defender/Container Defender - App Embedded/Fargate task generates JSON unacceptable to AWS

TommyHunt — Tue, 01 Nov 2022 19:33:26 GMT

please delete, disregard that comment above; it is intended for another conversation.