Unsupported Cloud Type For Remediation

TommyHunt — Tue, 03 Mar 2020 21:35:51 GMT

Given the Prisma Cloud SaaS, I am trying to create my 1st custom policy to detect and remediate overly permissive SecurityGroupIngress rules in AWS cloud.

My RQL below is valid and returns a half-dozen or so results...

event where cloud.type = 'aws' AND cloud.account.group = 'Test' AND operation IN ('AuthorizeSecurityGroupIngress') AND json.rule = ( $.requestParameters.ipPermissions.items[*].ipRanges.items[*].cidrIp contains '0.0.0.0/0' OR $.requestParameters.ipPermissions.items[*].ipv6Ranges.items[*].cidrIpv6 contains '::/0' )

My AWS CLI remediation command looks like this...

aws ec2 revoke-security-group-ingress --group-id ${resourceId} --region ${region} --ip-permissions '[{"IpProtocol":"${protocol}", "FromPort":${fromPort}, "ToPort":${toPort}, "Ip${ipV4/6}Ranges":[{"CidrIp${ipV4/6}":"${cidr}"}]}]'

When I push the "Validate Syntax" button, the system renders a dialog box, "Unsupported Cloud Type For Remediation".

This policy closely resembles the Prisma Cloud Default Policy, AWS Security groups allows internet traffic

What am I doing wrong?

Re: Unsupported Cloud Type For Remediation

TommyHunt — Mon, 18 May 2020 20:22:42 GMT

Customers are not allowed to use the parameters that the "out-of-the-box" remediation uses.

topic Unsupported Cloud Type For Remediation in General Topics

Unsupported Cloud Type For Remediation

Re: Unsupported Cloud Type For Remediation