PCC/Manage/Defenders/Deploy/Defender/Single Defender/Container Defender - App Embedded/Fargate task generates JSON unacceptable to AWS

[TommyHunt]

Given that I navigate to PCCConsole/Manage/Defenders/Deploy/Defender/Single Defender/Container Defender - App Embedded/Fargate task

And I paste the Fargate Task Definition JSON produced by AWS ECS

When I push the 'Generate protected task' button

And Copy Prisma's generated JSON

And Paste it into the new revision of an existing Task Definition

Then I get many error, 'Should only contain 'family', 'containerDefinitions', 'volumes', 'taskRoleArn', 'networkMode', 'requiresCompatibilities', 'cpu', 'memory', 'inferenceAccelerators', 'executionRoleArn', 'pidMode', 'ipcMode', 'proxyConfiguration', 'tags', 'runtimePlatform', 'placementConstraints'.'

And I have to eliminate json objects in order for AWS to accept the definition.

JSON zipped and attached; you can use a diff tool to see what JSON had to be deleted.

Why isn't Prisma's generated JSON acceptable to AWS?

What am I doing wrong?

Are the modifications that I made accpetable?

After making the modifications, is my Task protected?

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

[CloudEngineer · Accepted solution]

Hi Tommy,

This happens when a task definition is exported / copied from AWS and then pasted into Compute's protected task generation field. If you copy solely the original Fargate task and use that in Compute's protected task generator, and then use the result in a new Fargate task definition, you won't receive those errors.

Regards,

[TommyHunt]

Thanks Brandon;  choosing that version of a task definition was a poor choice. Given the dynamic nature of task definitions, the task definition is always a template where fields are populated with values and the transformed json is submitted via automation, for example terraform modules or CloudFormationTemplates.  Thus the original JSON Task Definition is never seen by the developer, it is neither handled by a developer nor checked into a version-control-system. Bottom-line: unless the developer manually codes it, they can't submit the version of JSON that the API was made to consume.

[TommyHunt]

Thanks again, I am grateful for your help.

[CloudEngineer]

You're welcome! I'm happy to help. I understand your feedback and I just wanted to inform you that we do have an RFE (Request for Enhancement) process. I believe that you will just need an account in our customer support portal to submit this, The more unique company votes it receives, the more visibility it will receive.

https://prismacloud.ideas.aha.io/ideas/new

Regards,

[TommyHunt · Accepted solution]

@CloudEngineer  dude, you were correct the whole time.  The Prisma Cloud Compute SecurityHub Alert Provider works perfectly fine.

I got misinformation from support case 02326773.  Here is how I determined that the Registry Scanned CVEs and Compliance vulnerabilities were generating Alerts and propogating them to AWS SecurityHub/Findings Console.  I entered this Filter criteria and then I could see the CVE-Alerts. 

I still have NO explanation for those errors that I cited at the beginning of this

[TommyHunt]

please delete, disregard that comment above; it is intended for another conversation.