Prisma Asset Type assignment to a created Prisma policy

[JKramer7]

Is there a way to assign a Asset Type to a custom Prisma policy? The only way we can currently do it is to copy a default policy that is already mapped to Asset Class and type. Thanks.

[JCalloway1]

Can yo uprovide a little more detial?

[JKramer7]

I exported from Prisma and attached output of some of our custom policies. Unfortunately these were created in a way in which they didn't choose an existing Prisma default policy that already had an asset type assigned. We would like to be able to assign these to a Asset Type but don't see anyway to do so. Any guidance is appreciated. 

[JCalloway1]

Hey JKramer7
I'm still having a hard time wrapping my head around your question.  In CSPM, the only way to associate an asset type with a policy us through the API specified in the RQL.  In CWP, you can do this (sort of) through scoping.  Can you send along some screen shots and show exactly what you mean by associating asset types with a policy?  There may be ways to do this through the API or Terraform provider, but it's hard to know without understanding what you're asking!

[JKramer7]

Can you see the attached export showing similar queries but only 1 has an associated asset type? How does the association of API used in RQL result in the Asset Type field being populated (manual or auto)? Attached is an example of 2 similar queries we created for CloudFront, but only one has an associated Asset Type. I believe that is because they copied a Prisma Default query for CloudFront that already was associated with the Asset Type and modified it, but for the other they didn't copy, they just created RQL. 

Perhaps an Asset Type can't be assigned to a created RQL? 

[JCalloway1]

I was able to download it and look at it.  So, you're saying this is something you see if you download a list of CSPM policies and not in the GUI correct?

[JKramer7]

Sorry I need to clarify. So when downloading a detailed view of policies/rql in the Governance tab, it doesn't have the Asset Type associated. 

[JCalloway1]

Yes!  I have downloaded the policies in my lab tenant, and I can see them as well.  Let me look in to this and get back to you.

[JCalloway1 · Accepted solution]

Hello!
So, quite simply, built in (OOB) policies get "resource type" fields.  By default, and to your point, custom policies do not get "resource types" unless, of course, they were cloned from existing built-in policies.  Of course this means it is possible to create custom policies that don't have "resource types" on them.  The only way to fix this is is to use the Update Policy API endpoint.  (Specifically, "resourceType") It looks like you can also do this using the Terraform Provider.   Finally, from what I can see, "resourceType" is also available in the Add Policy API endpoint and the create method in the Terraform provider.  So, you could make sure that all custom polices get updated so they have resource types, and also so that new ones also have resource types. 

Hope this helps!