A security team uses Prisma Cloud to monitor their GCP environment. They've discovered an alert indicating a 'Service Account with Admin Privileges' on a critical project. They want to automate the remediation of this issue by reducing the service account's permissions to the least privilege necessary. Which of the following Prisma Cloud remediation actions would be MOST appropriate for this scenario?
- ATrigger a webhook to notify the security team via Slack.
- BAutomatically delete the service account.
- CInitiate a Cloud Function to remove the 'roles/editor' role and assign a custom, more restricted role.
- DCreate a Jira ticket for manual review and remediation.
Show answer & explanationAnswer & explanation
Correct answer: C. Initiate a Cloud Function to remove the 'roles/editor' role and assign a custom, more restricted role.
Prisma Cloud's remediation capabilities can include triggering serverless functions (like AWS Lambda or GCP Cloud Functions) to perform complex, conditional actions. For reducing permissions, a Cloud Function can be programmed to remove the overly permissive role and assign a more appropriate, least-privilege role, automating the remediation while ensuring the service account remains functional.
Why the other options are wrong
- A. Notification is part of alert management, not a remediation action itself.
- B. Deleting a service account is a destructive action that could break applications; it's not a 'reduce permissions' remediation.
- D. Creating a Jira ticket is a manual remediation workflow, not an automated one as requested by 'automate the remediation'.
Prisma Cloud Automated Remediation
Prisma Cloud's capability to automatically correct security misconfigurations or policy violations, often through integrations with cloud-native automation services.
- Can trigger serverless functions (Lambda, Cloud Functions).
- Enables self-healing cloud environments.
- Requires careful planning to avoid unintended service disruptions.
Memory trick: Automate your fixes, trigger a function, and reduce those privileges carefully.