Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Security Posture Management (CSPM)Medium
A cloud architect is onboarding a new AWS organization into Prisma Cloud. They need to ensure that Prisma Cloud can discover all resources across multiple accounts within the organization, collect configuration data, and monitor for policy violations. What is the recommended method for onboarding an AWS organization to achieve this comprehensive visibility and management?
- AOnboarding each account individually using CloudFormation templates.
- BDeploying a Prisma Cloud Defender on an EC2 instance in each account.
- CIntegrating with AWS Control Tower for automated account provisioning.
- DUsing the AWS Organization master account for read-only access with an IAM role.
Show answer & explanationAnswer & explanation
Correct answer: D. Using the AWS Organization master account for read-only access with an IAM role.
The recommended and most efficient way to onboard an AWS Organization into Prisma Cloud for comprehensive CSPM (Cloud Security Posture Management) is by granting read-only access to the master account via an IAM role. This allows Prisma Cloud to discover and monitor all member accounts and their resources.
Why the other options are wrong
- A. Onboarding individual accounts is cumbersome and not scalable for an entire organization.
- B. Prisma Cloud Defenders are for Workload Protection (CWPP), not CSPM, and are not the primary method for CSPM onboarding.
- C. AWS Control Tower aids in setting up multi-account environments but is not the direct mechanism for Prisma Cloud onboarding itself; it's an environment that Prisma Cloud can then monitor.
Prisma Cloud AWS Organization Onboarding
The process of integrating an entire AWS Organization with Prisma Cloud for centralized CSPM, typically via an IAM role in the master account.
- Centralized discovery and monitoring.
- Utilizes an IAM role in the master account.
- Scalable for multi-account AWS environments.
Memory trick: One master key unlocks all AWS doors for Prisma Cloud.