Prisma Cloud Remediation - AWS IAM Policy Misconfiguration Deprecated Hidden

Deprecated. Use Prisma Cloud Remediation - AWS IAM Policy Misconfiguration v2 instead. This playbook remediates Prisma Cloud AWS IAM policy alerts. It uses sub-playbooks that perform the remediation steps.

Prisma Cloud by Palo Alto Networks · 13 tasks · 2 inputs · 0 outputs

Details

IDPrisma Cloud Remediation - AWS IAM Policy Misconfiguration
From Version5.0.0
Tasks13

README

Remediates Prisma Cloud AWS IAM policy alerts. It uses sub-playbooks that perform the remediation steps.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration

Integrations

  • PrismaCloud v2
  • Builtin

Scripts

This playbook does not use any scripts.

Commands

  • closeInvestigation
  • aws-iam-get-account-password-policy
  • redlock-dismiss-alerts

Playbook Inputs

Name Description Default Value Source Required
AutoUpdatePasswordPolicy Whether to update AWS IAM password policy automatically. no - Optional
policyId Returns the Prisma Cloud policy ID. labels.policy incident Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

PCR_AWS_IAM_Policy_Misconfig

Inputs

  • AutoUpdatePasswordPolicy — Update AWS IAM password policy automatically?
  • policyId — Get the Prisma Cloud policy ID.

Commands used

aws-iam-get-account-password-policy closeInvestigation redlock-dismiss-alerts

Flowchart

yes yes Yes passwdPolicy userPolicy yes Start Start Is AWS - IAM integration enabled? Is AWS - IAM integration ... Get IAM password policy - aws-iam-get-account-password-policy Get IAM password policy aws-iam-get-account-password-... Update IAM password policy automatically? Update IAM password polic... Auto remediate? Auto remediate? Manually update IAM password policy Manually update IAM passw... Close investigation - closeInvestigation Close investigation closeInvestigation Done Done Dismiss Prisma Cloud alert - redlock-dismiss-alerts Dismiss Prisma Cloud alert redlock-dismiss-alerts Get Prisma Cloud policy id Get Prisma Cloud policy id Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration - Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration Prisma Cloud Remediation ... Prisma Cloud Remediation - AW... Prisma Cloud Remediation - AWS IAM User Policy Misconfiguration - Prisma Cloud Remediation - AWS IAM User Policy Misconfiguration Prisma Cloud Remediation ... Prisma Cloud Remediation - AW... Is Prisma Cloud v2 integration enabled? Is Prisma Cloud v2 integr...

Source

playbook-PCR_-_AWS_IAM_Policy_Misconfig.yml playbook-PCR_-_AWS_IAM_Policy_Misconfig_v2.yml playbook-PCR_-_AWS_IAM_Policy_Misconfig_v2_README.md
Download History Raw 
This playbook remediates Prisma Cloud AWS IAM policy alerts. It uses sub-playbooks that perform the remediation steps.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

* Prisma Cloud Remediation - AWS IAM Password Policy Misconfiguration
* Prisma Cloud Remediation - AWS IAM User Policy Misconfiguration

### Integrations

* PrismaCloudV2

### Scripts

This playbook does not use any scripts.

### Commands

* aws-iam-get-account-password-policy
* prisma-cloud-alert-dismiss
* closeInvestigation

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| AutoUpdatePasswordPolicy | Update AWS IAM password policy automatically? | no | Optional |
| policyId | Get the Prisma Cloud policy ID. | incident.labels.policy | Optional |

## Playbook Outputs

---
There are no outputs for this playbook.

## Playbook Image

---

![Prisma Cloud Remediation - AWS IAM Policy Misconfiguration v2](../doc_files/Prisma_Cloud_Remediation_-_AWS_IAM_Policy_Misconfiguration_v2.png)