Policy Preview
Prisma Cloud Code Security supports policy-as-code capabilities using YAML-based policy definition files to enable attribute and connection checks (composite checks).
To use the API request, add your token to the header. API supports both YAML and JSON configuration of Prisma Cloud Code Security custom policy schema)
This API gets up to 30 results (by default) of non-compliant resources for a specific policy. The input is the policy to test and the output is an array of resources results. Use the first example to configure the API to test a policy, and use the second example as a reference of the expected output.
- application/json
Request Body required
policy object required
policy_preview object required
query object required
- anyOf
- AttributeQuery
- ConnectionQuery
- FilterQuery
- ComplexQuery
- AndQuery
- OrQuery
attribute string requiredcond_type string requiredPossible values: [
attribute]operator AttributeOperator requiredPossible values: [
within,equals,not_equals,regex_match,not_regex_match,greater_than,greater_than_or_equal,less_than,less_than_or_equal,exists,not_exists,contains,not_contains,starting_with,not_starting_with,ending_with,not_ending_with,jsonpath_equals,jsonpath_not_equals,jsonpath_exists,jsonpath_not_exists,subset,not_subset]resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]value object
- anyOf
- MOD1
- MOD2
- MOD3
stringbooleanArray [string]cond_type string requiredPossible values: [
connection]connected_resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]operator string requiredPossible values: [
exists,not_exists]resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]attribute string requiredPossible values: [
resource_type]cond_type string requiredPossible values: [
filter]operator string requiredPossible values: [
within]value string[] requiredand object[]
Array [- anyOf
- AttributeQuery
- ConnectionQuery
- FilterQuery
attribute string requiredcond_type string requiredPossible values: [
attribute]operator AttributeOperator requiredPossible values: [
within,equals,not_equals,regex_match,not_regex_match,greater_than,greater_than_or_equal,less_than,less_than_or_equal,exists,not_exists,contains,not_contains,starting_with,not_starting_with,ending_with,not_ending_with,jsonpath_equals,jsonpath_not_equals,jsonpath_exists,jsonpath_not_exists,subset,not_subset]resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]value object
- anyOf
- MOD1
- MOD2
- MOD3
stringbooleanArray [string]cond_type string requiredPossible values: [
connection]connected_resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]operator string requiredPossible values: [
exists,not_exists]resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]attribute string requiredPossible values: [
resource_type]cond_type string requiredPossible values: [
filter]operator string requiredPossible values: [
within]value string[] required]not object
- anyOf
- MOD1
Array [- anyOf
- AttributeQuery
- ConnectionQuery
- FilterQuery
attribute string requiredcond_type string requiredPossible values: [
attribute]operator AttributeOperator requiredPossible values: [
within,equals,not_equals,regex_match,not_regex_match,greater_than,greater_than_or_equal,less_than,less_than_or_equal,exists,not_exists,contains,not_contains,starting_with,not_starting_with,ending_with,not_ending_with,jsonpath_equals,jsonpath_not_equals,jsonpath_exists,jsonpath_not_exists,subset,not_subset]resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]value object
- anyOf
- MOD1
- MOD2
- MOD3
stringbooleanArray [string]cond_type string requiredPossible values: [
connection]connected_resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]operator string requiredPossible values: [
exists,not_exists]resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]attribute string requiredPossible values: [
resource_type]cond_type string requiredPossible values: [
filter]operator string requiredPossible values: [
within]value string[] required]or object[]
Array [- anyOf
- AttributeQuery
- ConnectionQuery
- FilterQuery
attribute string requiredcond_type string requiredPossible values: [
attribute]operator AttributeOperator requiredPossible values: [
within,equals,not_equals,regex_match,not_regex_match,greater_than,greater_than_or_equal,less_than,less_than_or_equal,exists,not_exists,contains,not_contains,starting_with,not_starting_with,ending_with,not_ending_with,jsonpath_equals,jsonpath_not_equals,jsonpath_exists,jsonpath_not_exists,subset,not_subset]resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]value object
- anyOf
- MOD1
- MOD2
- MOD3
stringbooleanArray [string]cond_type string requiredPossible values: [
connection]connected_resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]operator string requiredPossible values: [
exists,not_exists]resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]attribute string requiredPossible values: [
resource_type]cond_type string requiredPossible values: [
filter]operator string requiredPossible values: [
within]value string[] required]and object[]
Array [- anyOf
- AttributeQuery
- OrQuery
attribute string requiredcond_type string requiredPossible values: [
attribute]operator AttributeOperator requiredPossible values: [
within,equals,not_equals,regex_match,not_regex_match,greater_than,greater_than_or_equal,less_than,less_than_or_equal,exists,not_exists,contains,not_contains,starting_with,not_starting_with,ending_with,not_ending_with,jsonpath_equals,jsonpath_not_equals,jsonpath_exists,jsonpath_not_exists,subset,not_subset]resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]value object
- anyOf
- MOD1
- MOD2
- MOD3
stringbooleanArray [string]or object[] required
Array [attribute string requiredcond_type string requiredPossible values: [
attribute]operator AttributeOperator requiredPossible values: [
within,equals,not_equals,regex_match,not_regex_match,greater_than,greater_than_or_equal,less_than,less_than_or_equal,exists,not_exists,contains,not_contains,starting_with,not_starting_with,ending_with,not_ending_with,jsonpath_equals,jsonpath_not_equals,jsonpath_exists,jsonpath_not_exists,subset,not_subset]resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]value object
- anyOf
- MOD1
- MOD2
- MOD3
stringbooleanArray [string]]]or object[] required
Array [attribute string requiredcond_type string requiredPossible values: [
attribute]operator AttributeOperator requiredPossible values: [
within,equals,not_equals,regex_match,not_regex_match,greater_than,greater_than_or_equal,less_than,less_than_or_equal,exists,not_exists,contains,not_contains,starting_with,not_starting_with,ending_with,not_ending_with,jsonpath_equals,jsonpath_not_equals,jsonpath_exists,jsonpath_not_exists,subset,not_subset]resource_types object required
- anyOf
- MOD1
- MOD2
Array [string]stringPossible values: [
all]value object
- anyOf
- MOD1
- MOD2
- MOD3
stringbooleanArray [string]]resource_types object
- anyOf
- MOD1
- MOD2
stringArray [string]scope object
provider ProviderType requiredPossible values: [
aws,gcp,azure,kubernetes,oci,openstack,packages,git,linode,digitalocean,panos,licenses,alibabacloud]- resultsNumber double
- token string
- 200
- 403
- 422
- 500
Got policy preview
- application/json
- Schema
- Example (from schema)
- Example 1
Schema
- anyOf
- policyPreviewResult
- ErrorMessage
data object[] required
Array [arn string requiredawsAccountId string requiredcode string requiredcreatedBy string requiredcustomerName string requiredfile_path string requiredlines double[] requiredresource string requiredsource string requiredstatus string required]token stringmessage string required
{
"data": [
{
"arn": "string",
"awsAccountId": "string",
"code": "string",
"createdBy": "string",
"customerName": "string",
"file_path": "string",
"lines": [
0
],
"resource": "string",
"source": "string",
"status": "string"
}
],
"token": "string"
}
{
"data": [
{
"arn": "/../folderName/account/branch/provider/resource",
"awsAccountId": "owner/repo",
"code": "---\nmetadata:\n name: \"example\" \n guidelines: \"guidelines example\" \n category: \"elasticsearch\" \n severity: \"critical\" \nscope:\n provider: \"aws\" \ndefinition: #define the conditions the policy searches for.\n or:\n - cond_type: \"attribute\"\n resource_types:\n - \"aws_instance\"\n attribute: \"instance_type\"\n operator: \"equals\"\n value: \"t3.micro\"\n - cond_type: \"attribute\"\n resource_types:\n - \"aws_instance\"\n attribute: \"instance_type\"\n operator: \"equals\"\n value: \"t3.nano\"\n",
"createdBy": "username",
"customerName": "customerName",
"file_path": "filePath",
"lines": [
10,
20
],
"resource": "aws_s3_bucket.logs",
"source": "",
"status": "Pass"
},
{
"arn": "arn",
"awsAccountId": "owner/repo",
"code": "resource code block",
"createdBy": "username",
"customerName": "customerName",
"file_path": "filePath",
"lines": [
4,
6
],
"resource": "aws_s3_bucket.flowbucket",
"source": "",
"status": "Fail"
}
],
"token": "12345"
}
Payment required
Request arguments validation error
Could not get policy preview data