* [Blog](https://www.paloaltonetworks.com/blog) * [Cloud Security](https://www.paloaltonetworks.com/blog/cloud-security/) * [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/) * Bridging the Gap: Infrast... # Bridging the Gap: Infrastructure as Code Security with Prisma Cloud [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fprisma-bridgecrew-infrastructure-security%2F) [](https://twitter.com/share?text=Bridging+the+Gap%3A+Infrastructure+as+Code+Security+with+Prisma+Cloud&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fprisma-bridgecrew-infrastructure-security%2F) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2Fcloud-security%2Fprisma-bridgecrew-infrastructure-security%2F&title=Bridging+the+Gap%3A+Infrastructure+as+Code+Security+with+Prisma+Cloud&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com/blog/cloud-security/prisma-bridgecrew-infrastructure-security/&ts=markdown) \[\](mailto:?subject=Bridging the Gap: Infrastructure as Code Security with Prisma Cloud) Link copied By [Idan Tendler](https://www.paloaltonetworks.com/blog/author/idan-tendler/?ts=markdown "Posts by Idan Tendler") Nov 16, 2021 6 minutes [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown) [DevSecOps](https://www.paloaltonetworks.com/blog/cloud-security/category/devsecops/?ts=markdown) [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [IaC](https://www.paloaltonetworks.com/blog/tag/iac/?ts=markdown) [Infrastructure as Code](https://www.paloaltonetworks.com/blog/tag/infrastructure-as-code/?ts=markdown) [Products and Services](https://www.paloaltonetworks.com/blog/tag/products-and-services/?ts=markdown) *Prisma Cloud adds developer-first Infrastructure as Code (IaC) Security to launch the most comprehensive platform built to unify security, development, and DevOps teams.* As enterprises undergo digital transformations and embrace cloud native applications, they want to unleash the creativity of their developers to rapidly develop and deploy new innovations. These enterprises need a simplified architecture to secure their cloud environments; one that enables them to leapfrog the cost and complexity of a patchwork of point products. To complete that vision for our customers, Palo Alto Networks is excited to announce the integration of Bridgecrew's Infrastructure as Code (IaC) security capabilities into the Prisma Cloud platform. [Bridgecrew](https://bridgecrew.io) is the pioneer in [shift left](https://www.paloaltonetworks.com/cyberpedia/shift-left-security?ts=markdown) and IaC security, where infrastructure protections are codified during development. The company's developer-first IaC security platform offers developers and DevOps teams a unified way to enforce infrastructure security standards throughout the development lifecycle. ### Infrastructure as Code presents an opportunity to shift security left IaC allows developers to define how their infrastructure will be configured using a human-readable code format. This allows them to adopt software processes like version control, collaboration and testing on code (rather than live infrastructure). This improves speed and reliability when deploying and managing infrastructure. However, this automated process means a single insecure IaC template could provision hundreds of insecure resources, snowballing to hundreds or thousands of security alerts. For example, a [Unit 42 Cloud Threat Report](https://start.paloaltonetworks.com/unit-42-cloud-threat-report-2h-2021.html) recently found that 63% of third-party IaC templates contained insecure configurations and 96% of open source container images contain known vulnerabilities.​​ ![Security issues in code amplify to overwhelming alerts for security teams](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/11/graphical-user-interface-description-automaticall-1.png) Security issues in code amplify to overwhelming alerts for security teams Shift left security aims to involve developers in security through automated feedback earlier in the development lifecycle. If security issues are addressed in code prior to deployment, then cloud resources are deployed securely from the beginning, and security teams are freed up to work on higher priority tasks. ### How this integration reduces risk across the development lifecycle With Bridgecrew capabilities integrated directly in the platform, Prisma Cloud customers benefit from [a single integrated platform](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) that will deliver cloud security across code, build, deploy and runtime to seamlessly connect security with development and DevOps teams. Developers gain visibility into misconfigurations in their code and security teams can be assured that misconfigured code is blocked or addressed before deployment. This is critical because developers know they need to secure their code, but they are often left out of policy decisions or aren't fully aware of all the policies they need to enforce. Prisma Cloud is empowering developers to take ownership of their share of security. This creates a natural point of collaboration where teams can work together on misconfigurations and decide what constitutes acceptable risk. ![Addressing security in code minimizes the unnecessary burden on security teams](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/11/graphical-user-interface-application-description-2.png) Addressing security in code minimizes the unnecessary burden on security teams ### Build Phase: Address Misconfigurations in IaC Templates Popular IaC frameworks---such as Terraform, CloudFormation, Kubernetes manifests, Helm charts, Azure Resource Manager (ARM) and Serverless Framework---are used to provision and deploy resources across different cloud providers. If left undetected, misconfigurations in those templates, such as lack of encryption or insecure networking design, manifest as insecure cloud infrastructure. Prisma Cloud IaC Security now allows customers to shift security left when provisioning cloud infrastructure, by alerting developers to misconfigurations during development. Prisma Cloud scans IaC files via command line interface (CLI) or integrated development environment (IDE) to check against hundreds of policies built into the [open source tool Checkov](https://www.paloaltonetworks.com/blog/prisma-cloud/checkov-2-deepening-open-source-iac-security/?ts=markdown) that has been downloaded over two million times. These policies are built on industry benchmarks such as CIS, NIST, PCI, and HIPPA, as well as community use cases. ![Checkov identifying misconfigurations in IaC templates](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/11/text-description-automatically-generated-1.png) Checkov identifying misconfigurations in IaC templates Prisma Cloud integrates these controls into developer tools to catch misconfigurations during code development. This means there are fewer misconfigurations when code is checked back into a version control system (VCS), and fewer misconfigurations for the cloud infrastructure when the code is applied. ![Automated code comments with fix suggestions](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/11/a-screenshot-of-a-computer-description-automatica-1.png) Automated code comments with fix suggestions ### Deploy Phase: Embed Security in the CI/CD Pipeline Prisma Cloud embeds IaC scanning into the continuous integration/continuous deployment [(CI/CD) workflow](https://www.paloaltonetworks.com/cyberpedia/what-is-the-ci-cd-pipeline-and-ci-cd-security?ts=markdown). When an issue is discovered, developers and DevOps teams receive actionable feedback directly in their CI/CD tools. Powered by policy-as-code, Prisma Cloud provides guidance, guardrails, and remediation in the form of pull request comments, CI tests and automated commits/pull requests. ![View scan results in native tooling with Prisma Cloud integrated with CircleCI](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/11/graphical-user-interface-text-description-automa-2.png) View scan results in native tooling with Prisma Cloud integrated with CircleCI Every code scan across the development lifecycle is then viewable within Prisma Cloud, all in a centralized platform next to the other cloud native security platform capabilities. #### Run Phase: Combine Best-of-Breed IaC Scanning and Cloud Native Security Platform The integration means development teams can address a majority of misconfigurations in code to minimize the burden on security teams, freeing up security teams to focus on misconfiguration alerts for resources not deployed with IaC and more advanced security concerns like [anomalous account behavior](https://www.paloaltonetworks.com/blog/prisma-cloud/compute-provisioning-anomaly-detection/?ts=markdown) and [network threat detection](https://www.paloaltonetworks.com/blog/prisma-cloud/network-based-data-exfiltration-detection/?ts=markdown). ![Centralized code posture across security scans in the Prisma Cloud Projects page](https://www.paloaltonetworks.com/blog/wp-content/uploads/2021/11/graphical-user-interface-application-description-3.png) Centralized code posture across security scans in the Prisma Cloud Projects page Additionally, the IaC security capabilities can address many of the requirements for industry compliance, while existing functionality in Prisma Cloud makes it simple to generate audit reports for a comprehensive library of benchmarks. Finally, we're creating a unified alerting mechanism. Notifications can be routed to the relevant team through integration with Jira, Slack, Splunk, Email, ServiceNow, MS Teams. ## Full lifecycle cloud infrastructure security Integrating Bridgecrew into the Prisma Cloud platform bolsters our full lifecycle, full stack security capabilities. Developers benefit from early, actionable feedback, embedded into their tools, preventing misconfigurations in cloud infrastructure from reaching production while reducing alert fatigue for security teams. By enabling closer collaboration across development, DevOps and security teams, Prisma Cloud helps create more secure infrastructure across the development lifecycle. The integrated Bridgecrew and Prisma Cloud offering will be generally available in January 2022. To experience this combined, full-lifecycle offering, please visit our [website](https://www.paloaltonetworks.com/prisma/cloud/devsecops?ts=markdown) and [schedule a demo](https://www.paloaltonetworks.com/prisma/request-a-prisma-cloud-trial?ts=markdown). *** ** * ** *** ## Related Blogs ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [DevSecOps](https://www.paloaltonetworks.com/blog/cloud-security/category/devsecops/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### IaC Smart Fixes: Democratize Institutional Security Knowledge](https://www.paloaltonetworks.com/blog/cloud-security/announcing-smart-fixes/) ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Cloud Posture Security](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-security-posture-management/?ts=markdown), [Cloud Workload Protection Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-workload-protection-platform/?ts=markdown), [DevSecOps](https://www.paloaltonetworks.com/blog/cloud-security/category/devsecops/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Prisma Cloud and Bridgecrew: Doubling Down on Developer-Led Security](https://www.paloaltonetworks.com/blog/2021/03/bridgecrew-developer-led-security/) ### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [DevSecOps](https://www.paloaltonetworks.com/blog/cloud-security/category/devsecops/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown) [#### Prisma Cloud Shifts Left With Proposed Acquisition of Bridgecrew](https://www.paloaltonetworks.com/blog/2021/02/prisma-cloud-bridgecrew/) ### [Cloud Computing](https://www.paloaltonetworks.com/blog/category/cloud-computing-2/?ts=markdown), [DevSecOps](https://www.paloaltonetworks.com/blog/cloud-security/category/devsecops/?ts=markdown) [#### AppSec and CloudSec 101: Blurring the Lines Between Cloud-Native App Layers](https://www.paloaltonetworks.com/blog/cloud-security/application-infrastructure-security-101-blurring-cloud-native-app-layers/) ### [Cloud Computing](https://www.paloaltonetworks.com/blog/category/cloud-computing-2/?ts=markdown), [DevSecOps](https://www.paloaltonetworks.com/blog/cloud-security/category/devsecops/?ts=markdown) [#### How To Adopt Infrastructure as Code With a Secure-by-Default Strategy](https://www.paloaltonetworks.com/blog/cloud-security/how-to-adopt-infrastructure-as-code-with-a-secure-by-default-strategy/) ### [Cloud Computing](https://www.paloaltonetworks.com/blog/category/cloud-computing-2/?ts=markdown), [DevSecOps](https://www.paloaltonetworks.com/blog/cloud-security/category/devsecops/?ts=markdown) [#### Addressing Security Throughout the Infrastructure DevOps Lifecycle](https://www.paloaltonetworks.com/blog/cloud-security/addressing-security-throughout-infra-devops-lifecycle/) ### Subscribe to Cloud Security Blogs! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language