Author and Enforce Policies in Strata Cloud Manager console

1. Create a folder for your Managed AIRS for AWS resource.

   1. In Strata Cloud Manager, select WorkflowsNGFW SetupFolder Management and click Add Folder.

   2. Enter a descriptive name for the folder.
   3. (Optional) Enter a description for the folder.
   4. (Optional) Assign one or more labels using the Labels drop-down.
   5. Choose where to create the folder using the location drop-down. Select All Firewalls or choose an existing folder to nest under it.
   6. Click Create.
2. Author security policies within the folder.

   1. In Strata Cloud Manager, select ManageConfigurationNGFW and Prisma Access.

   2. Select Configuration Scope.

   3. In the drop-down list, locate the folder containing your Cloud NGFW AWS resources.

   4. In the Overview page, select Security Services.

   5. In the Security Services drop-down list, choose AI Security Policy.

      For information about configuring security policy using Strata Cloud Manager, see Manage Security Policy.
3. (Optional) Associate a pre-defined AIRS-Best-Practice snippet with the folder containing your Cloud NGFW AWS resources.

   1. In Strata Cloud Manager, select ConfigurationNGFW and Prisma AccessOverview, then click Snippet Management in the Configuration Scope panel.
   2. From the Snippet Library tab, locate and opt in to the AIRS-Best-Practice snippet.

   After opting in, associate the snippet with the appropriate scopes:

   1. Select the AIRS-Best-Practice snippet.
   2. In the Snippet Associations area, click the settings gear icon to display available scopes.
   3. Choose the scopes — folders, deployments, or devices — that you want to associate with the snippet. For example, select folders such as Global, Prisma Access, or All Firewalls.
   4. Push the configuration changes to your network.
4. Author an AI security profile for the security policy.

   1. Create an AI security profile.

      • Set up an AI security profile mapped to a model group targeting your preferred AI model environment (such as AWS Bedrock).
      • Configure the profile to handle protections such as prompt injections, AI applications, and data leaks.
      • Enable custom model support within the profile to forward traffic to the AI security cloud for inspection.

      For information about model groups, see Create Model Groups in Strata Cloud Manager.
   2. Create model groups for customized protections and apply the configuration snippet and policy.

      • Target Models — Associate the target large language model paths (such as AWS Cloud or specific model options).
      • Action Policies — Map defensive parameters across AI Application Protection and AI Data Protection. Set specific prompt injection, data leak, or toxic content rules to either Alert or Block.
      • Custom Model Support — Choose Enabled to force all matching traffic to the external AI security cloud for deep threat inspection instead of scanning only known static model endpoints.
   3. Edit the target security policy and assign your profile group containing the AI rules to it.

      Once attached, verify under the policy details that the AI security profile is listed as active under that policy group.
   4. Configure an outbound decryption policy.

      • Create an outbound decryption rule targeted at outgoing traffic.
      • Assign a proxy or decryption certificate to the rule. Without this decryption rule, the firewall cannot inspect the encrypted payload or read prompt strings.
   5. Export the forward proxy CA certificate from Strata Cloud Manager and mount it into your application pods as a trusted root CA using a Kubernetes ConfigMap or Secret.