: Connect VScode with Prisma Cloud Application security

Connect VScode with Prisma Cloud Application security

Table of Contents

Connect VScode with Prisma Cloud Application security

Integrating VScode (Visual Studio Code) with Prisma Cloud Application security makes it possible for you to identify misconfigurations before you commit your code, and avoid pull requests that can potentially fail builds due to undetected misconfigurations. Using Checkov, a code analysis tool that scans Infrastructure-as-code (IaC) files from frameworks such as Terraform_plan, CloudFormation, Azure Resource Manager (ARM), Secrets, Serverless, Dockerfile (only code), and Kubernetes on VScode (Visual Studio Code) gives you immediate detection of misconfigurations and inline code fixes. Apart from the scanning the default Prisma Cloud policies, Checkov also scans for policy violations in custom policies that you can configure during custom build-time checks.
  1. Verify the pre-requisites.
    • Access Key.
      The access key enables access to Prisma Cloud. If you do not have the access key, refer to generate access key. Every IDE user, who needs access to the Prisma Cloud console requires the Developer (minimum) role with access to specific repositories. The Developer role provides view and access to
      Fix and Submit
      changes to the relevant VCS repositories. If a user has more than one Prisma Cloud Role assigned to them, the access key associated with the default role is used when accessing Prisma Cloud.
    • Secret Key.
      The secret key generates with your access key. Save your secret key when you generate it, as you cannot view it again on Prima Cloud.
    • Python Installation.
      Checkov needs Python to run, install Python version 3.7 or above. If you have a versatile working environment of both pip and virtual environment install Pipenv or Docker.
    • Prisma Cloud API URL.
      When you configure Checkov plugin to VScode (Visual Studio Code) you need Prisma Cloud API URL. The URL for Prisma Cloud varies depending on the region and cluster on which your tenant is deployed. The tenant provisioned for you is, for example, https://app2.prismacloud.io or https://app.eu.prismacloud.io. For Prisma Cloud API URL, replace
      in the URL with
    • Prisma Cloud IP addresses and hostnames that need to be allowed
      See enable access to the Prisma Cloud Console for what IP addresses and hostnames for Application security need to be allowed for successfully integrating with Prisma Cloud.
  2. Access VScode (Visual Studio Code) on Prisma Cloud Application security.
    1. Select
      Settings > Code & Build Provider > Add
    2. Select
      You will be directed to Visual Studio Code Marketplace.
  3. Install and Enable Checkov on VScode.
    1. Select
      Install > Continue > Open Visual Studio Code
      and then select
      to install Checkov Extension on VScode (Visual Studio Code).
      You can optionally choose to access VScode (Visual Studio Code) directly from your system and access Checkov plugin from
      and then search for the Checkov plugin to install.
  4. Configure Checkov plugin on VScode (Visual Studio Code).
    1. Select
      Extension > Extension Settings
    2. Add your Prisma Cloud application API for
      Checkov:Prisma URL
      for example .
    3. Add your Prisma Cloud access key and secret key as
      "Access Key::Secret Key"
      You can optionally choose to add a custom CA-Certificate and enter the certificate path to configure for
      . Ensure your CA-Certificate is in ".pem" format.
      A Checkov scan runs each time you access a file on VScode (Visual Studio Code).
  5. Fix scanned files for policy misconfiguration in build-time checks.
    1. Select a file. Checkov runs an immediate scan on the file.
    2. View the highlighted policy misconfiguration inline.
    3. Select
      Quick Fix
      to fix the misconfiguration inline.
      You can optionally select
      View Problem
      to know more about the misconfiguration.
      Each misconfiguration has details on the policy violation and guidelines to fix the policy. See here to know more about each of misconfigurations in all supported environments. For custom policy and out-of-the-box misconfigurations you can access the Prisma Cloud Administrator console to know more.

Troubleshoot Logs

In case of a Checkov scan fail, you can access Checkov logs to know see more details.
  1. Access VScode (Visual Studio Code)
    Command Palette
    or enter
    Ctrl + Shift + P
    for Windows or
    Cmd + Shift + P
    for Mac and then run command
    Developer: Open Extensions Logs Folder
  2. Access
    Bridgecrew.checkov > checkov.log
    to see the log details.

Recommended For You