1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Administrator’s Guide (Compute)
    5. Cloud Service Providers
    6. Cloud discovery

    Cloud discovery

    It’s difficult to ensure that all your apps running on all the different types of cloud services are being properly secured. If you’re using multiple cloud platforms, you might have many separate accounts per platform. You could easily have hundreds of combinations of providers, accounts, and regions where cloud native services are being deployed.
    Cloud discovery helps you find all cloud-native services being used across cloud service providers - AWS, Azure, and Google Cloud, across all regions, and across all accounts. It continuously monitors these accounts, detects when new services are added, and reports which services are unprotected, and helps you mitigate your exposure to rogue deployments, abandoned environments, and sprawl.
    Cloud discovery offers coverage for the following services.
    Registries:
    • AWS
    • Azure
    • Google Artifact Registry
      1
    • Google Container Registry
      2
    Serverless functions:
    • AWS
      3
      4
    • Azure
    • Google Cloud
    3
    Managed platforms:
    • AWS ECS
    • AWS EKS
    • Azure Kubernetes Service (AKS)
    • Azure Container Instances (ACI)
    • Google Kubernetes Engine (GKE)
    Virtual machines:
    • AWS EC2 instances
    • Azure VMs
      3
    • Google Cloud Platform (GCP) Compute Engine VM instances
      3
    1
    Although Artifact Registry supports a number of content types (for example, Java, Node.js, and Python language packs), Prisma Cloud only supports discovering and scanning Docker images.
    2
     For Google Container Registry, create credentials on
    Compute > Manage > Cloud accounts
    .
    Prisma Cloud doesn’t support scanning Helm charts saved as OCI images and stored in Artifact Registry. The OCI image that represents a Helm chart has a single layer that contains the Helm package. It’s only a way to store a Helm chart, but it has no meaning in terms of a container. Prisma Cloud has no way to run the image to scan it. Note that Helm charts stored as OCI images will be shown in the list of resources discovered in the registry because we can’t indicate their type until we actually pull and scan them.
    3
    Auto-defend is currently not yet available for these services. Auto-defend utilizes rule-based policies to automatically deploy Prisma Cloud Defenders to protect resources in your environment.
    4
     Prisma Cloud ingestion only provides information on $LATEST version of AWS serverless functions and not other versions.
    Cloud discovery won’t find Google Artifact Registry and Google Container Registry when credentials are imported from Prisma Cloud. Prisma Cloud finds those registries if you create the credentials in
    Compute > Manage > Cloud accounts
    .

    Ingestion-Based Discovery

    After onboarding a cloud account into the platform, you can reuse the same onboarded account in Compute for Cloud Discovery without the need for additional permissions on cloud accounts. Cloud Discovery uses this ingested data to discover unprotected workloads across your monitored environment. By using the same ingested metadata from cloud providers for both CSPM and CWP, the time to scan for unprotected resources is reduced substantially, providing instant visibility into undefended workloads in your organization.
    Prisma Cloud needs an additional set of permissions to enable protection for these workloads. For example, to deploy Defenders automatically on undefended VM machines. Review the permissions by feature table to learn about the needed permissions and protection for the onboarding template.

    Configure Discovery for Cloud Service Providers

    You can configure Prisma Cloud to scan your cloud service provider accounts for cloud-native resources and services. Then, you can configure Prisma Cloud to protect them with a single click.
    1. Log in to Prisma Cloud.
    2. Select
      Compute > Manage > Cloud Accounts
      .
    3. Select the accounts to scan. If there are no accounts in the table, you can import Prisma Cloud onboarded accounts, using the "Add account" workflow and selecting "Prisma Cloud" as the provider.
    4. Select
      Bulk actions
       >
      Discovery configuration
    5. Enable
      Cloud discovery
      .
    6. Save
       your changes.
    7. Review the scan results.
      1. Select
        Compute > Manage > Cloud Accounts
         to view the scan report in tabular format.
        1. Select the Show account details icon to see the discovery scan results for resources within the cloud account.
      2. Select
        Radar > Cloud
         to view the scan report in a visual format.
        In the Radar you can see the details for the resources that are protected using Defenders and agentless scanning across the services in each region.
      3. Select
        Defend
         for the entities you want Prisma Cloud to scan for vulnerabilities.
        A new auto-defend rule is proposed. Select the appropriate credential, tweak the scan rule as desired, then click
        Add
        .
      4. See the scan results on
        Compute > Monitor > Vulnerabilities > {Images > Registry|Functions}
        .