Update an Onboarded AWS Account
After you add your cloud account to Prisma Cloud, you may need to update the Prisma Cloud stack to provide additional permissions for new policies that are frequently added to help you monitor your cloud account and ensure that have a good security posture. When you update the CFT stack, Prisma Cloud can ingest data on new services that are supported. These CFTs are available directly from the Prisma Cloud administrative console.
In addition to updating the CFT stack for enabling permissions for new services, you can use this workflow to update the account groups that are secured with Prisma Cloud or to enable or disable the security capabilities and permissions. If you enable a security capability that you had not enabled during the initial onboarding, make sure you
Download IAM Role CFT
again and complete the required steps in order for the updated permissions to be granted to Prisma Cloud.For instruction on updating your AWS Organization, see Update an Onboarded AWS Organization.
- Log in to the Prisma Cloud administrative console.
- Select the AWS cloud account you want to modify.Select and click theEditicon for the cloud account to manage from the list of cloud accounts.
- OnEdit Cloud Account, navigate toConfigure Account, andDownload IAM Role CFT.
- (To change permissions for the Prisma Cloud role)Update the Prisma Cloud App using the CFT you downloaded in the above step. You can update the stack either using the AWS console or the AWS CLI.
- Log in to AWS console.
- Select .
- Select thePrismaCloudAppstack to update and selectUpdate.SelectReplace current templateandUpload a template fileyou downloaded earlier.
If you decide to create a new stack instead of updating the existing stack, you must copy the PrismaCloudRoleARN value from the CFT outputs tab. - Configure stack options.
- ClickNextand verify the settings.
- Preview your changesto the CloudFormation template for the role you updated.
- Updateyour CFT.If you created a new stack, you must log in to the Prisma Cloud administrative console, select your cloud account on , click theEditicon, navigate toConfigure Account, and enter thePrismaCloudRoleARNvalue from the AWS CFT output in theIAM Role ARNfield.If you want to use AWS Command Line Interface to deploy the updated Prisma Cloud App stack. Using the AWS CLI tool, enter the following command to deploy the CFT that you downloaded.
- Check the status to verify that Prisma Cloud can successfully retrieve information on your cloud resources.
