Palo Alto Networks

C Prisma Cloud (Enterprise Edition)

Workloads call the Prisma Cloud API with a static access key (ID and secret) that is swapped at /login for a 10-minute JWT; no OIDC or workload identity path exists. Keys can be capped by an org maximum validity, rotated by API, held by role-scoped service accounts and show last use, but GitHub does not report leaks. Into your cloud it is keyless on AWS and Alibaba, but Azure wants an app client secret and GCP a service account JSON key.

Docs: pan.dev · Checked 2026-10-22 · source YAML · dispute via PR

Inbound C

How a workload running anywhere authenticates to this product.

Access key (Access Key ID + Secret Key) owned by a user or service account, posted to POST /login as username/password to get a JWT valid for 10 minutes (x-redlock-auth). The Compute (Runtime Security) API, twistcli, the Terraform provider and CI plugins take the same access key.

pan.dev checked 2026-10-22
“To generate a token, you must have an access key and include the following values in the request body parameter — access key ID as the username and your secret key as the password.”
raw.githubusercontent.com checked 2026-10-22
“Prisma Cloud requires an API access key to enable programmatic access to the REST API.”
raw.githubusercontent.com checked 2026-10-22
“The JWT is valid for 10 minutes, so you must refresh the token for continued access to the Prisma Cloud API.”
pan.dev checked 2026-10-22
“Internally the token contains a Prisma Cloud platform token, which is only valid for 10 minutes.”
raw.githubusercontent.com checked 2026-10-22
“Prisma Cloud keys are required to access twistcli and the Compute API.”
raw.githubusercontent.com checked 2026-10-22
“You can authenticate to the API using basic auth.”
raw.githubusercontent.com checked 2026-10-22
“`password` - (Env: `PRISMACLOUD_PASSWORD`) Secret key.”
raw.githubusercontent.com checked 2026-10-22
“Add the Prisma Cloud access key as an environment variable to *GitHub Secrets*.”

Graded C on the same pattern as `cyera-data-security`: the bearer token is a 10-minute JWT, but minting it needs a long-lived Access Key ID and Secret Key, so a static secret sits at the root of every workload path. No OIDC, GitHub Actions, cloud workload identity or token-exchange login is documented; the OIDC configuration endpoints under /authn/api/v1/oauth2/config are for human SSO. Even Prisma Cloud's own GitHub Actions integration stores the access key in GitHub Secrets rather than trusting the runner's OIDC token. Reviewer check: the Runtime Security (Compute) docs say the Compute API also accepts the access key directly as HTTP Basic auth (used to download twistcli). Under the weakest-path rule that could be read as a plain static key (D, given 4 of 5 hygiene passes); it was kept at C because the documented API access paths (pan.dev, Terraform provider) all exchange the key for a short-lived token and the Basic path is optional. Defenders are not graded here. Palo Alto's newer platform, Cortex Cloud, has its own API keys and was not graded on this card.

Outbound B

How this product reaches into your cloud, repos, or other SaaS.

AWS onboarding creates an IAM role trusting Prisma Cloud's AWS account with an External ID, and Alibaba Cloud uses a RAM role trusting Prisma Cloud's account; both keyless. Azure onboarding hands Prisma Cloud an app registration's client secret, GCP onboarding uploads a service account JSON key, and OCI uses an API signing key for a dedicated IAM user.

raw.githubusercontent.com checked 2026-10-22
“Select *Require external ID* and paste the *ExternalID* value that you copied in Step 1 above.”
raw.githubusercontent.com checked 2026-10-22
“Type of trusted entity: *Another AWS Account* and enter the *Account ID*: *188619942792*”
raw.githubusercontent.com checked 2026-10-22
“A unique account ID is used to enable the trust relationship in the roles trust policy, which you will require later in the onboarding process.”
raw.githubusercontent.com checked 2026-10-22
“After you create the role and the permissions are enabled, you can add the Alibaba Cloud Resource Name (ARN) on Prisma Cloud to assume the role to monitor your Alibaba Cloud account.”
raw.githubusercontent.com checked 2026-10-22
“Application Client Secret: c_application_key”
raw.githubusercontent.com checked 2026-10-22
“The client secret is a secret string that the application uses to prove its identity when requesting a token.”
raw.githubusercontent.com checked 2026-10-22
“Provide xref:authorize-prisma-cloud.adoc#terraform[details] for *Application (Client) ID*, *Application Client Secret*, *Enterprise Application Object ID* from the script output.”
raw.githubusercontent.com checked 2026-10-22
“*Download Terraform Script* and follow the *Steps* to upload your *Service Account Key (JSON) file*.”
raw.githubusercontent.com checked 2026-10-22
“A combination of custom, predefined, and primitive roles grant the service account the permissions it needs to complete specific actions on the assets in your GCP organization or project.”
raw.githubusercontent.com checked 2026-10-22
“To onboard the Oracle Cloud account, a public key is needed to access the OCI API. This public key is embedded in the Terraform template, and it changes each time you download the template.”
raw.githubusercontent.com checked 2026-10-22
“Depending on your password policy, you can choose to rotate your user’s keys.”
raw.githubusercontent.com checked 2026-10-22
“Create and copy a Personal Access Token (PAT) on Bitbucket Server.”

Checked: cloud account onboarding for AWS (CloudFormation or manual IAM role trusting Prisma Cloud's AWS account 188619942792 with an External ID; keyless), Alibaba Cloud (RAM role trusting Prisma Cloud's Alibaba account, ARN pasted; keyless), Azure (Terraform or manual app registration in your tenant whose client secret you paste into Prisma Cloud; static secret, least-privilege custom role documented, so C/D on its own), GCP (service account with documented roles, its JSON key uploaded; static key) and OCI (Prisma Cloud generates the key pair and embeds only the public key for a dedicated IAM user in the Terraform template, so no secret leaves your hands, but it is a long-lived API signing key held by the vendor and rotated by re-running Terraform). Code Security repository connections: GitHub uses a GitHub App install (keyless); GitHub Server and GitLab Self-Managed want an OAuth application's client ID and secret; Bitbucket Server wants a personal access token. No documented option for Azure federated credentials or GCP Workload Identity Federation was found in the onboarding docs; either would lift outbound to A.

Hygiene for any static credential the product still issues

✓ Expiry enforceable	Passes on the org policy, not the default: out of the box a key with no expiry selected never expires, but an admin can set Enterprise Settings > Access Key Maximum Validity, a tenant-wide cap on key lifetime (platform-enforced maximum = pass, per the precedent applied to `temporal`). The docs do not list the drop-down values, so whether "no limit" is the shipped default is not publicly verifiable. raw.githubusercontent.com checked 2026-10-22 “Use the Access Key Maximum Validity settings to establish the platform limit for the maximum number of days for access key validity.” raw.githubusercontent.com checked 2026-10-22 “If you do not select key expiry, the key is set to never expire; if you select it, but do not specify a date, the key expires in a month.”
✓ Rotation via API	POST /access_keys, DELETE /access_keys/:id and an update-status call (make inactive) cover rotation. Each identity can hold at most two keys, enough for overlap during rotation. pan.dev checked 2026-10-22 “If you want to create an access key for an existing Prisma Cloud service account instead of for the current user, then specify the name of the existing service account as the value for the request body parameter serviceAccountName.” pan.dev checked 2026-10-22 “Deletes the access key that has the specified ID.”
✓ Scoped keys	Service accounts are purpose-built machine principals with their own role (permission group plus account groups), and a key is bound to one role. A key made by a human user carries that user's role permissions. raw.githubusercontent.com checked 2026-10-22 “Service Accounts can be created for automation use cases to enable a nonhuman entity to interact programmatically with the Prisma Cloud APIs.” raw.githubusercontent.com checked 2026-10-22 “When you create an access key, the key is tied to the role with which you logged in and if you delete the role, the access key is automatically deleted.” raw.githubusercontent.com checked 2026-10-22 “The CI User role is purpose-built for this use case.”
✓ Last-used visible	raw.githubusercontent.com checked 2026-10-22 “You can verify the expiry date for the key and can update it here, review when it was last used and the status —Active or Expired.”
✗ Leak revocation	Neither Palo Alto Networks nor Prisma Cloud appears in GitHub's supported secret scanning patterns table, so a leaked access key is not reported to Palo Alto for revocation. docs.github.com checked 2026-10-22

Notes

Graded on Prisma Cloud Enterprise Edition (SaaS): the CSPM API, the Runtime Security (Compute) API it fronts, and cloud account onboarding. docs.prismacloud.io redirects scripted fetches, so admin-guide receipts cite the vendor's public source repo (PaloAltoNetworks/prisma-cloud-docs) and API receipts cite pan.dev. Self-hosted Prisma Cloud Compute Edition is not graded here. Four of five hygiene checks pass; GitHub secret-scanning partnership would make five. Inbound moves to B or A only if /login (or a successor) accepts a federated token from GitHub Actions, a cloud workload identity or a customer-chosen OIDC issuer. Outbound moves to A with keyless Azure (federated credential or multi-tenant app consent) and GCP (service account impersonation or WIF) onboarding.

Badge

[![wif.tax grade](https://wif.tax/badge/paloalto-prisma-cloud.svg)](https://wif.tax/p/paloalto-prisma-cloud/)