PM updates

hlxsites · Oct 21, 2024 · 71018b6 · 71018b6
1 parent d964156
commit 71018b6
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 0 deletions.
diff --git a/...rk-security/container-network-exposure/container-network-exposure-overview.adoc b/...rk-security/container-network-exposure/container-network-exposure-overview.adoc
@@ -28,6 +28,8 @@ CNA supports only inbound calculation. The data refresh or ingestion occurs once
 
 Prisma Cloud does not support the following for Container Exposure:
 
+* AWS Classic Load Balancers
+
 * Red Hat Openshift clusters
 
 * Non-Kubernetes based orchestration platforms (AWS ECS, Azure WebApp/Container Instances, GCP Cloud Run)

diff --git a/...ration/network-security/container-network-exposure/satellite-prerequisites.adoc b/...ration/network-security/container-network-exposure/satellite-prerequisites.adoc
@@ -37,6 +37,14 @@ Satellite ingests the following objects:
 * DaemonSet
 * NetworkPolicy
 * Core DNS Logs
+* Replication Controller
+* Ingress
+* Cilium Network Policy
+* Service Account
+* Role
+* RoleBinding
+* ClusterRole
+* ClusterRoleBinding
 
 
 === Supported Platforms

diff --git a/...ministration/network-security/investigate-network-exposure-on-prisma-cloud.adoc b/...ministration/network-security/investigate-network-exposure-on-prisma-cloud.adoc
@@ -41,5 +41,15 @@ config from network where source.network = '0.0.0.0/0' and address.match.criteri
 +
 image::administration/cna-4.png[]
 
+//CWP-61079 related to PCSUP-23569 > CNA permissions for cloning policies
+//CNA policies have a different behavior than config policies, regarding cloning.
+
+//Aside from Policy-CRUD permission, cloning CNA policies also requires Investigate-Network_View permission. 
+//In contrast, cloning Config policies does not require Investigate-Config_View. This is because the CNA suggest API (called during cloning) requires Investigate-Network_View, while Config suggest only requires Policy_Read.
+
+//The issue does not happen with IAM or Config policies. 
+//Custom role user with permission to create, delete policies is unable to clone any “Network” Policies.
+//Error below is seen.
+//The Service Account Key Uploaded is not valid. Please update to continue
 
 Learn how to xref:../../governance/create-a-network-policy.adoc[create a network exposure policy].