Cspm Redlock
You set up cspm redlock by linking your cloud accounts to its read-only scanner. This tool then checks your cloud state and network logs against safety rules. Most teams start by giving the scanner a read role across all cloud accounts. Trouble starts when engineers still use broad admin roles to fix the alerts. How cspm redlock checks your cloud accounts RedLock started as a standalone cloud scanner before Palo Alto Networks bought it. It now forms the core of the Prisma Cloud posture tool.
Redlock: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up cspm redlock by linking your cloud accounts to its read-only scanner. This tool then checks your cloud state and network logs against safety rules. Most teams start by giving the scanner a read role across all cloud accounts. Trouble starts when engineers still use broad admin roles to fix the alerts.
How cspm redlock checks your cloud accounts
RedLock started as a standalone cloud scanner before Palo Alto Networks bought it. It now forms the core of the Prisma Cloud posture tool. The system works without agents by reading data from your cloud provider APIs. You create a cross-account role in your cloud console first. Then you give that role read rights to view asset data and logs.
Once linked, the engine pulls state data from your cloud services on a schedule. It reads firewall rules, storage bucket flags, and role permissions. It also ingests network flow logs and audit trails from your cloud accounts. The tool compares this data against built-in rule sets and custom search queries. When it spots an open port or a public bucket, it fires an alert. Your security team then routes that alert to a chat channel or ticket queue.
Why teams need more than posture scans
A posture scanner is great at finding bad settings across hundreds of cloud accounts. It shows you which storage buckets are public and which roles look too wide. It also tracks cloud audit logs to show who logged in from odd locations. This gives compliance teams a clear map of their cloud setup.
Still, posture scans only look at static settings and past logs. They do not watch what engineers or apps do inside a live session. The cloud role decides who can log in to a database or server. It cannot check each query or command as it runs in flight. If an engineer has a role to fix a database, they have full access. A posture tool will not stop a bad query from dropping a table. It also cannot rewrite sensitive fields like emails or card numbers in query results. You only find out about the mistake after the next log scan runs.
Redlock: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
How to handle alerts and fix broad roles
When a scan flags a bad setting, an engineer must log in and fix it. Many teams use auto-fix scripts, though these scripts often need broad write rights. If humans fix the issue by hand, they often ask for admin roles. Granting full cloud admin rights just to close one alert creates new risk.
Teams should shrink the scope of every fix role they hand out. Split read roles from write roles in your cloud identity tool. Make sure engineers do not share static keys when they run repair scripts. You also need controls that sit closer to the data layer. Cloud API scans check the outside of the box, not the commands inside it. Pairing posture scans with session-level controls closes the gap between cloud settings and live data use.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What happened to the standalone RedLock product?
Palo Alto Networks bought RedLock and merged it into Prisma Cloud. The core scanning features now run as part of that larger cloud tool.
Does a cloud posture scanner require agents on servers?
No, standard posture scans read state data through cloud provider APIs. You only link a read role, and the tool pulls data remotely.
Can posture tools mask sensitive data in live database queries?
No, posture scanners only check cloud settings and past audit logs. They do not sit in the data path to rewrite phone numbers or emails in results.