What does Prisma Cloud execute to change public cloud infrastructure when autoremediation is enabled?

When autoremediation is enabled for cloud infrastructure, Prisma Cloud deploys a serverless function (e.g., AWS Lambda) into the customer's account. This function is triggered by an alert and executes commands using the cloud provider's native APIs or SDKs to correct the misconfiguration. These actions are functionally equivalent to running public cloud CLI commands. For example, to fix an overly permissive security group, the function would execute an API call to modify the ingress rules, just as an aws ec2 revoke-security-group-ingress CLI command would.

A. Remediation scripts are not executed from a "local" Prisma Cloud environment but from within the customer's cloud account via serverless functions.
B. Host agents (Defenders) are part of Prisma Cloud Compute for workload protection, not for remediating cloud infrastructure posture (CSPM).
C. Third-party tools are used for notifications or ticketing integrations, not for executing the direct remediation actions on the cloud infrastructure.

1. Palo Alto Networks, Prisma Cloud Docs. "Remediation for Misconfigurations on Prisma Cloud". This page details the remediation process and provides the specific CLI commands that Prisma Cloud can execute to resolve policy violations. It states, "For each policy, Prisma Cloud provides you with the CLI command to remediate the issue."

2. Palo Alto Networks, Prisma Cloud Docs. "Set Up Automated Remediation on AWS". This guide explains the setup process, which involves deploying a CloudFormation template that creates "the IAM role, policies, and Lambda functions required to enable automated remediation." This confirms that serverless functions are the execution mechanism.