Documentation / Policy and Compliance

Remediation

Auto Remediation

Auto Remediation closes the loop on findings: instead of only telling you what's wrong, Prancer applies the fix — directly on the cloud resource for a Cloud Service Provider (CSP) finding, or as a pull request against your repository for an Infrastructure-as-Code (IaC) finding.

Two remediation modes

| Mode | What happens | Where the change lands |

| --- | --- | --- |

| CSP (Cloud) | Prancer authenticates with the connector and patches the resource via the cloud API. | Live cloud account. |

| IaC | Prancer creates a branch, commits the fix, and opens a pull request. | Your Git repository. |

Warning: CSP remediation requires the connector to have write permissions on the target resource. Use a least-privilege role scoped to the resource types you want to fix.

Before you start

  • A completed Compliance Run with at least one failed test.
  • For CSP remediation: a connector with permissions to modify the affected resource.
  • For IaC remediation: a Git connector with permission to push branches and open PRs.

How to launch a remediation

1. Go to Infra Findings and find a failed test case. 2. Click the blue circle in the Remediate column, or open the finding and click Remediate. 3. Prancer applies the fix automatically — directly on the cloud resource or via PR for IaC.

IaC Remediation Workflow

1. Review findings and severity

!Findings list

2. Select findings

Open an individual finding, or select multiple in bulk (e.g. all failures of the same resource type).

3. Initiate remediation

Click Remediate to trigger Prancer's AI-assisted remediation engine.

!Select remediate

4. Automated code updates

Prancer checks out the IaC code, applies the fix, commits, and submits a pull request.

!PR opened

5. Inspect the diff

The PR shows exactly which lines changed, with rule context attached.

!PR detail

6. Approve and merge

A team member reviews and merges the PR — the next deployment carries the fix.

Tip: Wire your CI to re-run Compliance on the merged commit so the finding closes automatically.

CSP Remediation Workflow

1. Review findings and severity

!Cloud findings list

2. Select findings

Open one finding, or bulk-select all failures of the same resource type.

!Cloud remediate

3. Initiate remediation

Click Remediate. Prancer applies the change to the live cloud resource immediately using the connector credentials.

Warning: CSP remediation is irreversible. Confirm the change in a lower environment first, or use IaC remediation if you need a review gate.

Supported IaC resources

AWS

| Resource | Description |

| --- | --- |

| acm | AWS Certificate Manager — provision and manage SSL/TLS certificates. |

| amplify | AWS Amplify — develop and host full-stack web/mobile apps. |

| api_gateway | Amazon API Gateway — create, deploy, manage APIs. |

| cloudfront | Amazon CloudFront — CDN and edge caching. |

| cloudtrail | AWS CloudTrail — governance, compliance, audit logging. |

| code | AWS Code services (CodeCommit, CodeBuild, CodeDeploy). |

| database | AWS database services (RDS, DynamoDB). |

| ec2 | Amazon EC2 — virtual machines. |

Azure

| Resource | Description |

| --- | --- |

| Redis | Azure Cache for Redis — high-performance caching. |

| activitylogalerts | Trigger actions from Azure Activity Log events. |

| aks | Azure Kubernetes Service. |

| applicationgateways | Application Gateway — load balancing and WAF. |

| azure_firewallso | Azure Firewall — network protection with HA & autoscale. |

| cdn | Azure CDN. |

| container_instance | Azure Container Instances — serverless containers. |

| cosmosdb | Cosmos DB — globally distributed multi-model database. |

| databricks | Azure Databricks — big data analytics and AI. |

| dbadministrators | DB administrator role config. |

| dbauditingsettings | Database auditing. |

| dbdataencryption | Data-at-rest encryption for Azure databases. |

| dbfirewallrules | Database firewall rules. |

| dbforMariaDB | Azure DB for MariaDB. |

| dbforMySQL | Azure DB for MySQL. |

| dbforMySQL_firewallrules | Firewall rules for MySQL. |

| dbsecurityalertpolicies | Database security alert policies. |

| dbvulnerabilityassessments | Database vulnerability assessments. |

| diagnosticsettings | Resource log/metric collection. |

| disks | Azure managed disks. |

| eventgrid | Event Grid — event-based serverless architectures. |

| eventhub | Event Hubs — big-data streaming and ingestion. |

| frontdoors | Azure Front Door. |

| functionapp | Azure Functions / Function Apps. |

| keyvaultkeys | Cryptographic keys in Key Vault. |

| keyvaultsecrets | Secrets in Key Vault. |

| locks | Resource locks. |

| ms_defender_for_cloud | Microsoft Defender for Cloud. |

| networkwatchersflowlogs | Network Watcher flow logs. |

| nsg | Network Security Groups. |

| postgreSQL | Azure DB for PostgreSQL. |

| pricing | Pricing tier configuration. |

| recoveryservices_vaults | Backup and site recovery. |

| registrieswebhooks | ACR webhooks. |

| registry | Azure Container Registry. |

| secrets | Sensitive value storage (Key Vault). |

| securitycontacts | Security Center contact info. |

| sql_alert_policy | Azure SQL alert policies. |

| sql_database | Azure SQL Database. |

| sql_managedinstance | Azure SQL Managed Instance. |

| sql_servers | Azure SQL Servers. |

| sql_servers_auditing | SQL Server auditing. |

| sql_servers_encryption | TDE for SQL Servers. |

| sql_vulnerabilityassessments | SQL DB/MI vulnerability assessments. |

| storageaccounts | Azure Storage Accounts. |

| vm | Azure Virtual Machines. |

| vm_scale_sets | VM Scale Sets. |

| vmextensions | VM extensions. |

| vnetpeerings | VNet peering. |

| vnetsubnets | VNet subnets. |

| vpngateways | VPN gateways. |

| web | Azure Web Apps. |

GCP

| Resource | Description |

| --- | --- |

| cloudfunction | Cloud Functions — serverless event-driven compute. |

| compute | Compute Engine — VMs. |

| container | GKE — Kubernetes orchestration. |

| database | Cloud SQL and other GCP databases. |

| dns | Cloud DNS. |

| iam | Identity and Access Management. |

| kms | Cloud KMS — key management. |

| logging | Cloud Logging. |

| sqladmin | Cloud SQL Admin. |

| storage | Cloud Storage. |

Supported CSP resources

| Cloud | Resource | Description |

| --- | --- | --- |

| Azure | NSG (Network Security Group) | Inbound/outbound traffic filtering at subnet/NIC level. |

| Azure | Storage Account | Secure scalable storage for blobs, files, queues, tables. |

| AWS | IAM (Human & Non-Human) | Identity and access for AWS services and resources. |

| AWS | Security Group | Virtual firewall for EC2 instances and resources. |

| GCP | Security Group | VPC firewall rules for resource traffic control. |

Next steps