How to Implement Network Segmentation for 2026 Clouds with Palo Alto Prisma and AWS VPC

# Provider configuration for AWS and Prisma Cloud
# Requires AWS CLI v2.15+ and Prisma Cloud API key with Network Admin role
terraform {
  required_version = ">= 1.7.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.40"
    }
    prismacloud = {
      source  = "PaloAltoNetworks/prismacloud"
      version = "~> 1.2"
    }
  }
  # Prevent accidental destruction of production network resources
  lifecycle {
    prevent_destroy = true
  }
}

# Configure AWS provider for us-east-1 (2026 supported region with VPC Lattice GA)
provider "aws" {
  region = var.aws_region
  default_tags {
    tags = {
      ManagedBy = "terraform"
      Project   = "2026-network-segmentation"
      CostCenter = "cloud-security"
    }
  }
}

# Configure Prisma Cloud provider with API credentials
provider "prismacloud" {
  url    = var.prisma_api_url
  api_key = var.prisma_api_key
  api_secret = var.prisma_api_secret
}

# Variable validation for AWS region
variable "aws_region" {
  type        = string
  description = "AWS region to deploy VPCs"
  default     = "us-east-1"
  validation {
    condition     = contains(["us-east-1", "us-west-2", "eu-west-1"], var.aws_region)
    error_message = "Region must be a 2026-supported VPC Lattice GA region."
  }
}

# Web tier VPC: public subnets only, no direct access to app/data tiers
resource "aws_vpc" "web" {
  cidr_block           = "10.0.1.0/24"
  enable_dns_support   = true
  enable_dns_hostnames = true
  tags = {
    Name        = "web-tier-vpc"
    Tier        = "web"
    Segmentation = "public"
  }
}

# App tier VPC: private subnets, accessible only from web tier via VPC Lattice
resource "aws_vpc" "app" {
  cidr_block           = "10.0.2.0/24"
  enable_dns_support   = true
  enable_dns_hostnames = true
  tags = {
    Name        = "app-tier-vpc"
    Tier        = "app"
    Segmentation = "private"
  }
}

# Data tier VPC: fully private, no ingress except from app tier
resource "aws_vpc" "data" {
  cidr_block           = "10.0.3.0/24"
  enable_dns_support   = true
  enable_dns_hostnames = true
  tags = {
    Name        = "data-tier-vpc"
    Tier        = "data"
    Segmentation = "restricted"
  }
}

# VPC Lattice service network to manage cross-VPC connectivity
resource "aws_vpc_lattice_service_network" "segmentation_sn" {
  name = "2026-segmentation-service-network"
  tags = {
    Name = "segmentation-service-network"
  }
}

# Associate web VPC with service network (ingress only)
resource "aws_vpc_lattice_service_network_vpc_association" "web_assoc" {
  service_network_identifier = aws_vpc_lattice_service_network.segmentation_sn.id
  vpc_identifier             = aws_vpc.web.id
}

# Associate app VPC with service network (bidirectional with web, ingress from web only)
resource "aws_vpc_lattice_service_network_vpc_association" "app_assoc" {
  service_network_identifier = aws_vpc_lattice_service_network.segmentation_sn.id
  vpc_identifier             = aws_vpc.app.id
}

# Associate data VPC with service network (ingress only from app tier)
resource "aws_vpc_lattice_service_network_vpc_association" "data_assoc" {
  service_network_identifier = aws_vpc_lattice_service_network.segmentation_sn.id
  vpc_identifier             = aws_vpc.data.id
}

# Output VPC IDs for use in Prisma policy configuration
output "vpc_ids" {
  value = {
    web  = aws_vpc.web.id
    app  = aws_vpc.app.id
    data = aws_vpc.data.id
  }
  description = "VPC IDs for Prisma Cloud segmentation policy binding"
}

#!/usr/bin/env python3
"""
Prisma Cloud VPC Lattice Policy Manager
Deploys zero-trust segmentation policies for 2026 cloud networks
Requires: Python 3.11+, requests 2.31+, prismacloud-api 0.9+
"""

import os
import sys
import json
import logging
from typing import Dict, List, Any
import requests
from requests.exceptions import HTTPError, ConnectionError

# Configure logging for audit trails (required for SOC2 compliance)
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s",
    handlers=[logging.FileHandler("prisma_policy_deploy.log"), logging.StreamHandler()]
)
logger = logging.getLogger(__name__)

class PrismaVpcLatticeManager:
    """Manages Prisma Cloud segmentation policies for AWS VPC Lattice"""

    def __init__(self, api_url: str, api_key: str, api_secret: str):
        self.api_url = api_url.rstrip("/")
        self.auth_token = self._get_auth_token(api_key, api_secret)
        self.headers = {
            "Authorization": f"Bearer {self.auth_token}",
            "Content-Type": "application/json"
        }
        # Verify Prisma Cloud version is 24.3+ (required for VPC Lattice integration)
        self._verify_prisma_version()

    def _get_auth_token(self, api_key: str, api_secret: str) -> str:
        """Retrieve OAuth token from Prisma Cloud API"""
        auth_endpoint = f"{self.api_url}/login"
        payload = {"username": api_key, "password": api_secret}
        try:
            response = requests.post(auth_endpoint, json=payload, timeout=10)
            response.raise_for_status()
            return response.json()["token"]
        except HTTPError as e:
            logger.error(f"Authentication failed: {e.response.text}")
            sys.exit(1)
        except ConnectionError as e:
            logger.error(f"Failed to connect to Prisma API: {e}")
            sys.exit(1)

    def _verify_prisma_version(self) -> None:
        """Check Prisma Cloud version meets 2026 requirements"""
        version_endpoint = f"{self.api_url}/version"
        try:
            response = requests.get(version_endpoint, headers=self.headers, timeout=10)
            response.raise_for_status()
            version = response.json()["version"]
            if not version.startswith("24.3") and not version.startswith("24.4"):
                logger.error(f"Prisma Cloud version {version} does not support VPC Lattice. Requires 24.3+")
                sys.exit(1)
            logger.info(f"Verified Prisma Cloud version: {version}")
        except HTTPError as e:
            logger.error(f"Version check failed: {e.response.text}")
            sys.exit(1)

    def create_segmentation_policy(self, policy_config: Dict[str, Any]) -> str:
        """Create zero-trust segmentation policy in Prisma Cloud"""
        policy_endpoint = f"{self.api_url}/policy/vpc-lattice"
        try:
            response = requests.post(policy_endpoint, headers=self.headers, json=policy_config, timeout=10)
            response.raise_for_status()
            policy_id = response.json()["policyId"]
            logger.info(f"Created segmentation policy: {policy_id}")
            return policy_id
        except HTTPError as e:
            logger.error(f"Policy creation failed: {e.response.text}")
            sys.exit(1)

    def bind_policy_to_service_network(self, policy_id: str, service_network_arn: str) -> None:
        """Bind segmentation policy to AWS VPC Lattice service network"""
        bind_endpoint = f"{self.api_url}/policy/vpc-lattice/{policy_id}/bind"
        payload = {"serviceNetworkArn": service_network_arn}
        try:
            response = requests.post(bind_endpoint, headers=self.headers, json=payload, timeout=10)
            response.raise_for_status()
            logger.info(f"Bound policy {policy_id} to service network {service_network_arn}")
        except HTTPError as e:
            logger.error(f"Policy binding failed: {e.response.text}")
            sys.exit(1)

def main():
    # Load configuration from environment variables (avoids hardcoding secrets)
    required_vars = ["PRISMA_API_URL", "PRISMA_API_KEY", "PRISMA_API_SECRET", "VPC_LATTICE_SN_ARN"]
    for var in required_vars:
        if var not in os.environ:
            logger.error(f"Missing required environment variable: {var}")
            sys.exit(1)

    # Initialize Prisma manager
    manager = PrismaVpcLatticeManager(
        api_url=os.environ["PRISMA_API_URL"],
        api_key=os.environ["PRISMA_API_KEY"],
        api_secret=os.environ["PRISMA_API_SECRET"]
    )

    # Define zero-trust segmentation policy: web -> app only, app -> data only
    policy_config = {
        "name": "2026-zero-trust-segmentation",
        "description": "Allow web tier to app tier, app tier to data tier, deny all else",
        "rules": [
            {
                "name": "web-to-app-allow",
                "source": {"vpcId": os.environ.get("WEB_VPC_ID")},
                "destination": {"vpcId": os.environ.get("APP_VPC_ID")},
                "protocol": "TCP",
                "port": 8080,
                "action": "ALLOW",
                "priority": 100
            },
            {
                "name": "app-to-data-allow",
                "source": {"vpcId": os.environ.get("APP_VPC_ID")},
                "destination": {"vpcId": os.environ.get("DATA_VPC_ID")},
                "protocol": "TCP",
                "port": 5432,
                "action": "ALLOW",
                "priority": 200
            },
            {
                "name": "deny-all-cross-vpc",
                "source": {"cidr": "0.0.0.0/0"},
                "destination": {"cidr": "0.0.0.0/0"},
                "action": "DENY",
                "priority": 1000
            }
        ]
    }

    # Deploy policy and bind to VPC Lattice service network
    policy_id = manager.create_segmentation_policy(policy_config)
    manager.bind_policy_to_service_network(policy_id, os.environ["VPC_LATTICE_SN_ARN"])
    logger.info("Segmentation policy deployment complete")

if __name__ == "__main__":
    main()

# GitHub Actions Workflow: Deploy Network Segmentation Policies
# Triggers on push to main branch, validates and deploys Prisma + AWS VPC config
# Requires GitHub Secrets: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, PRISMA_API_KEY, PRISMA_API_SECRET

name: Deploy 2026 Network Segmentation

on:
  push:
    branches: [ main ]
    paths:
      - "terraform/**"
      - "prisma-policies/**"
  pull_request:
    branches: [ main ]
    paths:
      - "terraform/**"
      - "prisma-policies/**"

env:
  AWS_REGION: us-east-1
  PRISMA_API_URL: https://api.prismacloud.io

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Terraform 1.7+
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.7.0
          terraform_wrapper: false

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Terraform init and validate
        working-directory: ./terraform
        run: |
          terraform init -backend-config="bucket=${{ secrets.TF_STATE_BUCKET }}" -backend-config="key=network-segmentation.tfstate"
          terraform validate
          terraform fmt -check -recursive

      - name: Setup Python 3.11+
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: "pip"

      - name: Install Python dependencies
        run: pip install requests prismacloud-api pylint

      - name: Lint Prisma policy scripts
        run: pylint prisma-policies/*.py --disable=C0114,C0115

      - name: Run Prisma policy validation (dry-run)
        env:
          PRISMA_API_KEY: ${{ secrets.PRISMA_API_KEY }}
          PRISMA_API_SECRET: ${{ secrets.PRISMA_API_SECRET }}
          WEB_VPC_ID: ${{ secrets.WEB_VPC_ID }}
          APP_VPC_ID: ${{ secrets.APP_VPC_ID }}
          DATA_VPC_ID: ${{ secrets.DATA_VPC_ID }}
          VPC_LATTICE_SN_ARN: ${{ secrets.VPC_LATTICE_SN_ARN }}
        run: python prisma-policies/validate_policies.py --dry-run

  deploy:
    needs: validate
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Terraform 1.7+
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.7.0
          terraform_wrapper: false

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Terraform apply (AWS VPCs + VPC Lattice)
        working-directory: ./terraform
        run: |
          terraform init -backend-config="bucket=${{ secrets.TF_STATE_BUCKET }}" -backend-config="key=network-segmentation.tfstate"
          terraform apply -auto-approve
          echo "VPC_IDS<> $GITHUB_ENV
          terraform output -json vpc_ids >> $GITHUB_ENV
          echo "EOF" >> $GITHUB_ENV

      - name: Deploy Prisma segmentation policies
        env:
          PRISMA_API_URL: ${{ env.PRISMA_API_URL }}
          PRISMA_API_KEY: ${{ secrets.PRISMA_API_KEY }}
          PRISMA_API_SECRET: ${{ secrets.PRISMA_API_SECRET }}
          WEB_VPC_ID: ${{ fromJson(env.VPC_IDS).web }}
          APP_VPC_ID: ${{ fromJson(env.VPC_IDS).app }}
          DATA_VPC_ID: ${{ fromJson(env.VPC_IDS).data }}
          VPC_LATTICE_SN_ARN: ${{ secrets.VPC_LATTICE_SN_ARN }}
        run: python prisma-policies/deploy_policies.py

      - name: Run compliance check
        run: python prisma-policies/compliance_check.py --standard soc2,pci-dss,iso27001

      - name: Upload deployment artifacts
        uses: actions/upload-artifact@v4
        with:
          name: segmentation-deployment-logs
          path: prisma-policies/*.log

variable "segmentation_rules" {
  type = list(object({
    source_cidr = string
    destination_cidr = string
  }))
  validation {
    condition     = alltrue([for rule in var.segmentation_rules : rule.source_cidr == "" && rule.destination_cidr == ""])
    error_message = "CIDR-based selectors are prohibited. Use vpcId instead."
  }
}

resource "prismacloud_defender_deployment" "ebpf_agent" {
  name = "ebpf-telemetry-agent"
  type = "eks"
  cluster_name = var.eks_cluster_name
  defender_type = "agentless-ebpf"
  enable_runtime_protection = true
  enable_network_protection = true
}

- name: Dry-run policy check
  run: python prisma-policies/deploy.py --dry-run --output report.json
- name: Fail if policy violates compliance
  run: python prisma-policies/check_compliance.py report.json --standard pci-dss

prisma-aws-vpc-segmentation/
├── terraform/
│   ├── main.tf                # AWS VPC, VPC Lattice, Prisma provider config
│   ├── variables.tf           # Input variables with validation
│   ├── outputs.tf             # VPC IDs, service network ARNs
│   ├── versions.tf            # Provider version constraints
│   └── terraform.tfvars.example # Example variable values
├── prisma-policies/
│   ├── deploy_policies.py     # Prisma policy deployment script
│   ├── validate_policies.py   # Dry-run policy validation
│   ├── compliance_check.py    # SOC2/PCI-DSS compliance checks
│   └── requirements.txt      # Python dependencies
├── .github/
│   └── workflows/
│       └── deploy-segmentation.yml # CI/CD pipeline
├── docs/
│   ├── benchmarks.md          # Latency and cost benchmark data
│   └── troubleshooting.md    # Common pitfall fixes
└── README.md                  # Tutorial overview and setup instructions