Manage cloud workload policies

Create, copy, edit, enable, disable, and delete cloud workload policies.

Use Cloud Workload policies to detect risks and enforce actions across your workloads.

Open Posture Management → Rules & Policies → Policies → Cloud Workload.

Create a policy

Select Create Policy, then select the policy type.

Misconfiguration policy

1. Enter a unique name and description.
2. The evaluation stage is Runtime.
3. Select Next, then add the rules to evaluate.
4. Set rule severity, policy action, and remediation guidance as needed.
5. Select Asset Groups or Default Asset Scopes for the policy scope.
6. Select Done.

The policy summary updates as you configure its general settings, rules, and scope.

Misconfiguration policies work only at Runtime. The Kubernetes Admission Controller enforces them for clusters onboarded through the Posture Management connector.

Asset groups contain relevant compute assets only. A filter creates a dynamic group. Manually selected assets create a static group.

For Kubernetes Prevent policies, dynamic asset groups support these attributes:

• Kubernetes Resource Cluster, Namespace, Labels, Category, and Creation Time.
• Kubernetes Resource Name.

Malware policy

1. Enter a unique name and description.
2. Select CI, Runtime, or Deploy.
3. Define detection criteria and optional exclusions.
4. Configure the scope for the selected stage.
5. Select an action, severity, and optional remediation guidance.
6. Select Done.

At CI, the policy covers all Cloud Workload Build Container Images. A Prevent action fails the pipeline with exit code 2.

At Runtime, select asset groups or default asset scopes. Default scopes include all Cloud Workload assets, hosts, container images, container instances, Kubernetes workloads, and serverless functions.

At Deploy, select registry-image asset groups or all Cloud Workload registry images. Deploy policies create an issue by default.

Secret policy

1. Enter a unique name and description.
2. Select CI, Runtime, or Deploy.
3. Define detection criteria and optional exclusions.
4. Configure the stage-specific scope and action.
5. Select Done.

The available scopes and actions match those for Malware policies. At CI, the policy applies to all Cloud Workload Build Container Images. At Runtime, choose asset groups or default asset scopes. At Deploy, choose registry-image asset groups or all registry images.

Trusted Images policy

1. Enter a unique name and description.
2. The evaluation stage is Runtime.
3. Define image trust criteria and any exclusions.
4. Choose Asset Groups or Default Asset Scopes.
5. Select an action, severity, and optional remediation guidance.
6. Select Done.

Use stable image identifiers, such as registries, signatures, or digests. Avoid mutable tags. Pre-ingest images when trust criteria depend on image metadata.

Exclude system-critical namespaces, such as kube-system, from the scope. A namespace-scoped asset group applies only to that namespace.

Select Create an issue to log a violation. Select Prevent and create an issue to block it and log an issue. Trusted Images policies also provide an action for unavailable trust verdicts.

Enable or disable a policy

1. Select the policy.
2. On the Details page, use the toggle at the top.

Copy a policy

1. Select the policy.
2. On the Details page, select More Options (⋮) → Save as new.
3. Update the policy name, conditions, scope, or actions.
4. Select Done.

Edit a policy

1. Select the policy.
2. On the Details page, select Edit.
3. Make the required changes.
4. Select Done.

Delete a policy

1. Select the policy.
2. On the Details page, select More Options (⋮) → Delete policy.
3. Select Delete to confirm.