Guide: Onboarding a new cloud account in under 10 minutes (the real way).

Alright, let's cut through the usual marketing fluff. Everyone talks about rapid onboarding, but the real speed comes from automation, not the web console. If you're manually clicking through the Prisma Cloud UI to add every new AWS account or GCP project, you're building a future bottleneck.

The key is treating Prisma Cloud as another piece of infrastructure, managed by Terraform. This way, onboarding becomes a repeatable, version-controlled process. Here's the core of it, using their Terraform provider.

First, you'll need to configure the provider with your Prisma Cloud credentials. I usually manage these via environment variables or a secure backend.

```hcl
terraform {
required_providers {
prismacloud = {
source = "PaloAltoNetworks/prismacloud"
version = "~> 1.4"
}
}
}

provider "prismacloud" {
json_config_file = var.prisma_cred_file_path # Path to your downloaded API credentials
}
```

Then, the actual account onboarding resource for AWS. This defines the scan account, the role Prisma will assume, and the monitoring mode.

```hcl
resource "prismacloud_cloud_account" "aws_production_account" {
name = "aws-prod-account"
account_type = "account"
enabled = true
account_id = var.aws_account_id

cloud_account {
account_id = var.aws_account_id
enabled = true
name = "aws-prod-account"
role_arn = var.prisma_role_arn
account_type = "aws"
}
}
```

For GCP, the approach is similar but uses a service account. The critical part is that your `account_id` here is the GCP Project ID.

```hcl
resource "prismacloud_cloud_account" "gcp_dev_project" {
name = "gcp-dev-project"
account_type = "account"
enabled = true
account_id = var.gcp_project_id

cloud_account {
account_id = var.gcp_project_id
enabled = true
name = "gcp-dev-project"
account_type = "gcp"
credentials {
type = "service_account"
service_account_credentials {
project_id = var.gcp_project_id
private_key_id = var.service_account_key_id
client_email = var.service_account_email
client_id = var.service_account_client_id
private_key = var.service_account_private_key
}
}
}
}
```

Once this code is in your Terraform state, adding a new account is just updating a variable file and running `terraform apply`. The 10-minute claim is about the *process*, not the initial setup. The real time-saver is when your next account comes online; you just replicate the module, and it's integrated in a single pipeline run. This also ensures your compliance and security scanning kicks in immediately, with no lag waiting for manual setup.