AWS Control Tower vs. Palo Alto Networks Prisma Cloud

We were wanting to prove the concept of a low touch process for quickly spinning up boilerplate AWS environments. We were able to get started quickly and to ensure that the AWS Well-Architected Framework principles were followed - at least upfront - however, we found that for our use case and expertise level it ultimately wasn't a fit. We have the skills on our team to manage more of this on our own. My recommendation would be contingent on what skills are already available on your team: if you can "do it yourself" you might as well so that you don't pay for resources you don't need and you have finer grain control over what's created.

Incentivized

Finding specific Cloud Vendor specific Cloud resource configuration, tags, network information and etc. is fairly easy to do. Cloud alert capabilities are pretty good and with proper knowledge top notch alerts can be created. Only downside I can think of is ease of use.

Incentivized

• Easily create new AWS accounts.
• Easily secure and manage AWS accounts.
• Landing zone with SSO is a huge win for larger teams.

Incentivized

• Vulnerability assessment using Twistlock
• Enhancing Security by scanning workload based on different Security standards and provide a compliance report
• CF template integration with CI/CD pipeline to identify any security issue before workload are deployed
• IAM/UEBA features additional to enchaining security posture
• Auto remediation
• Integration is simple and solution is supported on multiple cloud
• Customized dashboard/queries

Incentivized

• The AWS SSO GUI is not very intuitive and determining how to apply policies to users without creating redundant logins has been a challenge.
• The default guardrails do not fully encompass all the security checks that we needed.
• There does not appear to be any way to control roles at the IAM level from the control tower account through the GUI.
• Some features on AWS accounts still require logging into the individual account with the root user and cannot be done from AWS Control Tower.

Incentivized

• Real-time supports would be much appreciated. At the moment they have a third-party ticketing support tool, which can be replaced with real-time support, which can be provided to the user at the time of the issue.
• The user should be provided with all the learning material by the Palo Alto team at the time of license purchase. This would save a lot of users' time, which is taken up by research and finding the correct documents from the website.
• Themes can be introduced in the feature set, which would help the user customize the software as per their needs.

Incentivized

There is no way to easily close an AWS account whether it was created manually or via the AWS Control Tower. It takes too many steps to close it vs to provision a new AWS account

Incentivized

Using AWS Systems Manager and other slightly lower level components has been helpful for us to manage parts of our AWS presence at a more granular level than AWS Control Tower was designed for. It's not at all an apples-to-apples comparison as they solve different use cases, but for us, the use case associated with AWS Systems Manager was a better fit for our specific needs and skillsets. We did not need everything that AWS Control Tower was doing for us.

Incentivized

Our organization didn't consider any other tool, and so far we are pretty much satisfied with Prisma Cloud.

Incentivized

• Less time manually deploying accounts which was error prone.
• Central logging allowed us to have 1 place to view logs.

Incentivized

• Investigation time is severely reduced
• Has potential to identify misconfigurations
• Hard to setup

Incentivized