Prowler

Prowler reads the configuration of your cloud account and lists risky settings, such as a public S3 bucket. On AWS, all you need to start is a user or role with read-only permissions.

This review is for people who manage AWS or other clouds and want to check their settings for gaps. After reading it, you can do the following:

• Set up the AWS permissions Prowler needs
• Check your own AWS account and read the report
• Narrow down the services and results

##What Prowler does

Prowler calls cloud APIs to collect settings and compares them with its built-in checks. The checks map to standards such as CIS, NIST, PCI-DSS, and ISO 27001, so you can see which requirement of which standard you don’t meet.

The main officially supported targets are:

The list grows often. Check the table in the official repository or Prowler Hub for the latest.

Besides the command-line Prowler CLI, there is Prowler Local Server with a web interface and the Prowler Cloud service. This review covers Prowler CLI.

##Required permissions (AWS)

The documentation tells you to attach these two AWS managed policies to the user or role that runs Prowler:

• SecurityAudit
• ViewOnlyAccess

Some checks need extra read permissions. Attach prowler-additions-policy.json from the official repository as a custom policy.

All of these are read permissions. A check needs no write access, so don’t run Prowler with administrator credentials.

##Try it safely on your own AWS account

1. Install Python 3.10 or later, then run pipx install prowler or pip install prowler. On macOS and Linux, brew install prowler also works. If prowler -v prints a version, you’re ready.

2. In your own AWS account, create an IAM user or role with only the permissions above.

3. Set up those credentials as an AWS CLI profile.

4. Run Prowler with the profile and a region:

   prowler aws --profile custom-profile -f us-east-1

5. When the run finishes, CSV, JSON-OCSF, and HTML reports appear in the output folder. Open the HTML report to see the result of each check, such as PASS or FAIL.

Limiting the run to one region with -f keeps your first scan short.

##Common tasks

Prowler exits with code 3 when any check fails. To keep CI from stopping, add -z (--ignore-exit-code-3).

##Cautions

##Read next

• cd ../trivyTrivyscans container images and IaC configuration files