Package: prowler
Prowler SaaSandProwler Open Sourceare as dynamic and adaptable as the environment they’re meant to protect. Trusted by the leaders in security.Learn more atprowler.comDescriptionProwleris an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness.It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, AWS Well-Architected Framework Security Pillar, AWS Foundational Technical Review (FTR), ENS (Spanish National Security Scheme) and your custom security frameworks.ProviderChecksServicesCompliance FrameworksCategoriesAWS30261 ->prowler aws --list-services27 ->prowler aws --list-compliance6 ->prowler aws --list-categoriesGCP7311 ->prowler gcp --list-services1 ->prowler gcp --list-compliance2 ->prowler gcp --list-categoriesAzure374 ->prowler azure --list-servicesCIS soon1 ->prowler azure --list-categoriesKubernetesWork In Progress-CIS soon-📖 DocumentationThe full documentation can now be found athttps://docs.prowler.cloudLooking for Prowler v2 documentation?For Prowler v2 Documentation, please go tohttps://github.com/prowler-cloud/prowler/tree/2.12.1.⚙️ InstallPip packageProwler is available as a project inPyPI, thus can be installed using pip with Python >= 3.9, < 3.13:pip install prowlerprowler -vMore details athttps://docs.prowler.cloudContainersThe available versions of Prowler are the following:latest: in sync with master branch (bear in mind that it is not a stable version)<x.y.z>(release): you can find the releaseshere, those are stable releases.stable: this tag always point to the latest release.The container images are available here:DockerHubAWS Public ECRFrom GithubPython >= 3.9, < 3.13 is required with pip and poetry:git clone https://github.com/prowler-cloud/prowler
cd prowler
poetry shell
poetry install
python prowler.py -v📐✏️ High level architectureYou can run Prowler from your workstation, an EC2 instance, Fargate or any other container, Codebuild, CloudShell and Cloud9.📝 RequirementsProwler has been written in Python using theAWS SDK (Boto3),Azure SDKandGCP API Python Client.AWSSince Prowler uses AWS Credentials under the hood, you can follow any authentication method as describedhere.
Make sure you have properly configured your AWS-CLI with a valid Access Key and Region or declare AWS variables properly (or instance profile/role):aws configureorexport AWS_ACCESS_KEY_ID="ASXXXXXXX"export AWS_SECRET_ACCESS_KEY="XXXXXXXXX"export AWS_SESSION_TOKEN="XXXXXXXXX"Those credentials must be associated to a user or role with proper permissions to do all checks. To make sure, add the following AWS managed policies to the user or role being used:arn:aws:iam::aws:policy/SecurityAuditarn:aws:iam::aws:policy/job-function/ViewOnlyAccessMoreover, some read-only additional permissions are needed for several checks, make sure you attach also the custom policyprowler-additions-policy.jsonto the role you are using.If you want Prowler to send findings toAWS Security Hub, make sure you also attach the custom policyprowler-security-hub.json.AzureProwler for Azure supports the following authentication types:Service principal authentication by environment variables (Enterprise Application)Current az cli credentials storedInteractive browser authenticationManaged identity authenticationService Principal authenticationTo allow Prowler assume the service principal identity to start the scan, it is needed to configure the following environment variables:export AZURE_CLIENT_ID="XXXXXXXXX"export AZURE_TENANT_ID="XXXXXXXXX"export AZURE_CLIENT_SECRET="XXXXXXX"If you try to execute Prowler with the--sp-env-authflag and those variables are empty or not exported, the execution is going to fail.AZ CLI / Browser / Managed Identity authenticationThe other three cases do not need additional configuration,--az-cli-authand--managed-identity-authare automated options,--browser-authneeds the user to authenticate using the default browser to start the scan. Also--browser-authneeds the tenant id to be specified with--tenant-id.PermissionsTo use each one, you need to pass the proper flag to the execution. Prowler for Azure handles two types of permission scopes, which are:Azure Active Directory permissions: Used to retrieve metadata from the identity assumed by Prowler and future AAD checks (not mandatory to have access to execute the tool)Subscription scope permissions: Required to launch the checks against your resources, mandatory to launch the tool.Azure Active Directory scopeAzure Active Directory (AAD) permissions required by the tool are the following:Directory.Read.AllPolicy.Read.AllSubscriptions scopeRegarding the subscription scope, Prowler by default scans all the subscriptions that is able to list, so it is required to add the following RBAC builtin roles per subscription  to the entity that is going to be assumed by the tool:Security ReaderReaderGoogle Cloud PlatformProwler will follow the same credentials search asGoogle authentication libraries:GOOGLE_APPLICATION_CREDENTIALS environment variableUser credentials set up by using the Google Cloud CLIThe attached service account, returned by the metadata serverThose credentials must be associated to a user or service account with proper permissions to do all checks. To make sure, add theViewerrole to the member associated with the credentials.By default,prowlerwill scan all accessible GCP Projects, use flag--project-idsto specify the projects to be scanned.💻 Basic UsageTo run prowler, you will need to specify the provider (e.g aws or azure):prowler <provider>Running theprowlercommand without options will use your environment variable credentials.By default, prowler will generate a CSV, a JSON and a HTML report, however you can generate JSON-ASFF (only for AWS Security Hub) report with-Mor--output-modes:prowler <provider> -M csv json json-asff htmlThe html report will be located in theoutputdirectory as the other files and it will look like:You can use-l/--list-checksor--list-servicesto list all available checks or services within the provider.prowler <provider> --list-checksprowler <provider> --list-servicesFor executing specific checks or services you can use options-c/--checksor-s/--services:prowler aws --checks s3_bucket_public_accessprowler aws --services s3 ec2Also, checks and services can be excluded with options-e/--excluded-checksor--excluded-services:prowler aws --excluded-checks s3_bucket_public_accessprowler aws --excluded-services s3 ec2You can always use-h/--helpto access to the usage information and all the possible options:prowler -hChecks ConfigurationsSeveral Prowler's checks have user configurable variables that can be modified in a commonconfiguration file.
This file can be found in the following path:prowler/config/config.yamlAWSUse a custom AWS profile with-p/--profileand/or AWS regions which you want to audit with-f/--filter-region:prowler aws --profile custom-profile -f us-east-1 eu-south-2By default,prowlerwill scan all AWS regions.AzureWith Azure you need to specify which auth method is going to be used:prowler azure [--sp-env-auth, --az-cli-auth, --browser-auth, --managed-identity-auth]By default,prowlerwill scan all Azure subscriptions.Google Cloud PlatformOptionally, you can provide the location of an application credential JSON file with the following argument:prowler gcp --credentials-file pathBy default,prowlerwill scan all accessible GCP Projects, use flag--project-idsto specify the projects to be scanned.📃 LicenseProwler is licensed as Apache License 2.0 as specified in each file. You may obtain a copy of the License athttp://www.apache.org/licenses/LICENSE-2.0