Continuous AWS Security Assessments with Prowler and Security Hub

Cybr · Author

Victoria Shutenko ↗TechMagic · Guest co-author

Scenario

Your assignment: You’ve been tasked with regularly scanning your organization’s AWS accounts to make sure they are following security best practices, prepared for thorough audits, and that they have continuous monitoring. Your organization wants you to use AWS-native solutions whenever possible, but you can also use open source software if it will provide additional benefits.

Your solution: Enabling Prowler to run serverless on a regular basis through CodeBuild, then storing results in S3 and pushing findings to Security Hub.

Solution Diagram

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

Use this Cybr cheat sheet as reference: Continuous AWS Security Assessments with Prowler and Security Hub
Source: https://cybr.com/cheat-sheets/prowler-security-hub/

My goal: Help me implement this

Help me implement scheduled Prowler assessments with CodeBuild, S3, Security Hub, and EventBridge Scheduler. Ask about my account structure, regions, deployment tool, and scan schedule first. Then provide the architecture, least-privilege IAM permissions, configuration and code, and verification steps. Complete the illustrative buildspec, including report uploads and findings integration; explain how scan failures and findings affect the build result.

Use the included reference material even if you cannot open the source URL. Ask for missing context rather than inventing my environment. Explain assumptions. For version-sensitive service behavior or commands, consult current official documentation when available, cite it, and explain any differences from this reference. If you cannot verify something, say so.

Reference material from the cheat sheet (structured text or a curated summary):

Assignment: You’ve been tasked with regularly scanning your organization’s AWS accounts to make sure they are following security best practices, prepared for thorough audits, and that they have continuous monitoring. Your organization wants you to use AWS-native solutions whenever possible, but you can also use open source software if it will provide additional benefits.

Solution: Enabling Prowler to run serverless on a regular basis through CodeBuild, then storing results in S3 and pushing findings to Security Hub.

1. Enable Prowler integration in Security Hub to accept findings
2. Configure Prowler to run in CodeBuild
3. Prowler executes
4. Prowler stores results in S3
5. Prowler sends findings to Security Hub
6. View the findings and address them in the Security Hub dashboard
7. Repeat on a regular schedule

Prowler branches to S3 for reports and Security Hub for findings. EventBridge Scheduler triggers CodeBuild repeatedly. QuickSight visualizations are optional. Findings have Critical, High, Medium, Low, or Info severity.

Illustrative buildspec.yml (incomplete; the upload phase only prints a message):

```yaml
version: 0.2
phases:
  install:
    runtime-versions:
      python: 3.11
    commands:
      - echo "Installing Prowler and dependencies..."
      - pip3 install prowler
      - prowler -v
  build:
    commands:
      - echo "Running a single account scan."
      - echo "Running Prowler as prowler $PROWLER_OPTIONS --role arn:$AWS_PARTITION:iam::$AWS_ACCOUNT_ID:role/service-role/$PROWLER_ROLE"
      - prowler $PROWLER_OPTIONS || true
  post_build:
    commands:
      - echo "Uploading reports to S3..."
```

More cheat sheets