Secure Your Cloud with Prowler
Multi-Cloud Open-Source CSPM
What is Prowler?
Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more
- Security best practices assessments
- Audits
- Incident Response
- Continuous Monitoring
- Hardening & Forensics
- Remediation
Getting Started
Installation methods:
- Generic
- Docker
- Ubuntu
- GitHub
- Amazon Linux 2
- Brew
- AWS or Azure CloudShell
Examples:
› pip install prowler › brew install prowler› prowler -h
usage: prowler [-h] [--version] {aws,azure,gcp,kubernetes} ...
options:
-h, --help show this help message and exit
--version, -v show Prowler version
Available cloud providers:
{aws,azure,gcp,kubernetes}
aws AWS Provider
azure Azure Provider
gcp GCP Provider
kubernetes Kubernetes Provider
Available components:
dashboard Prowler local dashboard
To see the different available options on a specific component, run:
prowler {provider|dashboard} -h|--help
Detailed documentation at https://docs.prowler.comSet credentials:
Prowler uses your local CLI credentials if they are set:
› aws configure › export AWS_ACCESS_KEY_ID="AS..."
› export AWS_SECRET_ACCESS_KEY="..."
› export AWS_SESSION_TOKEN="..."Basic Usage
› prowler aws -h
options:
--check CHECK [CHECK ...], --checks CHECK [CHECK ...], -c CHECK [CHECK ...]
List of checks to be executed.
--checks-file [CHECKS_FILE], -C [CHECKS_FILE]
JSON file containing the checks to be executed. See config/checklist_example.json
--service SERVICE [SERVICE ...], --services SERVICE [SERVICE ...], -s SERVICE [SERVICE ...]
List of services to be executed.
--compliance {cisa_aws,soc2_aws,cis_1.4_aws,...}
--list-checks, -l List checks
...› prowler aws --list-checks
[awslambda_function_no_secrets_in_code] Find secrets in Lambda functions code. - lambda [critical]
[ec2_ebs_volume_snapshots_exists] Check if EBS snapshots exists. - ec2 [medium]
[kms_key_not_publicly_accessible] Check exposed KMS keys - kms [medium]
[iam_role_administratoraccess_policy] Ensure IAM Roles do not have AdministratorAccess policy attached - iam [high]
...
› prowler aws --list-categories
- - encryption
- - forensics-ready
- - internet-exposed
- - logging
- - secrets
- - threat-detection
- - trustboundaries
There are 7 available categories.
› prowler aws --categories encryption
Overview Results:
Account 992 Scan Results (severity columns are for fails only):
| Provider | Service | Status | Critical | High | Medium | Low | Muted |
|---|---|---|---|---|---|---|---|
| aws | cloudwatch | FAIL (1) | 0 | 0 | 1 | 0 | 0 |
| aws | ec2 | FAIL (5) | 0 | 0 | 5 | 0 | 0 |
› prowler aws --services s3 ec2
Executing 54 checks, please wait...
-> Scan completed! ▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮ 54/54 [100%] in 47.2s
Overview Results:
Account 992 Scan Results (severity columns are for fails only):
| Provider | Service | Status | Critical | High | Medium | Low | Muted |
|---|---|---|---|---|---|---|---|
| aws | ec2 | FAIL (36) | 0 | 18 | 15 | 3 | 0 |
Advanced Usage
Exclude certain checks from your scans:
› prowler aws --exclude-checks s3_bucket_public_access Scan based on resource tags:
› prowler aws --resource-tags Env=prod Project=cybrCustomizing the config file:
prowler/config/config.yaml Customize configurable checks, ie: # of days before an access key is considered unused; or max number of security group rules allowed, etc...
Integrations
- - Amazon S3
- - Security Hub
- - Slack
- - Shodan
- ...
Security Hub Example:
HIGH
MEDIUM
LOW
INFO
HIGH
MEDIUM
LOW
INFO
Use this cheat sheet with AI
Copy a ready-to-use prompt into your preferred AI assistant.