---
title: "Secure Your Cloud with Prowler Cheat Sheet | Cybr"
description: "Multi-Cloud Open-Source CSPM"
url: https://cybr.com/cheat-sheets/prowler/
---

# Secure Your Cloud with Prowler

Multi-Cloud Open-Source CSPM

![Prowler](https://cybr.com/prowler-cheat-sheet/prowler-logo.png)

[cybr.com](https://cybr.com/) [Christophe Limpalair](https://www.linkedin.com/in/christophelimpalair/)

[prowler.com](https://prowler.com/) [Toni de la Fuente](https://www.linkedin.com/in/toniblyx/)

## What is Prowler?

Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more

**Available providers:** ![AWS, Azure, GCP and Kubernetes](https://cybr.com/prowler-cheat-sheet/provider-strip.png)

**Main use cases:**

- Security best practices assessments
- Audits
- Incident Response
- Continuous Monitoring
- Hardening & Forensics
- Remediation

## Getting Started

Installation methods:

- Generic
- Docker
- Ubuntu
- GitHub
- Amazon Linux 2
- Brew
- AWS or Azure CloudShell

Examples:

`› pip install prowler` `› brew install prowler`

› prowler -h

```
usage: prowler [-h] [--version] {aws,azure,gcp,kubernetes} ...
options:
  -h, --help     show this help message and exit
  --version, -v  show Prowler version
Available cloud providers:
  {aws,azure,gcp,kubernetes}
  aws            AWS Provider
  azure          Azure Provider
  gcp            GCP Provider
  kubernetes     Kubernetes Provider
Available components:
  dashboard      Prowler local dashboard
To see the different available options on a specific component, run:
  prowler {provider|dashboard} -h|--help
Detailed documentation at https://docs.prowler.com
```

Set credentials:

Prowler uses your local CLI credentials if they are set:

`› aws configure` `› export AWS_ACCESS_KEY_ID="AS..."   › export AWS_SECRET_ACCESS_KEY="..."   › export AWS_SESSION_TOKEN="..."`

Recommended
permissions (to start):

`arn:aws:iam::aws:policy/SecurityAudit` `arn:aws:iam::aws:policy/job-function/ViewOnlyAccess`

## Basic Usage

› prowler aws -h

```
options:
  --check CHECK [CHECK ...], --checks CHECK [CHECK ...], -c CHECK [CHECK ...]
  List of checks to be executed.
  --checks-file [CHECKS_FILE], -C [CHECKS_FILE]
  JSON file containing the checks to be executed. See config/checklist_example.json
  --service SERVICE [SERVICE ...], --services SERVICE [SERVICE ...], -s SERVICE [SERVICE ...]
  List of services to be executed.
  --compliance {cisa_aws,soc2_aws,cis_1.4_aws,...}
  --list-checks, -l  List checks
  ...
```

› prowler aws --list-checks

\[awslambda\_function\_no\_secrets\_in\_code\] Find secrets in Lambda functions code. - **lambda** \[critical\]

\[ec2\_ebs\_volume\_snapshots\_exists\] Check if EBS snapshots exists. - **ec2** \[medium\]

\[kms\_key\_not\_publicly\_accessible\] Check exposed KMS keys - **kms** \[medium\]

\[iam\_role\_administratoraccess\_policy\] Ensure IAM Roles do not have AdministratorAccess policy attached - **iam** \[high\]

...

› prowler aws --list-categories

- \- encryption
- \- forensics-ready
- \- internet-exposed
- \- logging
- \- secrets
- \- threat-detection
- \- trustboundaries

There are 7 available categories.

› prowler aws --categories encryption

Overview Results:

**100.0% (6) Failed****0.0% (0) Passed****0.0% (0) Muted**

Account 992 Scan Results (severity columns are for fails only):

| Provider | Service | Status | Critical | High | Medium | Low | Muted |
| --- | --- | --- | --- | --- | --- | --- | --- |
| aws | cloudwatch | FAIL (1) | 0 | 0 | 1 | 0 | 0 |
| aws | ec2 | FAIL (5) | 0 | 0 | 5 | 0 | 0 |

Scan specific services only:

› prowler aws --services s3 ec2

**Executing 54 checks, please wait...**
\-> Scan completed! ▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮▮ 54/54 \[100%\] in 47.2s

Overview Results:

**34.95% (36) Failed****65.05% (67) Passed****0.0% (0) Muted**

Account 992 Scan Results (severity columns are for fails only):

| Provider | Service | Status | Critical | High | Medium | Low | Muted |
| --- | --- | --- | --- | --- | --- | --- | --- |
| aws | ec2 | FAIL (36) | 0 | 18 | 15 | 3 | 0 |

## Advanced Usage

Exclude certain checks from your scans:

`› prowler aws --exclude-checks s3_bucket_public_access`

Scan based on resource tags:

`› prowler aws --resource-tags Env=prod Project=cybr`

Customizing the config file:

`prowler/config/config.yaml`

Customize configurable checks, ie: # of days before an access key is considered unused; or max number of security group rules allowed, etc...

## Integrations

- \- Amazon S3
- \- Security Hub
- \- Slack
- \- Shodan
- ...

![Prowler](https://cybr.com/prowler-cheat-sheet/prowler-logo.png)

Security Hub Example:

aws Account 111

CRITICAL
HIGH
MEDIUM
LOW
INFO

RoleSecurity Hub

aws Account 222

CRITICAL
HIGH
MEDIUM
LOW
INFO

RoleSecurity Hub

## Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

More info: [**More about Prowler**
https://github.com/prowler-cloud/prowler/](https://github.com/prowler-cloud/prowler/) [**Prowler documentation**
https://docs.prowler.com/projects/prowler-open-source/en/latest/](https://docs.prowler.com/projects/prowler-open-source/en/latest/)

[**More AWS security cheat sheets:**
https://cybr.com/aws-cheat-sheets](https://cybr.com/tag/aws-security-cheat-sheets/) [**AWS security training:**
https://cybr.com/](https://cybr.com/)

[More cheat sheets](https://cybr.com/cheat-sheets/)