Overview - Prowler Open Source Documentation (2024)

Prowler is an Open Source security tool to perform AWS, Azure, Google Cloud and Kubernetes security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness, and also remediations! We have Prowler CLI (Command Line Interface) that we call Prowler Open Source and a service on top of it that we call Prowler SaaS.

Prowler CLI¶

prowler <provider>

Prowler Dashboard¶

prowler dashboard

It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, AWS Well-Architected Framework Security Pillar, AWS Foundational Technical Review (FTR), ENS (Spanish National Security Scheme) and your custom security frameworks.

Quick Start¶

Installation¶

Prowler is available as a project in PyPI, thus can be installed using pip with Python >= 3.9:

pip install prowlerprowler -v

docker run -ti --rm -v /your/local/dir/prowler-output:/home/prowler/output \--name prowler \--env AWS_ACCESS_KEY_ID \--env AWS_SECRET_ACCESS_KEY \--env AWS_SESSION_TOKEN toniblyx/prowler:latest

pip3.9 install prowlerexport PATH=$PATH:/home/$HOME/.local/bin/prowler -v

git clone https://github.com/prowler-cloud/prowlercd prowlerpoetry shellpoetry installpython prowler.py -v

pip3.9 install prowlerexport PATH=$PATH:/home/$HOME/.local/bin/prowler -v

brew install prowlerprowler -v

sudo bashadduser prowlersu prowlerpip install prowlercd /tmpprowler aws

pip install prowlerprowler -v

Prowler container versions¶

The available versions of Prowler are the following:

• latest: in sync with master branch (bear in mind that it is not a stable version)
• v3-latest: in sync with v3 branch (bear in mind that it is not a stable version)
• <x.y.z> (release): you can find the releases here, those are stable releases.
• stable: this tag always point to the latest release.
• v3-stable: this tag always point to the latest release for v3.

The container images are available here:

• DockerHub
• AWS Public ECR

High level architecture¶

You can run Prowler from your workstation, a Kubernetes Job, a Google Compute Engine, an Azure VM, an EC2 instance, Fargate or any other container, CloudShell and many more.

Deprecations from v3¶

General¶

• Allowlist now is called Mutelist.
• The --quiet option has been deprecated, now use the --status flag to select the finding's status you want to get from PASS, FAIL or MANUAL.
• All INFO finding's status has changed to MANUAL.
• The CSV output format is common for all the providers.

We have deprecated some of our outputs formats:

• The native JSON is replaced for the JSON OCSF v1.1.0, common for all the providers.

AWS¶

• Deprecate the AWS flag --sts-endpoint-region since we use AWS STS regional tokens.
• To send only FAILS to AWS Security Hub, now use either --send-sh-only-fails or --security-hub --status FAIL.

Basic Usage¶

To run Prowler, you will need to specify the provider (e.g aws, gcp, azure or kubernetes):

prowler <provider>

If you miss the former output you can use --verbose but Prowler v4 is smoking fast, so you won't see much ;

By default, Prowler generates CSV, JSON-OCSF and HTML reports. However, you can generate a JSON-ASFF report (used by AWS Security Hub) with -M or --output-modes:

prowler <provider> -M csv json-asff json-ocsf html

You can use -l/--list-checks or --list-services to list all available checks or services within the provider.

prowler <provider> --list-checksprowler <provider> --list-services

For executing specific checks or services you can use options -c/checks or -s/services:

prowler azure --checks storage_blob_public_access_level_is_disabledprowler aws --services s3 ec2prowler gcp --services iam computeprowler kubernetes --services etcd apiserver

Also, checks and services can be excluded with options -e/--excluded-checks or --excluded-services:

prowler aws --excluded-checks s3_bucket_public_accessprowler azure --excluded-services defender iamprowler gcp --excluded-services kmsprowler kubernetes --excluded-services controllermanager

More options and executions methods that will save your time in Miscellaneous.

You can always use -h/--help to access to the usage information and all the possible options:

prowler --help

AWS¶

Use a custom AWS profile with -p/--profile and/or AWS regions which you want to audit with -f/--filter-region:

prowler aws --profile custom-profile -f us-east-1 eu-south-2

See more details about AWS Authentication in Requirements

Azure¶

With Azure you need to specify which auth method is going to be used:

# To use service principal authenticationprowler azure --sp-env-auth# To use az cli authenticationprowler azure --az-cli-auth# To use browser authenticationprowler azure --browser-auth --tenant-id "XXXXXXXX"# To use managed identity authprowler azure --managed-identity-auth

See more details about Azure Authentication in Requirements

Prowler by default scans all the subscriptions that is allowed to scan, if you want to scan a single subscription or various specific subscriptions you can use the following flag (using az cli auth as example):

prowler azure --az-cli-auth --subscription-ids <subscription ID 1> <subscription ID 2> ... <subscription ID N>

Google Cloud¶

Prowler will use by default your User Account credentials, you can configure it using:

• gcloud init to use a new account
• gcloud config set account <account> to use an existing account

Then, obtain your access credentials using: gcloud auth application-default login

Otherwise, you can generate and download Service Account keys in JSON format (refer to https://cloud.google.com/iam/docs/creating-managing-service-account-keys) and provide the location of the file with the following argument:

prowler gcp --credentials-file path

Prowler by default scans all the GCP Projects that is allowed to scan, if you want to scan a single project or various specific projects you can use the following flag:

prowler gcp --project-ids <Project ID 1> <Project ID 2> ... <Project ID N>

See more details about GCP Authentication in Requirements

Kubernetes¶

Prowler allows you to scan your Kubernetes Cluster either from within the cluster or from outside the cluster.

For non in-cluster execution, you can provide the location of the KubeConfig file with the following argument:

prowler kubernetes --kubeconfig-file path

For in-cluster execution, you can use the supplied yaml to run Prowler as a job within a new Prowler namespace:

kubectl apply -f kubernetes/job.yamlkubectl apply -f kubernetes/prowler-role.yamlkubectl apply -f kubernetes/prowler-rolebinding.yamlkubectl get pods --namespace prowler-ns --> prowler-XXXXXkubectl logs prowler-XXXXX --namespace prowler-ns

Prowler v2 Documentation¶

For Prowler v2 Documentation, please check it out here.