Think outside the black-box.

Check your Python version, install with pipx, and confirm you are on Prowler v5.

python3 --version # >=3.9, <=3.12
pipx install prowler
prowler -v

# already installed? make sure you are on the latest
pipx upgrade prowler

Prowler uses your AWS CLI credentials. Configure a profile or export the environment variables, then point Prowler at it. For read-only access, attach SecurityAudit and ViewOnlyAccess.

aws configure

# ...or export the keys directly
export AWS_ACCESS_KEY_ID="ASXXXXXXX"
export AWS_SECRET_ACCESS_KEY="XXXXXXXXX"
export AWS_SESSION_TOKEN="XXXXXXXXX"

prowler aws -p <profile_name>

# scan another account by assuming a role
prowler aws -R arn:aws:iam::<account_id>:role/<role_name>

Assign the Reader role on the subscription (Access control (IAM) → Add role assignment), then pick an auth method. Prowler scans every subscription it can list.

prowler azure --sp-env-auth            # service principal
prowler azure --az-cli-auth            # az cli credentials
prowler azure --browser-auth           # interactive browser
prowler azure --managed-identity-auth  # managed identity

Prowler uses your user account credentials by default and scans every project it is allowed to. You can also hand it a service account key file.

gcloud init                              # new account
gcloud config set account <account>      # existing account
gcloud auth application-default login

# or a downloaded service account key
prowler gcp --credentials-file <credentials_file_path>

Scan from outside the cluster (anywhere with access to the management port and admin permissions) or from inside it as a pod. Prowler uses the active context unless you name one.

prowler kubernetes
prowler kubernetes --context <context_name>

Authentication goes through the MsGraph SDK. Note that the PowerShell-backed checks require service principal and user credentials (--sp-env-auth).

prowler m365 --env-auth                 # enterprise application
prowler m365 --sp-env-auth              # service principal + user
prowler m365 --az-cli-auth
prowler m365 --browser-auth --tenant-id "XXXXXXXX"

Three ways in: a personal access token, an OAuth app token, or a GitHub App. Each one works as a flag or an environment variable.

prowler github --personal-access-token your_token_here

export GITHUB_PERSONAL_ACCESS_TOKEN="your_token_here"
prowler github

prowler github --oauth-app-token your_oauth_token
prowler github --github-app-id your_app_id \
  --github-app-key /path/to/private-key.pem

Shift left: scan Terraform, CloudFormation, Kubernetes manifests and more straight from a directory — no cloud credentials needed.

prowler iac --scan-path ./my-iac-directory
prowler iac --scan-path ./my-iac-directory --frameworks terraform kubernetes
prowler iac --scan-path ./my-iac-directory \
  --exclude-path ./my-iac-directory/test,./my-iac-directory/examples

Run every check for a provider (Ctrl+C stops it at any point), then narrow down to what hurts. Scope by region, project, subscription or context.

prowler aws
prowler aws --status FAIL --severity critical

# scope the scan
prowler aws -f us-east-1 us-east-2
prowler gcp --project-ids <project_id_1> <project_id_2>
prowler azure --subscription-ids <subscription_id_1>
prowler kubernetes --context <context_name>

# run only specific checks, or get help
prowler aws -c s3_bucket_object_versioning iam_user_hardware_mfa_enabled
prowler aws -h

A plain run writes CSV, OCSF JSON and HTML into output/. Open all three and compare what each is good for.

prowler aws
ls -ltra output

prowler-output-<account_id>-<timestamp>.csv
prowler-output-<account_id>-<timestamp>.ocsf.json
prowler-output-<account_id>-<timestamp>.html

The JSON output implements the OCSF v1.1.0 Detection Finding class — that is what makes it portable into SIEMs and data lakes.

Prowler ships a local dashboard that reads the CSVs you already generated — findings and compliance, no server to run.

prowler dashboard   # http://127.0.0.1:11666/

Checks carry metadata, so you can select groups of them dynamically instead of listing check IDs by hand.

prowler aws --services ec2
prowler aws --list-services

prowler azure --categories encryption
prowler azure --list-categories

prowler gcp --severity critical high

Every framework is a JSON definition in prowler/compliance/<provider>/ that maps requirements to checks — which is why you can read it, diff it, and write your own.

prowler aws --list-compliance
prowler aws --list-compliance-requirements cis_1.5_aws
prowler aws --compliance cis_1.5_aws

Send findings straight into Security Hub — optionally only the failures, and only for the services you care about.

prowler aws --security-hub
prowler aws --security-hub --status FAIL
prowler aws --security-hub --services ec2

Pull organization metadata (account names, tags, OUs) into your findings with -O, then loop over every active account assuming the same role.

prowler aws -O arn:aws:iam::<mgmt_account_id>:role/<role_name>

ACCOUNTS_IN_ORGS=$(aws organizations list-accounts \
  --query "Accounts[?Status=='ACTIVE'].Id" --output text)

for accountId in $ACCOUNTS_IN_ORGS; do
  prowler aws \
    -O arn:aws:iam::<mgmt_account_id>:role/<role_name> \
    -R arn:aws:iam::"${accountId}":role/<role_name>
done

Cross-check your public IPs against Shodan.io to see what the internet already knows about your estate.

prowler aws -N <shodan_api_key>

A YAML file that mutes findings per account, check, region, resource or tag — wildcards included. Muted findings stay in the output, flagged as muted.

Mutelist:
  Accounts:
    "123456789012":
      Checks:
        "iam_user_hardware_mfa_enabled":
          Regions: ["us-east-1"]
          Resources: ["user-1", "user-2"]
        "ec2_*":
          Regions: ["*"]
          Resources: ["*"]
        "*":
          Regions: ["*"]
          Resources: ["test"]
          Tags: ["test=test"]

prowler aws -w mutelist.yaml

By default Prowler skips checks for services you do not use. Turn them back on when you want the full picture — or to find the things nobody remembers enabling.

prowler aws --scan-unused-services

Write the output straight into a bucket, in whichever formats you need.

prowler aws -B my-bucket \
  --output-directory test-folder \
  --output-filename output-filename

prowler aws -M csv -B my-bucket

Some checks ship a fixer. Run it and Prowler applies the remediation for you — make sure the credentials you use carry the extra write permissions.

prowler aws -c <check_to_fix_1> <check_to_fix_2> --fixer

Threat-detection checks read CloudTrail for privilege escalation and enumeration patterns. And any run can post its summary to Slack.

prowler aws --category threat-detection
# cloudtrail_threat_detection_privilege_escalation
# cloudtrail_threat_detection_enumeration

prowler aws --slack

Clone the repo and install with Poetry. From here you are running Prowler from source.

git clone https://github.com/prowler-cloud/prowler
cd prowler
pip install poetry
poetry install
poetry shell

Prowler logs at CRITICAL by default. Turn it up while you are developing, and write the log to a file when you need to share it.

prowler aws --log-level DEBUG
prowler aws --log-level ERROR --log-file error-logs.json

A check is a folder named after the check, containing <check_id>.py and <check_id>.metadata.json. Services live beside them, each with a _client.py and a _service.py that gather the data.

• Lab 35 — AWS: EC2 security group with an open custom port.
• Lab 36 — GCP: compute instances have Confidential Computing enabled.
• Lab 37 — Azure: network access restricted on port 3333.
• Lab 38 — Kubernetes: apiserver client certificate configured.

# load checks from a folder or an S3 prefix, then run only yours
prowler aws -x ./my_custom_checks/ -c my_custom_check
prowler aws -x s3://bucket/prowler/custom_checks/ -c s3_bucket_policy

Drop a JSON definition into prowler/compliance/<provider>/ with your requirements and the checks each one maps to. Prowler generates the dedicated report from it like any built-in framework.

{
  "Framework": "<framework>",
  "Version": "<version>",
  "Provider": "AWS",
  "Description": "Compliance framework full description",
  "Requirements": [
    {
      "Id": "<unique-id>",
      "Name": "Requirement name",
      "Description": "Requirement full description",
      "Checks": ["guardduty_is_enabled", "securityhub_enabled"],
      "Attributes": [{ "Section": "Access Control (AC)", "Service": "aws" }]
    }
  ]
}

Add <check_id>_fixer.py next to the check and implement fixer(). Check which IAM permissions the remediation needs before you run it — the docs walk through a full example.

def fixer(region):
    try:
        regional_client = ec2_client.regional_clients[region]
        return regional_client.enable_ebs_encryption_by_default()[
            "EbsEncryptionByDefault"
        ]
    except Exception as error:
        logger.error(f"{region} -- {error}")
        return False

The self-hosted Prowler Local Dashboard — UI, API and workers — comes up with one compose file in dev mode.

git clone https://github.com/<your-github-user>/prowler
cd prowler
docker compose -f docker-compose-dev.yml up --build

Create an account with email and password, or Google / GitHub, using the DEFCON promo code. Nothing to install — no PostgreSQL, Celery or Valkey to operate, and scale, scheduled scans, SSO and RBAC come with it.

From Providers → Add Provider, pick AWS and choose Connect via Credentials. Paste the workshop Access Key ID and Secret Access Key — leave the session token empty.

• Same flow for Azure, GCP, Kubernetes, M365, GitHub and the rest — one onboarding, any cloud.
• In your own account, prefer Connect assuming an IAM Role: role ARN plus optional external ID, session name and duration.

Kick off a scan from the provider card and watch it progress. Results start landing before the scan finishes.

Start on the Overview and the ThreatScore, then browse the findings list and filter it. Finding Groups collapse thousands of individual results into the handful of underlying problems, so you fix a cause instead of a symptom. Drill into one to see the failed check, the resource, the evidence and the remediation.

Turn any filtered view of findings into an alert rule, and route it to the people who should hear about it.

Open Compliance to see your posture against dozens of frameworks — 44 for AWS alone — CIS, AWS FSBP, ISO 27001, PCI-DSS, GDPR, ENS, DORA and the Prowler ThreatScore. Drill from a score into requirements and into the checks behind them.

The Multiple Scans view aggregates a single score per framework across every provider type — AWS, Azure, GCP, Kubernetes, GitHub — which is what frameworks like CIS Controls, CSA CCM and DORA actually ask for.

Graph-based analysis of how an attacker chains misconfigurations and IAM relationships into privilege escalation. Stop reading findings one at a time and look at the path.

Tune what a scan checks, then set it and forget it: from Scans → Launch Scan choose On a schedule — daily, every 48 hours, weekly or monthly. The Scheduled tab shows next and last run per provider, and you can bulk-edit schedules from the Providers page.

Mute known-and-accepted findings in the UI. From Configuration → Integrations, push findings to Amazon S3, AWS Security Hub or Jira. And onboard a whole AWS Organization instead of one account at a time.

Browse the interactive docs and the schema: get a token, list providers, run a scan, filter findings.

Token-based auth, JSON:API content type. You get an access token and a refresh token back.

curl -X POST "https://api.prowler.com/api/v1/tokens" \
  -H "Content-Type: application/vnd.api+json" \
  -d '{"data":{"type":"tokens","attributes":{
        "email":"user@example.com","password":"your_password"}}}'

List your providers, grab the provider ID, and launch a manual scan against it. The response hands you a task to follow.

curl -X GET "https://api.prowler.com/api/v1/providers" \
  -H "Authorization: Bearer <your_access_token>"

curl -X POST "https://api.prowler.com/api/v1/scans" \
  -H "Authorization: Bearer <your_access_token>" \
  -H "Content-Type: application/vnd.api+json" \
  -d '{"data":{"type":"scans",
        "attributes":{"name":"Manual Security Scan"},
        "relationships":{"provider":{"data":{
          "id":"<provider_id>","type":"providers"}}}}}'

Filter by date, severity, region, service, provider or check ID — the same filters the UI uses.

curl -X GET "https://api.prowler.com/api/v1/findings\
?filter[inserted_at__gte]=2026-08-08&filter[severity]=critical" \
  -H "Authorization: Bearer <your_access_token>"

Open Lighthouse AI from the sidebar, or set it up under Configuration → Lighthouse AI. It is multi-LLM — pick your provider and model, and optionally add business context so prioritization reflects what actually matters to you.

• Ask it in plain language what is wrong, what to fix first, and how.
• Get remediation steps grounded in the open-source check logic, not a guess.
• Lab 48: what happens in the real world — take a finding from alert to fix.