Cloud
Prowler
Cloud security configuration scanner for AWS, Azure, and GCP against CIS and similar benchmarks.
What it is
Prowler runs hundreds of read-oriented checks on cloud accounts you have been given a role into. It is the default config pass on AWS landing-zone and org reviews. Results need human triage — CIS fails are not all findings, and HIPAA mapping lives in the report, not the scanner.
Reach for it when
Cloud assessments with a read-only (or documented) role in the target accounts, before any manual identity-path work.
Watch-outs
Confirm the role cannot write. Do not run against accounts outside the org unit in scope. Some checks enumerate S3 keys — skip buckets tagged as ePHI if the RoE forbids listing. Export reports to the engagement store, not Prowler Cloud, unless the client signed that.
Typical invocation
prowler aws --role arn:aws:iam::440012345678:role/pentest-readonly -M json html
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- ScoutSuite
Multi-cloud audit tool that collects configuration via APIs and highlights risky settings.
- Pacu
AWS exploitation framework for authorized identity and service abuse proofs after config review.
- Trivy
Scanner for container images, filesystems, IaC, and cloud misconfig in authorized build and landing-zone reviews.