Prowler: cloud security posture assessment in a pentest

Prowler · Apache-2.0

Prowler runs hundreds of security checks against a cloud account and reports pass/fail per check, mapped to compliance frameworks. It is authenticated assessment — it needs read access to the account — which makes it a configuration review rather than an external test.

Install

pipx install prowler
# or
docker run --rm -ti toniblyx/prowler:latest aws

Core commands

# whole AWS account
prowler aws

# a profile and region
prowler aws --profile client-audit --region us-east-1

# only failures, which is all you will report
prowler aws --status FAIL

# a specific framework
prowler aws --compliance cis_3.0_aws

# JSON output for import
prowler aws --output-formats json-ocsf --output-directory ./out

# other providers
prowler azure --subscription-ids <id>
prowler gcp --project-ids <id>

Read-only credentials are sufficient and are what you should ask for. SecurityAudit plus ViewOnlyAccess on AWS is the usual grant.

Output

OCSF JSON, one object per check result, with severity, resource ARN, remediation text and compliance mappings.

Where it sits in Tandera

Prowler runs in the static phase of recon_cloud — the authenticated cloud flow, which requires a connected cloud account seed. It runs alongside scoutsuite, which covers similar ground with a different check set and a different output shape.

This is distinct from recon_cloud_enum, the unauthenticated flow that uses s3scanner and needs no access at all.

Using it in a pentest

The raw output is not a report. A mid-size AWS account produces hundreds of failures, most of them low-severity defaults. Dumping them into a deliverable is how clients learn to ignore your reports. Triage to what is actually exploitable in this environment.

Public exposure first. Filter for the checks that mean something is reachable from the internet — public buckets, open security groups, unauthenticated endpoints, publicly shared snapshots. That subset is the report; the rest is an appendix.

Compliance mappings are the client’s language, not yours. --compliance cis_3.0_aws gives you framework references that make findings legible to auditors and get them prioritised internally.

Scope the credentials, and say what you had. Findings depend entirely on what the role could see. State the access level in the methodology, or the coverage claim is unverifiable.