# Prowler: cloud security posture assessment in a pentest

> How to install and run Prowler against AWS, Azure and GCP, and how Tandera turns hundreds of check results into a reportable set.

`Prowler` runs hundreds of security checks against a cloud account and reports pass/fail per check, mapped to compliance frameworks. It is authenticated assessment — it needs read access to the account — which makes it a configuration review rather than an external test.

## Install

```bash
pipx install prowler
# or
docker run --rm -ti toniblyx/prowler:latest aws
```

## Core commands

```bash
# whole AWS account
prowler aws

# a profile and region
prowler aws --profile client-audit --region us-east-1

# only failures, which is all you will report
prowler aws --status FAIL

# a specific framework
prowler aws --compliance cis_3.0_aws

# JSON output for import
prowler aws --output-formats json-ocsf --output-directory ./out

# other providers
prowler azure --subscription-ids <id>
prowler gcp --project-ids <id>
```

Read-only credentials are sufficient and are what you should ask for. `SecurityAudit` plus `ViewOnlyAccess` on AWS is the usual grant.

## Output

OCSF JSON, one object per check result, with severity, resource ARN, remediation text and compliance mappings.

## Where it sits in Tandera

Prowler runs in the **static** phase of `recon_cloud` — the authenticated cloud flow, which requires a connected cloud account seed. It runs alongside `scoutsuite`, which covers similar ground with a different check set and a different output shape.

This is distinct from `recon_cloud_enum`, the unauthenticated flow that uses `s3scanner` and needs no access at all.

## Using it in a pentest

**The raw output is not a report.** A mid-size AWS account produces hundreds of failures, most of them low-severity defaults. Dumping them into a deliverable is how clients learn to ignore your reports. Triage to what is actually exploitable in this environment.

**Public exposure first.** Filter for the checks that mean something is reachable from the internet — public buckets, open security groups, unauthenticated endpoints, publicly shared snapshots. That subset is the report; the rest is an appendix.

**Compliance mappings are the client's language, not yours.** `--compliance cis_3.0_aws` gives you framework references that make findings legible to auditors and get them prioritised internally.

**Scope the credentials, and say what you had.** Findings depend entirely on what the role could see. State the access level in the methodology, or the coverage claim is unverifiable.

---

Canonical: https://tandera.io/tools/prowler
This page as markdown: https://tandera.io/tools/prowler.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.