{"id":8450,"library":"prowler","title":"Prowler","description":"Prowler is an Open Source Cloud Security Platform that automates security and compliance across AWS, GCP, Azure, Kubernetes, Microsoft 365, GitHub, Infrastructure as Code, and MongoDB Atlas environments. It provides hundreds of ready-to-use security checks aligned with various compliance frameworks like CIS, NIST, PCI-DSS, SOC2, and AWS Well-Architected. Currently at version 5.24.0, Prowler has a regular release cadence, with minor versions released frequently, often weekly or bi-weekly, to introduce new features, checks, and bug fixes.","status":"active","version":"5.24.0","language":"en","source_language":"en","source_url":"https://github.com/prowler-cloud/prowler","tags":["cloud-security","aws","azure","gcp","kubernetes","compliance","audit","security-assessment","cli"],"install":[{"cmd":"pip install prowler","lang":"bash","label":"Install Prowler CLI"}],"dependencies":[],"imports":[{"note":"Prowler is primarily a command-line interface (CLI) tool. Direct Python imports for running scans are not typical for end-users; the common pattern is to invoke the `prowler` command via a shell or `subprocess`. The `Prowler SDK` exists for advanced extensibility, but its direct use for routine scanning is less common.","symbol":"Prowler CLI","correct":"import subprocess\nsubprocess.run([\"prowler\", \"aws\"])"}],"quickstart":{"code":"import subprocess\nimport os\n\n# Ensure AWS credentials are configured (e.g., via AWS CLI or environment variables)\n# Example: export AWS_ACCESS_KEY_ID='AKIA...'\n#          export AWS_SECRET_ACCESS_KEY='...'\n#          export AWS_SESSION_TOKEN='...'\n\nprint(\"Running a basic Prowler scan for AWS. This may take a while...\")\n\ntry:\n    # Run a basic AWS scan and output to the terminal\n    # For a full scan, remove --checks CHECK_AWS_EC2_01. For specific frameworks, use --compliance.\n    result = subprocess.run(\n        [\"prowler\", \"aws\", \"--checks\", \"CHECK_AWS_EC2_01\", \"--output-modes\", \"json\", \"text\"],\n        capture_output=True, text=True, check=True\n    )\n    print(\"Scan completed successfully.\")\n    print(\"--- Standard Output ---\")\n    print(result.stdout)\n    if result.stderr:\n        print(\"--- Standard Error ---\")\n        print(result.stderr)\nexcept subprocess.CalledProcessError as e:\n    print(f\"An error occurred during the Prowler scan: {e}\")\n    print(f\"Command: {e.cmd}\")\n    print(f\"Return Code: {e.returncode}\")\n    print(f\"Output: {e.stdout}\")\n    print(f\"Error Output: {e.stderr}\")\nexcept FileNotFoundError:\n    print(\"Error: 'prowler' command not found. Please ensure Prowler is installed and in your PATH.\")\n","lang":"python","description":"This quickstart demonstrates how to run a basic Prowler AWS scan using Python's `subprocess` module. Prowler automatically uses configured cloud credentials (e.g., from AWS CLI, environment variables, or IAM roles). The example runs a specific check for brevity, but you can configure full scans or compliance frameworks using various CLI flags. Output is captured for programmatic access."},"warnings":[{"fix":"Refer to the official documentation (docs.prowler.com) and GitHub README (github.com/prowler-cloud/prowler) to understand which features apply to the open-source CLI versus Prowler Cloud.","message":"Distinction between Prowler CLI (Open Source) and Prowler Cloud/App. Many new features and multi-account management capabilities highlighted in recent releases (e.g., AWS Organizations improvements, Google Workspace integration) are exclusive to the commercial Prowler Cloud/App offering, which provides a web UI and additional features. The CLI remains a powerful open-source tool, but it's important to understand this distinction when reviewing release notes.","severity":"gotcha","affected_versions":"All versions (since Prowler Cloud/App inception)"},{"fix":"After running a scan, use `prowler dashboard` to launch a local web UI for visualizing findings. Alternatively, process JSON or CSV output files programmatically or with other tools.","message":"Prowler v3 deprecated the direct HTML output page. Users accustomed to a quick HTML overview from older versions will find this functionality removed, requiring different methods (e.g., the local dashboard or parsing JSON/CSV outputs) to visualize results.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"For large environments, consider running Prowler from an EC2 instance, a Docker container with more allocated storage, or a local machine. If using CloudShell, narrow the scan scope (e.g., specific checks or services) and regularly clear old output files. Zip outputs for easier download.","message":"Limited disk space in AWS CloudShell (1GB) can hinder Prowler operations. Running extensive scans or generating large output files in CloudShell may lead to disk space exhaustion, preventing Prowler from completing or saving results.","severity":"gotcha","affected_versions":"All versions when run in AWS CloudShell"},{"fix":"Replace `poetry shell` with `poetry env activate` to activate the Poetry virtual environment for Prowler.","message":"Poetry's `poetry shell` command is deprecated in versions 2.0.0 and above. Users activating Prowler within a Poetry environment should use the updated command.","severity":"deprecated","affected_versions":"Poetry >=2.0.0"}],"env_vars":null,"last_verified":"2026-04-16T00:00:00.000Z","next_check":"2026-07-15T00:00:00.000Z","problems":[{"fix":"Install Prowler using `pip install prowler`. If already installed, ensure your PATH environment variable includes the directory where pip installs executables (e.g., `~/.local/bin` on Linux/macOS, or the Python `Scripts` directory on Windows).","cause":"Prowler is not installed, or its installation directory is not in your system's PATH.","error":"prowler: command not found"},{"fix":"Configure your AWS credentials using the AWS CLI (`aws configure`) or by setting environment variables (e.g., `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`). Ensure the principal running Prowler has sufficient permissions.","cause":"Prowler could not find valid AWS credentials in the expected locations (environment variables, `~/.aws/credentials`, IAM roles).","error":"No credentials found for AWS. Configure your credentials to run Prowler. See https://docs.prowler.com/en/latest/references/authentication/ for more info."},{"fix":"Prowler is meant to be run as a command-line tool. To execute it from Python, use `subprocess.run(['prowler', ...])` to invoke the CLI. If you are developing custom checks or extending Prowler, refer to the Prowler documentation for its SDK and internal module structure.","cause":"Attempting to import `prowler` as a Python module directly, but it's designed primarily as a CLI tool and its core scanning logic is not exposed for general library imports in this manner.","error":"ModuleNotFoundError: No module named 'prowler'"}]}