{ "markdown": "

\n \"Prowler\n \"Prowler\n

\n

\n Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security simple, scalable, and cost-effective for organizations of any size.\n

\n

\nThe Agentic Cloud Defender\n

\n

\nTry Prowler Cloud\n

\n\n

\n\"Prowler\n
\n Join our Prowler community!\n

\n
\n

\n \"Slack\n \"Python\n \"Python\n \"PyPI\n \"Docker\n \"AWS\n \"Codecov\n \"Linux\n

\n

\n \"Version\"\n \"Version\"\n \"Contributors\"\n \"Issues\"\n \"License\"\n \"Twitter\"\n \"Twitter\"\n

\n
\n

\n \"Prowler\n

\n\n# Description\n\n**Prowler** is the worldโ€™s most widely used _Open-Source Cloud Security Platform_ that automates security and compliance across **any cloud environment**. With thousands of ready-to-use security checks, remediation guidance, and compliance frameworks, Prowler is built to _โ€œSecure ANY Cloud at AI Speedโ€_. Prowler delivers **AI-driven**, **customizable**, and **easy-to-use** assessments, dashboards, reports, and integrations, making cloud security **simple**, **scalable**, and **cost-effective** for organizations of any size.\n\nProwler includes hundreds of built-in controls to ensure compliance with standards and frameworks, including:\n\n- **Prowler ThreatScore:** Weighted risk prioritization scoring that helps you focus on the most critical security findings first\n- **Industry Standards:** CIS, NIST 800, NIST CSF, CISA, and MITRE ATT&CK\n- **Regulatory Compliance and Governance:** RBI, FedRAMP, PCI-DSS, and NIS2\n- **Frameworks for Sensitive Data and Privacy:** GDPR, HIPAA, and FFIEC\n- **Frameworks for Organizational Governance and Quality Control:** SOC2, GXP, and ISO 27001\n- **Cloud-Specific Frameworks:** AWS Foundational Technical Review (FTR), AWS Well-Architected Framework, and BSI C5\n- **National Security Standards:** ENS (Spanish National Security Scheme) and KISA ISMS-P (Korean)\n- **Custom Security Frameworks:** Tailored to your needs\n\n## Prowler Cloud & Prowler Local Server\n\n[Prowler Cloud](https://cloud.prowler.com/sign-up) and Prowler Local Server, its self-hosted open-source version, are web applications that simplify running Prowler across your cloud provider accounts. They provide a user-friendly interface to visualize the results and streamline your security assessments.\n\n![Prowler Cloud](docs/images/products/overview.png)\n![Risk Pipeline](docs/images/products/risk-pipeline.png)\n![Threat Map](docs/images/products/threat-map.png)\n\n\n>For more details, refer to the [Prowler Local Server documentation](https://docs.prowler.com/getting-started/installation/prowler-app)\n\n## Prowler CLI\n\n```console\nprowler \n```\n![Prowler CLI Execution](docs/img/short-display.png)\n\n\n## Prowler Local Dashboard\n\n```console\nprowler dashboard\n```\n![Prowler Local Dashboard](docs/images/products/dashboard.png)\n\n\n## Attack Paths\n\nAttack Paths automatically extends every completed AWS scan with a graph that combines Cartography's cloud inventory with Prowler findings. The feature runs in the API worker after each scan.\n\nTwo graph backends are supported as the long-lived sink:\n\n- **Neo4j** (default; the Docker Compose files already ship a `neo4j` service).\n- **Amazon Neptune** (cloud-managed; opt-in).\n\nSelect the sink with `ATTACK_PATHS_SINK_DATABASE` (`neo4j` or `neptune`; default `neo4j`).\n\n> Note: Cartography ingestion always uses a temporary Neo4j database, regardless of the configured sink. The `NEO4J_*` variables below must remain set even when `ATTACK_PATHS_SINK_DATABASE=neptune`.\n\n### Neo4j sink\n\n| Variable | Description | Default |\n| --- | --- | --- |\n| `NEO4J_HOST` | Hostname used by the API containers. | `neo4j` |\n| `NEO4J_PORT` | Bolt port exposed by Neo4j. | `7687` |\n| `NEO4J_USER` / `NEO4J_PASSWORD` | Credentials with rights to create per-tenant databases. | `neo4j` / `neo4j_password` |\n\n### Neptune sink\n\n| Variable | Description | Default |\n| --- | --- | --- |\n| `NEPTUNE_WRITER_ENDPOINT` | Bolt host for the Neptune writer instance. Required when sink is `neptune`. | _empty_ |\n| `NEPTUNE_READER_ENDPOINT` | Optional reader endpoint for read-only queries. Falls back to the writer when unset. | _empty_ |\n| `NEPTUNE_PORT` | Bolt port exposed by Neptune. | `8182` |\n| `AWS_REGION` | Region the Neptune cluster lives in. Required when sink is `neptune`. | _empty_ |\n\nNeptune authenticates with SigV4 using the standard boto3 credential chain. The worker's IAM role (or `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`) supplies the credentials. There is no Neptune password variable.\n\nEvery AWS provider scan will enqueue an Attack Paths ingestion job automatically. Other cloud providers will be added in future iterations.\n\n\n# Prowler at a Glance\n> [!Tip]\n> For the most accurate and up-to-date information about checks, services, frameworks, and categories, visit [**Prowler Hub**](https://hub.prowler.com).\n\n\n| Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/user-guide/compliance/tutorials/compliance) | [Categories](https://docs.prowler.com/user-guide/cli/tutorials/misc#categories) | Support | Interface |\n|---|---|---|---|---|---|---|\n| AWS | 639 | 86 | 47 | 19 | Official | UI, API, CLI |\n| Azure | 191 | 22 | 21 | 16 | Official | UI, API, CLI |\n| GCP | 109 | 20 | 19 | 12 | Official | UI, API, CLI |\n| Kubernetes | 92 | 7 | 8 | 11 | Official | UI, API, CLI |\n| GitHub | 24 | 3 | 2 | 5 | Official | UI, API, CLI |\n| M365 | 143 | 10 | 6 | 10 | Official | UI, API, CLI |\n| OCI | 52 | 14 | 5 | 10 | Official | UI, API, CLI |\n| Alibaba Cloud | 63 | 9 | 6 | 9 | Official | UI, API, CLI |\n| Cloudflare | 29 | 3 | 2 | 5 | Official | UI, API, CLI |\n| IaC | [See `trivy` docs.](https://trivy.dev/latest/docs/coverage/iac/) | N/A | N/A | N/A | Official | UI, API, CLI |\n| MongoDB Atlas | 10 | 3 | 1 | 8 | Official | UI, API, CLI |\n| LLM | [See `promptfoo` docs.](https://www.promptfoo.dev/docs/red-team/plugins/) | N/A | N/A | N/A | Official | CLI |\n| Image | N/A | N/A | N/A | N/A | Official | UI, API, CLI |\n| Google Workspace | 65 | 11 | 4 | 6 | Official | UI, API, CLI |\n| OpenStack | 34 | 5 | 1 | 9 | Official | UI, API, CLI |\n| Vercel | 26 | 6 | 1 | 8 | Official | UI, API, CLI |\n| Okta | 29 | 8 | 2 | 2 | Official | UI, API, CLI |\n| Linode [Contact us](https://prowler.com/contact) | 10 | 3 | 1 | 4 | Unofficial | CLI |\n| Huawei Cloud [Contact us](https://prowler.com/contact) | 25 | 10 | 1 | 6 | Unofficial | CLI |\n| E2E Networks [Contact us](https://prowler.com/contact) | 27 | 6 | 0 | 2 | Unofficial | CLI |\n| Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 1 | 1 | Unofficial | CLI |\n| StackIT [Contact us](https://prowler.com/contact) | 8 | 2 | 1 | 3 | Unofficial | CLI |\n| NHN | 6 | 2 | 2 | 0 | Unofficial | CLI |\n\n> [!Note]\n> The numbers in the table are updated periodically.\n\n\n\n> [!Note]\n> Use the following commands to list Prowler's available checks, services, compliance frameworks, and categories:\n> - `prowler --list-checks`\n> - `prowler --list-services`\n> - `prowler --list-compliance`\n> - `prowler --list-categories`\n\n# ๐Ÿ’ป Installation\n\n## Prowler Local Server\n\nProwler Local Server offers flexible installation methods tailored to various environments:\n\n> For detailed instructions on using Prowler Local Server, refer to the [usage guide](https://docs.prowler.com/user-guide/tutorials/prowler-app).\n\n### Docker Compose\n\n#### Requirements\n\n- `Docker Compose` installed: https://docs.docker.com/compose/install/.\n\n#### Commands\n\n_macOS/Linux:_\n\n``` console\nVERSION=$(curl -s https://api.github.com/repos/prowler-cloud/prowler/releases/latest | jq -r .tag_name)\ncurl -sLO \"https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/${VERSION}/docker-compose.yml\"\n# Environment variables can be customized in the .env file. Using default values in production environments is not recommended.\ncurl -sLO \"https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/${VERSION}/.env\"\ndocker compose up -d\n```\n\n_Windows PowerShell:_\n\n``` powershell\n$VERSION = (Invoke-RestMethod -Uri \"https://api.github.com/repos/prowler-cloud/prowler/releases/latest\").tag_name\nInvoke-WebRequest -Uri \"https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/docker-compose.yml\" -OutFile \"docker-compose.yml\"\n# Environment variables can be customized in the .env file. Using default values in production environments is not recommended.\nInvoke-WebRequest -Uri \"https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/.env\" -OutFile \".env\"\ndocker compose up -d\n```\n\n> [!WARNING]\n> ๐Ÿ”’ For a secure setup, the API auto-generates a unique key pair, `DJANGO_TOKEN_SIGNING_KEY` and `DJANGO_TOKEN_VERIFYING_KEY`, and stores it in `~/.config/prowler-api` (non-container) or the bound Docker volume in `_data/api` (container). Never commit or reuse static/default keys. To rotate keys, delete the stored key files and restart the API.\n\nOnce configured, access Prowler Local Server at http://localhost:3000. Sign up using your email and password to get started.\n\n### Common Issues with Docker Pull Installation\n\n> [!Note]\n If you want to use AWS role assumption (e.g., with the \"Connect assuming IAM Role\" option), you may need to mount your local `.aws` directory into the container as a volume (e.g., `- \"${HOME}/.aws:/home/prowler/.aws:ro\"`). There are several ways to configure credentials for Docker containers. See the [Troubleshooting](./docs/troubleshooting.mdx) section for more details and examples.\n\nYou can find more information in the [Troubleshooting](./docs/troubleshooting.mdx) section.\n\n\n### From GitHub\n\n#### Requirements\n\n- `git` installed.\n- `uv` installed: [uv installation](https://docs.astral.sh/uv/getting-started/installation/).\n- `pnpm` installed: [pnpm installation](https://pnpm.io/installation).\n- `Docker Compose` installed: https://docs.docker.com/compose/install/.\n\n#### Commands to run the API\n\n``` console\ngit clone https://github.com/prowler-cloud/prowler\ncd prowler/api\nuv sync\nsource .venv/bin/activate\nset -a\nsource .env\ndocker compose up postgres valkey -d\ncd src/backend\npython manage.py migrate --database admin\ngunicorn -c config/guniconf.py config.wsgi:application\n```\n\n> After completing the setup, access the API documentation at http://localhost:8080/api/v1/docs.\n\n#### Commands to run the API Worker\n\n``` console\ngit clone https://github.com/prowler-cloud/prowler\ncd prowler/api\nuv sync\nsource .venv/bin/activate\nset -a\nsource .env\ncd src/backend\npython -m celery -A config.celery worker -l info -E\n```\n\n#### Commands to run the API Scheduler\n\n``` console\ngit clone https://github.com/prowler-cloud/prowler\ncd prowler/api\nuv sync\nsource .venv/bin/activate\nset -a\nsource .env\ncd src/backend\npython -m celery -A config.celery beat -l info --scheduler django_celery_beat.schedulers:DatabaseScheduler\n```\n\n#### Commands to run the UI\n\n``` console\ngit clone https://github.com/prowler-cloud/prowler\ncd prowler/ui\npnpm install\npnpm run build\npnpm start\n```\n\n> Once configured, access Prowler Local Server at http://localhost:3000. Sign up using your email and password to get started.\n\n#### Pre-commit Hooks Setup\n\nSome pre-commit hooks require tools installed on your system:\n\n1. **Install [TruffleHog](https://github.com/trufflesecurity/trufflehog#install)** (secret scanning) โ€” see the [official installation options](https://github.com/trufflesecurity/trufflehog#install).\n\n2. **Install [Hadolint](https://github.com/hadolint/hadolint#install)** (Dockerfile linting) โ€” see the [official installation options](https://github.com/hadolint/hadolint#install).\n\n## Prowler CLI\n### Pip package\nProwler CLI is available as a project in [PyPI](https://pypi.org/project/prowler-cloud/). Consequently, it can be installed using pip with Python >=3.10, <3.13:\n\n```console\npip install prowler\nprowler -v\n```\n>For further guidance, refer to [https://docs.prowler.com](https://docs.prowler.com/getting-started/installation/prowler-cli)\n\n### Containers\n\n#### Available Versions of Prowler CLI\n\nThe following versions of Prowler CLI are available, depending on your requirements:\n\n- `latest`: Synchronizes with the `master` branch. Note that this version is not stable.\n- `v4-latest`: Synchronizes with the `v4` branch. Note that this version is not stable.\n- `v3-latest`: Synchronizes with the `v3` branch. Note that this version is not stable.\n- `` (release): Stable releases corresponding to specific versions. See the [complete list of Prowler releases](https://github.com/prowler-cloud/prowler/releases).\n- `stable`: Always points to the latest release.\n- `v4-stable`: Always points to the latest release for v4.\n- `v3-stable`: Always points to the latest release for v3.\n\nThe container images are available here:\n- Prowler CLI:\n - [DockerHub](https://hub.docker.com/r/prowlercloud/prowler/tags)\n - [AWS Public ECR](https://gallery.ecr.aws/prowler-cloud/prowler)\n- Prowler Local Server:\n - [DockerHub - Prowler UI](https://hub.docker.com/r/prowlercloud/prowler-ui/tags)\n - [DockerHub - Prowler API](https://hub.docker.com/r/prowlercloud/prowler-api/tags)\n\n### From GitHub\n\nPython >=3.10, <3.13 is required with [uv](https://docs.astral.sh/uv/):\n\n``` console\ngit clone https://github.com/prowler-cloud/prowler\ncd prowler\nuv sync\nsource .venv/bin/activate\npython prowler-cli.py -v\n```\n> [!IMPORTANT]\n> To clone Prowler on Windows, configure Git to support long file paths by running the following command: `git config core.longpaths true`.\n\n# ๐Ÿ›ก๏ธ GitHub Action\n\nThe official **Prowler GitHub Action** runs Prowler scans in your GitHub workflows using the official [`prowlercloud/prowler`](https://hub.docker.com/r/prowlercloud/prowler) Docker image. Scans run on any [supported provider](https://docs.prowler.com/user-guide/providers/), with optional [`--push-to-cloud`](https://docs.prowler.com/user-guide/tutorials/prowler-import-findings) to send findings to Prowler Cloud and optional SARIF upload so findings show up in the repo's **Security โ†’ Code scanning** tab and as inline PR annotations.\n\n```yaml\nname: Prowler IaC Scan\non:\n pull_request:\n\npermissions:\n contents: read\n security-events: write\n actions: read\n\njobs:\n prowler:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v4\n\n - uses: prowler-cloud/prowler@5.25\n with:\n provider: iac\n output-formats: sarif json-ocsf\n upload-sarif: true\n flags: --severity critical high\n```\n\nFull configuration, per-provider authentication, and SARIF examples: [Prowler GitHub Action tutorial](docs/user-guide/tutorials/prowler-app-github-action.mdx). Marketplace listing: [Prowler Security Scan](https://github.com/marketplace/actions/prowler-security-scan).\n\n# โœ๏ธ High level architecture\n\n## Prowler Local Server\n**Prowler Local Server** is composed of four key components:\n\n- **Prowler UI**: A web-based interface, built with Next.js, providing a user-friendly experience for executing Prowler scans and visualizing results.\n- **Prowler API**: A backend service, developed with Django REST Framework, responsible for running Prowler scans and storing the generated results.\n- **Prowler SDK**: A Python SDK designed to extend the functionality of the Prowler CLI for advanced capabilities.\n- **Prowler MCP Server**: A Model Context Protocol server that provides AI tools for Lighthouse, the AI-powered security assistant. This is a critical dependency for Lighthouse functionality.\n\n```mermaid\nflowchart TB\n user([User / Security Team])\n cli([Prowler CLI])\n\n subgraph APP[\"Prowler Local Server\"]\n ui[\"Prowler UI
(Next.js)\"]\n api[\"Prowler API
(Django REST Framework)\"]\n worker[\"API Worker
(Celery)\"]\n beat[\"API Scheduler
(Celery Beat)\"]\n mcp[\"Prowler MCP Server
(Lighthouse AI tools)\"]\n end\n\n sdk[\"Prowler SDK
(Python)\"]\n\n subgraph DATA[\"Data Layer\"]\n pg[(\"PostgreSQL\")]\n valkey[(\"Valkey / Redis\")]\n neo4j[(\"Neo4j\")]\n end\n\n providers[\"Providers\"]\n\n user --> ui\n user --> cli\n ui -->|REST| api\n ui -->|MCP HTTP| mcp\n mcp -->|REST| api\n api --> pg\n api --> valkey\n beat -->|enqueue jobs| valkey\n valkey -->|dispatch| worker\n worker --> pg\n worker -->|Attack Paths| neo4j\n worker -->|invokes| sdk\n cli --> sdk\n\n sdk --> providers\n```\n\n\n\n\n## Prowler CLI\n\n### Running Prowler\n\nProwler can be executed across various environments, offering flexibility to meet your needs. It can be run from:\n\n- Your own workstation\n\n- A Kubernetes Job\n\n- Google Compute Engine\n\n- Azure Virtual Machines (VMs)\n\n- Amazon EC2 instances\n\n- AWS Fargate or other container platforms\n\n- CloudShell\n\nAnd many more environments.\n\n![Architecture](docs/img/architecture.png)\n\n# ๐Ÿค– AI Skills for Development\n\nProwler includes a comprehensive set of **AI Skills** that help AI coding assistants understand Prowler's codebase patterns and conventions.\n\n## What are AI Skills?\n\nSkills are structured instructions that give AI assistants the context they need to write code that follows Prowler's standards. They include:\n\n- **Coding patterns** for each component (SDK, API, UI, MCP Server)\n- **Testing conventions** (pytest, Playwright)\n- **Architecture guidelines** (Clean Architecture, RLS patterns)\n- **Framework-specific rules** (React 19, Next.js 15, Django DRF, Tailwind 4)\n\n## Available Skills\n\n| Category | Skills |\n|----------|--------|\n| **Generic** | `typescript`, `react-19`, `nextjs-15`, `tailwind-4`, `playwright`, `pytest`, `django-drf`, `zod-4`, `zustand-5`, `ai-sdk-5` |\n| **Prowler** | `prowler`, `prowler-api`, `prowler-ui`, `prowler-mcp`, `prowler-sdk-check`, `prowler-test-ui`, `prowler-test-api`, `prowler-test-sdk`, `prowler-compliance`, `prowler-provider`, `prowler-pr`, `prowler-docs` |\n\n## Setup\n\n```bash\n./skills/setup.sh\n```\n\nThis configures skills for AI coding assistants that follow the [agentskills.io](https://agentskills.io) standard:\n\n| Tool | Configuration |\n|------|---------------|\n| **Claude Code** | `.claude/skills/` (symlink) |\n| **OpenCode** | `.claude/skills/` (symlink) |\n| **Codex (OpenAI)** | `.codex/skills/` (symlink) |\n| **GitHub Copilot** | `.github/skills/` (symlink) |\n| **Gemini CLI** | `.gemini/skills/` (symlink) |\n\n> **Note:** Restart your AI coding assistant after running setup to load the skills.\n> Gemini CLI requires `experimental.skills` enabled in settings.\n\n# ๐Ÿ“– Documentation\n\nFor installation instructions, usage details, tutorials, and the Developer Guide, visit https://docs.prowler.com/\n\n# ๐Ÿ“ƒ License\n\nProwler is licensed under the Apache License 2.0.\n\nA copy of the License is available at \n", "bytes": 22060, "sha": "4a6460c9d75e2a5e2f786e1cde5e026f2ebd87c41cb99a9993c79bac3479edad", "repo_slug": "prowler-cloud/prowler", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/skl_prowler_cloud_prowler_skills_skill_creat_68364bb3/readme" }