prowler

Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more

APACHE-2.0 License

Downloads
192.3K
Stars
9.5K
Committers
239
View Code on GitHub Visit Website View on X
Ecosystems: Azure, Python, Amazon Web Services

Bot releases are visible (Hide)

prowler - Prowler 3.7.2 - Gates of Tomorrow

Published by sergargar about 1 year ago

Fixes

Dependencies

Chores

Tests

Documentation

New Contributors

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.7.1...3.7.2

prowler - Prowler 3.7.1 - Gates of Tomorrow

Published by jfagoagas over 1 year ago

Fixes

Dependencies

Chores

Tests

Documentation

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.7.0...3.7.1

prowler - Prowler 3.7.0 - Gates of Tomorrow

Published by sergargar over 1 year ago

Trapped in the web, but I cut the threads
Show you the gates of tomorrow
Trapped in the web, no mercy is shed
Show you the gates of tomorrow
Trapped in the web, slaves to the dead
Show you the gates of tomorrow
Trapped in the web, but I cut the threads
Show you the gates of tomorrow

As the song says, this version of Prowler is opening gates of tomorrow! More compliance frameworks like MITRE ATT&CK®, ISO27001 (2013), AWS Well-Architected Framework Reliability pillar (in addition to the existing Security pillar), better support for the Allowlist feature, with all 73 checks for GCP covering CIS Benchmark 2.0 for Google Cloud! Take this one and start closing doors to the bad guys!

New features to highlight in this version:

🥳 GCP CIS v2.0.0 benchmark coverage!

  • Prowler now supports CIS v2.0.0 benchmark for Google Cloud Platform! There were added 73 checks of GCP to fully cover the CIS framework, you can execute it with the following flag to get all CSV standard and compliance, HTML, JSON and JSON OCSF reports:
prowler gcp --compliance cis_2.0_gcp

📝 New AWS compliance frameworks available

  • Prowler now supports MITRE ATT&CK for AWS, ISO27001 (2013) for AWS and AWS Well-Architected Framework Reliability Pillar v0.1. Also, the Spanish ENS RD2022 Compliance Framework has been updated.
  • You can run the new compliance frameworks with the following command:
prowler aws --compliance mitre_attack_aws
prowler aws --compliance iso27001_2013_aws
prowler aws --compliance aws_well_architected_framework_reliability_pillar_aws
prowler aws --compliance ens_rd2022_aws

⚙️ Allowlist supports exceptions:

Allowlist:
  Accounts:
    "*":
      Checks:
        "ecs_task_definitions_no_environment_secrets":
          Regions:
            - "*"
          Resources:
            - "*"
          Exceptions:
            Accounts:
              - "0123456789012"
            Regions:
              - "eu-west-1"
              - "eu-south-2"        # Will ignore every resource in check ecs_task_definitions_no_environment_secrets except the ones in account 0123456789012 located in eu-south-2 or eu-west-1

    "123456789012":
      Checks:
        "*":
          Regions:
            - "*"
          Resources:
            - "*"
          Exceptions:
            Resources:
              - "test"
            Tags:
              - "environment=prod"   # Will ignore every resource except in account 123456789012 except the ones containing the string "test" and tag environment=prod

What's Changed

Features

Fixes

Chores

Dependencies

New Contributors

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.6.1...3.7.0

prowler - Prowler 3.6.1 - Boots On

Published by sergargar over 1 year ago

Fixes

New Contributors

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.6.0...3.6.1

prowler - Prowler 3.6.0 - Boots On

Published by sergargar over 1 year ago

Die With Your Boots On is a song of Iron Maiden's album Piece of mind, it is self explanatory, we like the vibe of that song in their lives, watch it here.
Basically, this is what we do here, we go all in or nothing! 💪🏼
We are bringing the best we have in this code of Prowler 3.6.0: some new checks, improved GCP support, new features, more fixes making it a better piece of software and more helpful for your daily job 😄
Remember to run pip install prowler --upgrade and rock on! 🤘

New features to highlight in this version:

🥳 GCP Multi-Project support:

  • Prowler now supports GCP Multi-Project scans! By default Prowler will scan all the GCP Projects that is allowed to scan, if you want to scan a single project or various specific projects you can use the following flag:
prowler gcp --project-ids <Project ID 1> <Project ID 2> ... <Project ID N>

✅ 16 new checks for GCP (Thanks to @jit-contrib ! 💪🏼 ):

  • New services ApiKeys, DNS and Dataproc are covered and additional checks for Compute and IAM services.
  • See all checks with prowler gcp --list-checks

📝 OCSF Integration (Hello Amazon Security Lake!):

📊 AWS Well Architected Framework:

prowler aws --compliance aws_well_architected_framework_security_pillar_aws

⚙️ MFA supported in AWS:

  • If your IAM entity enforces MFA for AWS Calls you can use --mfa and Prowler will ask you to input the following values to get a new session:
prowler aws --mfa
Enter ARN of MFA: arn:aws:iam::012345678910:mfa/xxxxxx
Enter MFA code: XXXXXX

What's Changed

Features

Fixes

Chores

Dependencies

New Contributors

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.5.3...3.6.0

prowler - Prowler 3.5.3 - Dune (To Tame a Land)

Published by sergargar over 1 year ago

Fixes

Dependencies

Chores

New Contributors

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.5.2...3.5.3

prowler - Prowler 3.5.2 - Dune (To Tame a Land)

Published by sergargar over 1 year ago

Fixes

Chores

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.5.1...3.5.2

prowler - Prowler 3.5.1 - Dune (To Tame a Land)

Published by jfagoagas over 1 year ago

Fixes

Dependencies

Chores

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.5.0...3.5.1

prowler - Prowler 3.5.0 - Dune (To Tame a Land)

Published by sergargar over 1 year ago

I like the story behind this Iron Maiden song. Enjoy Prowler 3.5.0 - Dune!

New features to highlight in this version:

🥳 Slack integration:

  • Prowler now supports Slack integrations! Send a summary of the execution with a Slack APP in your channel, see more in our Integrations Docs

image

✅ 9 new checks for AWS:

  • New services covered like FMS and NetworkFirewall, additional checks for AutoScaling, Organizations, RDS, Route53, S3, SSM Incidents and Workspaces.
  • New important checks:
    • iam_role_cross_account_readonlyaccess_policy Ensure IAM Roles do not have ReadOnlyAccess access for external AWS accounts
    • route53_dangling_ip_subdomain_takeover Check if Route53 Records contains dangling IPs (based on https://github.com/assetnote/ghostbuster)
  • See all checks withprowler aws --list-checks

🔨 Allowlist improvements:

  • You can allowlist an specific service and include regex expressions in the tags, see more in our Allowlist Docs

What's Changed:

Features

Fixes

Chores

Dependencies

New Contributors

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.4.1...3.5.0

prowler - Prowler 3.4.1 - Still Life

Published by sergargar over 1 year ago

Fixes

Chores

Builds

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.4.0...3.4.1

prowler - Prowler 3.4.0 - Still Life

Published by sergargar over 1 year ago

Take a look in the pool and what do you see
In the dark depths there faces beckoning me
Can't you see them it's plain for all to see
They were there oh I know you don't believe me

Still Life is one of those jewels that Iron Maiden has (well… aren’t jewels all their songs? 😉) and it is so good that they also included it in their live double vhs/dvd/cd/lp called “Maiden England” back in 1988. The song is based on a book from Ramsey Campbell called "The Inhabitant of the lake and less welcome tenants”, and it is about somebody that see ghosts in the bottom of a lake and gets crazy about that. They are like cloud security vulnerabilities, they are everywhere and seems to be hard to beat them. Listen to the song here 🔥Still Life🔥 while hardening and reading below what we did.

A brand new version of Prowler 3.4.0 at your command! This version won’t make your ghosts to disappear but will help you to put them in their place and in line to start the journey of getting rid of them. Time to shine up your boots with pip install prowler --upgrade.

New features to highlight in this version:

☁️ New support for Google Cloud with 43 checks!:

  • GCP services covered: IAM, BigQuery, CloudSQL, CloudStorage, Compute, KMS and Logging.
  • Run prowler gcp --list-checks for details and visit our Prowler GCP documentation here.

✅ 21 new checks for AWS:

  • New services covered like Organizations best practices, SSM Incidents, Resource Explorer, Backup, additional checks for CloudTrail, ECR scan on push check updated, GuardDuty, VPC best practices, IAM (see these ones that will help you a lot!) thanks to @gabrielsoltz
  • Watch out! iam_policy_no_administrative_privileges has been renamed to iam_customer_unattached_policy_no_administrative_privileges
  • New important IAM checks:
    • [iam_aws_attached_policy_no_administrative_privileges] Ensure IAM AWS-Managed policies that allow full ":" administrative privileges are not attached - iam [high]
    • [iam_customer_attached_policy_no_administrative_privileges] Ensure IAM Customer-Managed policies that allow full ":" administrative privileges are not attached - iam [high]
    • [iam_customer_unattached_policy_no_administrative_privileges] Ensure IAM policies that allow full ":" administrative privileges are not created - iam [low]
  • See all checks withprowler aws --list-checks

📊 New html report for Azure and GCP:

  • When running Azure or GCP checks, html report is now also created for you to enjoy them during your security assessments.

⚙️ Custom checks now supported:

  • You can create your custom checks inside Prowler or in your custom folders following our Developer Guide and a Tutorial about it here, new option -x/--checks-folder for your custom checks.

🏷️ Resource Tags supported in Allow list:

What's Changed:

Features

Fixes

Builds

Chores

New Contributors

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.3.4...3.4.0

prowler - Prowler 3.3.4 - Sun and Steel [HOTFIX]

Published by jfagoagas over 1 year ago

Fixes

Chores

Dependencies

New Contributors

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.3.2...3.3.3

prowler - Prowler 3.3.3 - Sun and Steel

Published by jfagoagas over 1 year ago

Fixes

Chores

Dependencies

New Contributors

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.3.2...3.3.3

prowler - Prowler 3.3.2 - Sun and Steel [HOTFIX]

Published by jfagoagas over 1 year ago

Fixes

  • fix(pypi): Build from release branch by @jfagoagas in #2151

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.3.1...3.3.2

prowler - Prowler 3.3.1 - Sun and Steel

Published by jfagoagas over 1 year ago

Fixes

Chores

Docs

Dependencies

New Contributors

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.3.0...3.3.1

prowler - Prowler 3.3.0 - Sun and Steel

Published by toniblyx over 1 year ago

Through earth and water, fire and wind
You came at last, nothing was the end...

As this series of Prowler versions, Sun and Steel is a song part of Piece of Mind album of Iron Maiden. In this side of the world (north hemisphere), spring is about to start and this song is about Sun (and Steel) so here you go! 🤘🏽See below the amazing new features we have added to Prowler 3.3.0 🔥Sun and Steel🔥

New features to highlight in this version:

🏷️ Resource Tags everywhere:

  • Now all findings outputs like HTML, CSV and JSON for AWS provider contains every resource tags.
    Screenshot 2023-03-16 at 18 17 13

⚖️ Compliance everywhere:

  • Now all findings in outputs like HTML, CSV and JSON contains any security framework related to the finding.
    Screenshot 2023-03-16 at 18 17 23

🛡️ Security Hub integration with compliance from Prowler:

  • All findings sent to Security Hub include their compliance information and all frameworks that they belongs to. This allow user to filter by Compliance Associated Standards ID and others and take advantage of all new supported frameworks in Prowler:
    Screenshot 2023-03-16 at 18 25 37

📊 New inventory output include regions:

  • When running Prowler Quick Inventory (prowler -i) the output is as nice as this one:

✅ 3 new checks:

  • s3_bucket_level_public_access_block
  • rds_instance_transport_encrypted - this is valid so far only for Postgresql and MS SQL Server
  • cloudwatch_log_group_no_secrets_in_logs

What's Changed:

Fixes:

Documentation and other updates

New Contributors

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.2.4...3.3.0

prowler - Prowler 3.2.4 - Quest for Fire [HOTFIX]

Published by jfagoagas over 1 year ago

Fixes

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.2.3...3.2.4

prowler - Prowler 3.2.3 - Quest for Fire

Published by jfagoagas over 1 year ago

Dependencies

Fixes

Chores

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.2.2...3.2.3

prowler - Prowler 3.2.2 - Quest for Fire

Published by sergargar over 1 year ago

Chores

Fixes

Builds

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.2.1...3.2.2

prowler - Prowler 3.2.1 - Quest for Fire

Published by sergargar over 1 year ago

Chores

Fixes

Dependencies

Full Changelog: https://github.com/prowler-cloud/prowler/compare/3.2.0...3.2.1

Package Rankings
Top 6.01% on Pypi.org
Related Projects
cloud-custodian

Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to q...

01 Mar 2016 5,195
cs-suite

Cloud Security Suite - One stop tool for auditing the security posture of AWS/GCP/Azure infrastru...

16 Aug 2017 1,122
object-store-python

Python bindings and arrow integration for the rust object_store crate.

10 Sep 2022 52
examples

Infrastructure, containers, and serverless apps to AWS, Azure, GCP, and Kubernetes... all deploye...

27 Oct 2017 2,356
pulumi

Pulumi - Infrastructure as Code in any programming language 🚀

31 Oct 2016 21,518
awesome-cloud-security

🛡️ Awesome Cloud Security Resources ⚔️

10 May 2020 1,921
checkov

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as c...

27 Nov 2019 6,762