Prowler AWS

prowler aws -M csv

Audits AWS account security with Prowler, evaluating CIS controls and best practices in a CSV report.

Run it when you need an AWS security audit with the reference open-source tool: Prowler evaluates the account against controls (CIS AWS Foundations Benchmark and its own) — buckets, IAM policies, security groups, CloudTrail, exposed services — and generates the report with the result of each control. It's the standard for AWS auditing: the full account posture in one report, failed controls prioritized, and integration with Security Hub (prowler aws --security-hub). In hardening and periodic reviews, Prowler is the measurement: the findings CSV is processed and failures are remediated.

Don't use it as intrusion detection: Prowler audits configuration and posture, not behavior — compromised credentials in use won't show up (for that, use GuardDuty and activity analysis). The full report on a large account takes time and generates thousands of findings: filtering by severity and reviewing the controls relevant to your environment are part of the workflow. And watch out for permissions and scope: Prowler needs broad read policy on the account (or the organization role) — grant least privilege and narrow the scope (--region, --services). The project version moves fast: new controls and syntax change between versions.