Prowler AWS

prowler aws -M csv --output-directory <out>

Audit the AWS account with Prowler (CSPM), evaluating CIS controls and best practices in the posture report.

Run it in the infrastructure pipeline (or in periodic review) when you want the account posture: prowler aws evaluates controls (CIS AWS Foundations Benchmark and project-specific ones) — buckets, IAM, security groups, CloudTrail — and generates the report with the result of each control. It's the reference open-source CSPM: the account posture in the report. In DevSecOps, Prowler is the infrastructure pipeline check: failed controls (deployed misconfiguration) are detected in the report and remediated.

Don't use it as intrusion detection: Prowler audits configuration — behavior (credentials in use) is covered by GuardDuty. The full report of a large account takes time and generates thousands of findings: filtering by severity and scope (--services, --region) are part of the flow. And note: Prowler's permissions (broad read policy) are granted with least privilege and scope is narrowed. The real state (drift from code) is what Prowler measures — IaC (Checkov) validates code, Prowler the cloud state.