timsonner Prowler
Purpose
Use this skill for cloud-focused vulnerability analysis where the primary risks are identity, public exposure, logging gaps, and configuration drift.
Phase Fit
- Primary: Vulnerability Analysis
- Secondary: Discovery and Reconnaissance, Retest and Closure
Use When
- Need a structured view of cloud identity, storage exposure, and monitoring posture.
- Need to compare deployed controls against expected architecture.
- Need a repeatable cloud retest after remediation.
Avoid When
- Cloud control plane is out of scope.
- The engagement only covers a single application workload and not the surrounding account posture.
Inputs
- Approved provider, accounts, subscriptions, or projects
- Read-only preference and escalation contacts
- Known crown-jewel services or sensitive data locations
Procedure
- Confirm exact cloud scope and access model.
- Review findings with focus on identity, public exposure, storage, and logging.
- Prioritize issues that affect privileged paths or sensitive data.
- Cross-check critical findings against intended architecture before reporting.
- Use the same scoped checks during retest to confirm remediation.
Command Syntax
Replace sample targets with approved in-scope assets and read-only credentials.
# Full AWS assessment
prowler aws --profile pentest
# Specific region only
prowler aws --profile pentest -f us-east-1
# Run specific checks
prowler aws --profile pentest --checks s3_bucket_public_access_block iam_root_hardware_mfa_enabled
# CIS benchmark compliance run
prowler aws --profile pentest -c cis_aws_foundations_benchmark_1_4
# HTML output
prowler aws --profile pentest -M html -o /tmp/contoso-prowler/
# Azure assessment using service principal from environment vars
prowler azure --sp-env-auth
# GCP assessment for a specific project
prowler gcp --project-ids contoso-prod
Evidence to Capture
- Public exposure or excessive permission paths
- Logging and monitoring gaps tied to specific services
- Drift between intended and actual cloud posture
Safety Boundaries
- Prefer read-only assessment paths.
- Avoid expanding into adjacent accounts or services without written approval.