# Prowler

> Use for cloud control-plane posture review, identity analysis, logging coverage checks, and configuration drift assessment during authorized pentests. Trigger on AWS, Azure, or GCP scope where the goal is to review permissions, public exposure, and monitoring gaps.

- Skill: `timsonner/prowler` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/prowler`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/prowler/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/prowler

---


# Prowler

## Purpose

Use this skill for cloud-focused vulnerability analysis where the primary risks are identity, public exposure, logging gaps, and configuration drift.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Discovery and Reconnaissance, Retest and Closure

## Use When

- Need a structured view of cloud identity, storage exposure, and monitoring posture.
- Need to compare deployed controls against expected architecture.
- Need a repeatable cloud retest after remediation.

## Avoid When

- Cloud control plane is out of scope.
- The engagement only covers a single application workload and not the surrounding account posture.

## Inputs

- Approved provider, accounts, subscriptions, or projects
- Read-only preference and escalation contacts
- Known crown-jewel services or sensitive data locations

## Procedure

1. Confirm exact cloud scope and access model.
2. Review findings with focus on identity, public exposure, storage, and logging.
3. Prioritize issues that affect privileged paths or sensitive data.
4. Cross-check critical findings against intended architecture before reporting.
5. Use the same scoped checks during retest to confirm remediation.

## Command Syntax

Replace sample targets with approved in-scope assets and read-only credentials.

```bash
# Full AWS assessment
prowler aws --profile pentest

# Specific region only
prowler aws --profile pentest -f us-east-1

# Run specific checks
prowler aws --profile pentest --checks s3_bucket_public_access_block iam_root_hardware_mfa_enabled

# CIS benchmark compliance run
prowler aws --profile pentest -c cis_aws_foundations_benchmark_1_4

# HTML output
prowler aws --profile pentest -M html -o /tmp/contoso-prowler/

# Azure assessment using service principal from environment vars
prowler azure --sp-env-auth

# GCP assessment for a specific project
prowler gcp --project-ids contoso-prod
```

## Evidence to Capture

- Public exposure or excessive permission paths
- Logging and monitoring gaps tied to specific services
- Drift between intended and actual cloud posture

## Safety Boundaries

- Prefer read-only assessment paths.
- Avoid expanding into adjacent accounts or services without written approval.