[{"_1":2,"_195":-5,"_196":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_170":171},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":89,"_111":112,"_159":-5,"_160":11,"_161":21,"_162":11,"_163":-5,"_164":11,"_165":-5,"_166":167,"_168":113,"_169":-7},"canonicalUrl","https://hub.docker.com/r/aethereal/prowler/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","aethereal","reponame","prowler","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":21,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2017-12-24T15:24:06.089054Z","description","This builds a docker image for \"prowler\" suitable for general use. ","is_private","last_updated","2017-12-24T18:55:47.913632Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",2139,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Prowler: AWS CIS Benchmark Tool\n\n## Table of Contents \n- [Description](#description)\n- [Features](#features) \n- [Requirements](#requirements) \n- [Usage](#usage)\n- [Fix](#fix)\n- [Screenshots](#screenshots)\n- [Troubleshooting](#troubleshooting)\n- [Extras](#extras)\n\n## Description\n\nTool based on AWS-CLI commands for AWS account security assessment and hardening, following guidelines of the [CIS Amazon Web Services Foundations Benchmark 1.1 ](https://benchmarks.cisecurity.org/tools2/amazon/CIS_Amazon_Web_Services_Foundations_Benchmark_v1.1.0.pdf)\n\n## Features\n\nIt covers hardening and security best practices for all AWS regions related to:\n\n- Identity and Access Management (24 checks)\n- Logging (8 checks)\n- Monitoring (15 checks)\n- Networking (5 checks)\n- Extra checks (5 checks) *see Extras section\n\nFor a comprehesive list and resolution look at the guide on the link above.\n\nWith Prowler you can:\n- get a colourish or monochrome report\n- a CSV format report for diff\n- run specific checks without having to run the entire report\n- check multiple AWS accounts in parallel\n\n## Requirements\nThis script has been written in bash using AWS-CLI and it works in Linux and OSX.\n\n- Make sure your AWS-CLI is installed on your workstation, with Python pip already installed:\n```\npip install awscli\n```\nOr install it using \"brew\", \"apt\", \"yum\" or manually from https://aws.amazon.com/cli/\n\n- Previous steps, from your workstation:\n```\ngit clone https://github.com/Alfresco/prowler\ncd prowler\n```\n\n- Make sure you have properly configured your AWS-CLI with a valid Access Key and Region:\n```\naws configure\n```\n\n- Make sure your Secret and Access Keys are associated to a user with proper permissions to do all checks. To make sure add SecurityAuditor default policy to your user. Policy ARN is\n\n```\narn:aws:iam::aws:policy/SecurityAudit\n```\n> In some cases you may need more list or get permissions in some services, look at the Troubleshooting section for a more comprehensive policy if you find issues with the default SecurityAudit policy.\n\n## Usage\n\n1 - Run the prowler.sh command without options (it will use your environment variable credentials if exist or default in ~/.aws/credentials file and run checks over all regions when needed, default region is us-east-1):\n\n```\n./prowler\n```\n\n2 - For custom AWS-CLI profile and region, use the following: (it will use your custom profile and run checks over all regions when needed):\n\n```\n./prowler -p custom-profile -r us-east-1\n```\n\n3 - For a single check use option -c:\n\n```\n./prowler -c check310\n```\nor for custom profile and region\n```\n./prowler -p custom-profile -r us-east-1 -c check11\n```\nor for a group of checks use group name:\n```\n./prowler -c check3\n```\n\nValid check numbers are based on the AWS CIS Benchmark guide, so 1.1 is check11 and 3.10 is check310\n\n4 - If you want to save your report for later analysis:\n```\n./prowler > prowler-report.txt\n```\nor if you want a colored HTML report do:\n```\npip install ansi2html\n./prowler | ansi2html -la > report.html\n```\nor if you want a pipe-delimited report file, do:\n```\n./prowler -M csv > output.psv\n```\n\n5 - To perform an assessment based on CIS Profile Definitions you can use level1 or level2 with `-c` flag, more information about this [here, page 8](https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf):\n```\n./prowler -c level1\n```\n\n6 - If you want to run Prowler to check multiple AWS accounts in parallel (runs up to 4 simultaneously `-P 4`):\n\n```\ngrep -E '^\\[([0-9A-Aa-z_-]+)\\]' ~/.aws/credentials | tr -d '][' | shuf | \\\nxargs -n 1 -L 1 -I @ -r -P 4 ./prowler -p @ -M csv 2> /dev/null >> all-accounts.csv\n```\n\n7 - For help use:\n\n```\n./prowler -h\n\nUSAGE:\n prowler -p -r [ -h ]\n Options:\n -p specify your AWS profile to use (i.e.: default)\n -r specify an AWS region to direct API requests to (i.e.: us-east-1)\n -c specify a check number or group from the AWS CIS benchmark (i.e.: check11 for check 1.1, check3 for entire section 3 or level1 for CIS Level 1 Profile Definitions)\n -f specify an AWS region to run checks against (i.e.: us-west-1)\n -m specify the maximum number of items to return for long-running requests (default: 100)\n -M output mode: text (defalut), mono, csv (separator is \",\"; data is on stdout; progress on stderr)\n -k keep the credential report\n -n show check numbers to sort easier (i.e.: 1.01 instead of 1.1)\n -h this help\n\n```\n## Fix:\n Check your report and fix the issues following all specific guidelines per check in https://benchmarks.cisecurity.org/tools2/amazon/CIS_Amazon_Web_Services_Foundations_Benchmark_v1.1.0.pdf\n\n## Screenshots\n\n- Sample screenshot of report first lines:\n $\"screenshot$ \n\n- Sample screnshot of single check for check 3.3:\n $\"screenshot$ \n\n- Sample of a full report:\n\n```\n$ ./prowler\n _\n _ __ _ __ _____ _| | ___ _ __\n | '_ \\| '__/ _ \\ \\ /\\ / / |/ _ \\ '__|\n | |_) | | | (_) \\ V V /| | __/ |\n | .__/|_| \\___/ \\_/\\_/ |_|\\___|_|\n |_| CIS based AWS Account Hardening Tool\n\n\nDate: Wed Sep 14 13:30:13 EDT 2016\n\nThis report is being generated using credentials below:\n\nAWS-CLI Profile: [default] AWS Region: [us-east-1]\n\n--------------------------------------------------------------------------------------\n| GetCallerIdentity |\n+--------------+-------------------------------------------+-------------------------+\n| Account | Arn | UserId |\n+--------------+-------------------------------------------+-------------------------+\n| XXXXXXXXXXXX| arn:aws:iam::XXXXXXXXXXXX:user/toni | XXXXXXXXXXXXXXXXXXXXX |\n+--------------+-------------------------------------------+-------------------------+\n\nColors Code for results: INFORMATIVE, OK (RECOMMENDED VALUE), CRITICAL (FIX REQUIRED)\n\n\nGenerating AWS IAM Credential Report....COMPLETE\n\n\n 1 Identity and Access Management *********************************\n\n 1.1 Avoid the use of the root account (Scored). Last time root account was used\n (password last used, access_key_1_last_used, access_key_2_last_used):\n 2016-08-11T20:59:27+00:00, N/A, N/A\n\n 1.2 Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password (Scored)\n List of users with Password enabled but MFA disabled:\n toni\n\n 1.3 Ensure credentials unused for 90 days or greater are disabled (Scored)\n User list:\n toni\n\n 1.4 Ensure access keys are rotated every 90 days or less (Scored)\n Users with access key 1 older than 90 days:\n \n Users with access key 2 older than 90 days:\n\n 1.5 Ensure IAM password policy requires at least one uppercase letter (Scored)\n FALSE\n\n 1.6 Ensure IAM password policy require at least one lowercase letter (Scored)\n FALSE\n\n 1.7 Ensure IAM password policy require at least one symbol (Scored)\n FALSE\n\n 1.8 Ensure IAM password policy require at least one number (Scored)\n FALSE\n\n 1.9 Ensure IAM password policy requires minimum length of 14 or greater (Scored)\n FALSE\n\n 1.10 Ensure IAM password policy prevents password reuse (Scored)\n FALSE\n\n 1.11 Ensure IAM password policy expires passwords within 90 days or less (Scored)\n FALSE\n\n 1.12 Ensure no root account access key exists (Scored)\n Found access key 1\n OK No access key 2 found\n\n 1.13 Ensure hardware MFA is enabled for the root account (Scored)\n OK\n\n 1.14 Ensure security questions are registered in the AWS account (Not Scored)\n No command available for check 1.14\n Login to the AWS Console as root, click on the Account\n Name -> My Account -> Configure Security Challenge Questions\n\n 1.15 Ensure IAM policies are attached only to groups or roles (Scored)\n Users with policy attached to them instead to groups: (it may take few seconds...)\n toni\n\n\n 2 Logging ********************************************************\n\n 2.1 Ensure CloudTrail is enabled in all regions (Scored)\n FALSE\n\n 2.2 Ensure CloudTrail log file validation is enabled (Scored)\n FALSE\n\n 2.3 Ensure the S3 bucket CloudTrail logs to is not publicly accessible (Scored)\n WARNING! CloudTrail bucket doesn't exist!\n\n 2.4 Ensure CloudTrail trails are integrated with CloudWatch Logs (Scored)\n WARNING! No CloudTrail trails found!\n\n 2.5 Ensure AWS Config is enabled in all regions (Scored)\n WARNING! Region ap-south-1 has AWS Config disabled or not configured\n WARNING! Region eu-west-1 has AWS Config disabled or not configured\n WARNING! Region ap-southeast-1 has AWS Config disabled or not configured\n WARNING! Region ap-southeast-2 has AWS Config disabled or not configured\n WARNING! Region eu-central-1 has AWS Config disabled or not configured\n WARNING! Region ap-northeast-2 has AWS Config disabled or not configured\n WARNING! Region ap-northeast-1 has AWS Config disabled or not configured\n WARNING! Region us-east-1 has AWS Config disabled or not configured\n WARNING! Region sa-east-1 has AWS Config disabled or not configured\n WARNING! Region us-west-1 has AWS Config disabled or not configured\n WARNING! Region us-west-2 has AWS Config disabled or not configured\n\n 2.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket (Scored)\n WARNING! CloudTrail bucket doesn't exist!\n\n 2.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Scored)\n WARNING! CloudTrail bucket doesn't exist!\n\n 2.8 Ensure rotation for customer created CMKs is enabled (Scored)\n Region ap-south-1 doesn't have encryption keys\n Region eu-west-1 doesn't have encryption keys\n Region ap-southeast-1 doesn't have encryption keys\n Region ap-southeast-2 doesn't have encryption keys\n Region eu-central-1 doesn't have encryption keys\n Region ap-northeast-2 doesn't have encryption keys\n Region ap-northeast-1 doesn't have encryption keys\n WARNING! Key a0e988df-bc84-423f-996c-XXXX in Region us-east-1 is not set to rotate!\n Region sa-east-1 doesn't have encryption keys\n Region us-west-1 doesn't have encryption keys\n Region us-west-2 doesn't have encryption keys\n\n\n 3 Monitoring *****************************************************\n\n 3.1 Ensure a log metric filter and alarm exist for unauthorized API calls (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.3 Ensure a log metric filter and alarm exist for usage of root account (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.4 Ensure a log metric filter and alarm exist for IAM policy changes (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.7 Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.8 Ensure a log metric filter and alarm exist for S3 bucket policy changes (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.10 Ensure a log metric filter and alarm exist for security group changes (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.12 Ensure a log metric filter and alarm exist for changes to network gateways (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.13 Ensure a log metric filter and alarm exist for route table changes (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.14 Ensure a log metric filter and alarm exist for VPC changes (Scored)\n WARNING! No CloudWatch group found, no metric filters or alarms associated\n\n 3.15 Ensure security contact information is registered (Scored)\n No command available for check 3.15\n Login to the AWS Console, click on My Account\n Go to Alternate Contacts -> make sure Security section is filled\n\n 3.16 Ensure appropriate subscribers to each SNS topic (Not Scored)\n Region ap-south-1 doesn't have topics\n Region eu-west-1 doesn't have topics\n Region ap-southeast-1 doesn't have topics\n Region ap-southeast-2 doesn't have topics\n Region eu-central-1 doesn't have topics\n Region ap-northeast-2 doesn't have topics\n Region ap-northeast-1 doesn't have topics\n Region us-east-1 doesn't have topics\n Region sa-east-1 doesn't have topics\n Region us-west-1 doesn't have topics\n Region us-west-2 doesn't have topics\n\n\n 4 Networking **************************************************\n\n 4.1 Ensure no security groups allow ingress from 0.0.0.0/0 to port 22 (Scored)\n OK, No Security Groups found in ap-south-1 with port 22 TCP open to 0.0.0.0/0\n OK, No Security Groups found in eu-west-1 with port 22 TCP open to 0.0.0.0/0\n OK, No Security Groups found in ap-southeast-1 with port 22 TCP open to 0.0.0.0/0\n OK, No Security Groups found in ap-southeast-2 with port 22 TCP open to 0.0.0.0/0\n OK, No Security Groups found in eu-central-1 with port 22 TCP open to 0.0.0.0/0\n OK, No Security Groups found in ap-northeast-2 with port 22 TCP open to 0.0.0.0/0\n OK, No Security Groups found in ap-northeast-1 with port 22 TCP open to 0.0.0.0/0\n OK, No Security Groups found in us-east-1 with port 22 TCP open to 0.0.0.0/0\n OK, No Security Groups found in sa-east-1 with port 22 TCP open to 0.0.0.0/0\n OK, No Security Groups found in us-west-1 with port 22 TCP open to 0.0.0.0/0\n OK, No Security Groups found in us-west-2 with port 22 TCP open to 0.0.0.0/0\n\n 4.2 Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389 (Scored)\n OK, No Security Groups found in ap-south-1 with port 3389 TCP open to 0.0.0.0/0\n OK, No Security Groups found in eu-west-1 with port 3389 TCP open to 0.0.0.0/0\n OK, No Security Groups found in ap-southeast-1 with port 3389 TCP open to 0.0.0.0/0\n OK, No Security Groups found in ap-southeast-2 with port 3389 TCP open to 0.0.0.0/0\n OK, No Security Groups found in eu-central-1 with port 3389 TCP open to 0.0.0.0/0\n OK, No Security Groups found in ap-northeast-2 with port 3389 TCP open to 0.0.0.0/0\n OK, No Security Groups found in ap-northeast-1 with port 3389 TCP open to 0.0.0.0/0\n OK, No Security Groups found in us-east-1 with port 3389 TCP open to 0.0.0.0/0\n OK, No Security Groups found in sa-east-1 with port 3389 TCP open to 0.0.0.0/0\n OK, No Security Groups found in us-west-1 with port 3389 TCP open to 0.0.0.0/0\n OK, No Security Groups found in us-west-2 with port 3389 TCP open to 0.0.0.0/0\n\n 4.3 Ensure VPC Flow Logging is Enabled in all Applicable Regions (Scored)\n WARNING! no VPCFlowLog has been found in Region ap-south-1\n WARNING! no VPCFlowLog has been found in Region eu-west-1\n WARNING! no VPCFlowLog has been found in Region ap-southeast-1\n WARNING! no VPCFlowLog has been found in Region ap-southeast-2\n WARNING! no VPCFlowLog has been found in Region eu-central-1\n WARNING! no VPCFlowLog has been found in Region ap-northeast-2\n WARNING! no VPCFlowLog has been found in Region ap-northeast-1\n WARNING! no VPCFlowLog has been found in Region us-east-1\n WARNING! no VPCFlowLog has been found in Region sa-east-1\n WARNING! no VPCFlowLog has been found in Region us-west-1\n WARNING! no VPCFlowLog has been found in Region us-west-2\n\n 4.4 Ensure the default security group restricts all traffic (Scored)\n WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region ap-south-1\n WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region eu-west-1\n WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region ap-southeast-1\n WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region ap-southeast-2\n WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region eu-central-1\n WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region ap-northeast-2\n WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region ap-northeast-1\n OK, no Default Security Groups open to 0.0.0.0 found in Region us-east-1\n WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region sa-east-1\n WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region us-west-1\n OK, no Default Security Groups open to 0.0.0.0 found in Region us-west-2\n\n - For more information and reference:\n https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf\n```\n\n## Troubleshooting\n\n### STS expired token\nIf you are using an STS token for AWS-CLI and your session is expired you probably get this error:\n\n```\nA client error (ExpiredToken) occurred when calling the GenerateCredentialReport operation: The security token included in the request is expired\n```\nTo fix it, please renew your token by authenticating again to the AWS API.\n\n### Custom IAM Policy\nInstead of using default policy SecurityAudit for the account you use for checks you may need to create a custom policy with a few more permissions (get and list, not change!) here you go a good example for a \"ProwlerPolicyReadOnly\":\n\n```\n{\n \"Version\": \"2012-10-17\",\n \"Statement\": [{\n \"Action\": [\n \"acm:describecertificate\",\n \"acm:listcertificates\",\n \"autoscaling:describe*\",\n \"cloudformation:describestack*\",\n \"cloudformation:getstackpolicy\",\n \"cloudformation:gettemplate\",\n \"cloudformation:liststack*\",\n \"cloudfront:get*\",\n \"cloudfront:list*\",\n \"cloudtrail:describetrails\",\n \"cloudtrail:gettrailstatus\",\n \"cloudtrail:listtags\",\n \"cloudwatch:describe*\",\n \"cloudwatchlogs:describeloggroups\",\n \"cloudwatchlogs:describemetricfilters\",\n \"codecommit:batchgetrepositories\",\n \"codecommit:getbranch\",\n \"codecommit:getobjectidentifier\",\n \"codecommit:getrepository\",\n \"codecommit:list*\",\n \"codedeploy:batch*\",\n \"codedeploy:get*\",\n \"codedeploy:list*\",\n \"config:deliver*\",\n \"config:describe*\",\n \"config:get*\",\n \"datapipeline:describeobjects\",\n \"datapipeline:describepipelines\",\n \"datapipeline:evaluateexpression\",\n \"datapipeline:getpipelinedefinition\",\n \"datapipeline:listpipelines\",\n \"datapipeline:queryobjects\",\n \"datapipeline:validatepipelinedefinition\",\n \"directconnect:describe*\",\n \"dynamodb:listtables\",\n \"ec2:describe*\",\n \"ecs:describe*\",\n \"ecs:list*\",\n \"elasticache:describe*\",\n \"elasticbeanstalk:describe*\",\n \"elasticloadbalancing:describe*\",\n \"elasticmapreduce:describejobflows\",\n \"elasticmapreduce:listclusters\",\n \"es:describeelasticsearchdomainconfig\",\n \"es:listdomainnames\",\n \"firehose:describe*\",\n \"firehose:list*\",\n \"glacier:listvaults\",\n \"iam:generatecredentialreport\",\n \"iam:get*\",\n \"iam:list*\",\n \"kms:describe*\",\n \"kms:get*\",\n \"kms:list*\",\n \"lambda:getpolicy\",\n \"lambda:listfunctions\",\n \"logs:DescribeMetricFilters\",\n \"rds:describe*\",\n \"rds:downloaddblogfileportion\",\n \"rds:listtagsforresource\",\n \"redshift:describe*\",\n \"route53:getchange\",\n \"route53:getcheckeripranges\",\n \"route53:getgeolocation\",\n \"route53:gethealthcheck\",\n \"route53:gethealthcheckcount\",\n \"route53:gethealthchecklastfailurereason\",\n \"route53:gethostedzone\",\n \"route53:gethostedzonecount\",\n \"route53:getreusabledelegationset\",\n \"route53:listgeolocations\",\n \"route53:listhealthchecks\",\n \"route53:listhostedzones\",\n \"route53:listhostedzonesbyname\",\n \"route53:listresourcerecordsets\",\n \"route53:listreusabledelegationsets\",\n \"route53:listtagsforresource\",\n \"route53:listtagsforresources\",\n \"route53domains:getdomaindetail\",\n \"route53domains:getoperationdetail\",\n \"route53domains:listdomains\",\n \"route53domains:listoperations\",\n \"route53domains:listtagsfordomain\",\n \"s3:getbucket*\",\n \"s3:getlifecycleconfiguration\",\n \"s3:getobjectacl\",\n \"s3:getobjectversionacl\",\n \"s3:listallmybuckets\",\n \"sdb:domainmetadata\",\n \"sdb:listdomains\",\n \"ses:getidentitydkimattributes\",\n \"ses:getidentityverificationattributes\",\n \"ses:listidentities\",\n \"ses:listverifiedemailaddresses\",\n \"ses:sendemail\",\n \"sns:gettopicattributes\",\n \"sns:listsubscriptionsbytopic\",\n \"sns:listtopics\",\n \"sqs:getqueueattributes\",\n \"sqs:listqueues\",\n \"tag:getresources\",\n \"tag:gettagkeys\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }]\n}\n```\n\n### Incremental IAM Policy\n\nAlternatively, here is a policy which defines the permissions which are NOT present in the AWS Managed SecurityAudit policy. Attach both this policy and the AWS Managed SecurityAudit policy to the group and you're good to go. \n\n```\n{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"acm:DescribeCertificate\",\n \"acm:ListCertificates\",\n \"cloudwatchlogs:describeLogGroups\",\n \"cloudwatchlogs:DescribeMetricFilters\",\n \"es:DescribeElasticsearchDomainConfig\",\n \"ses:GetIdentityVerificationAttributes\",\n \"sns:ListSubscriptionsByTopic\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n```\n\n### Bootstrap Script\n\nQuick bash script to set up a \"prowler\" IAM user and \"SecurityAudit\" group with the required permissions. To run the script below, you need user with administrative permissions; set the AWS_DEFAULT_PROFILE to use that account.\n\n```\nexport AWS_DEFAULT_PROFILE=default\nexport ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' | tr -d '\"')\naws iam create-group --group-name SecurityAudit\naws iam create-policy --policy-name ProwlerAuditAdditions --policy-document file://$(pwd)/prowler-policy-additions.json\naws iam attach-group-policy --group-name SecurityAudit --policy-arn arn:aws:iam::aws:policy/SecurityAudit\naws iam attach-group-policy --group-name SecurityAudit --policy-arn arn:aws:iam::${ACCOUNT_ID}:policy/ProwlerAuditAdditions\naws iam create-user --user-name prowler\naws iam add-user-to-group --user-name prowler --group-name SecurityAudit\naws iam create-access-key --user-name prowler\nunset ACCOUNT_ID AWS_DEFAULT_PROFILE\n```\n\nThe `aws iam create-access-key` command will output the secret access key and the key id; keep these somewhere safe, and add them to ~/.aws/credentials with an appropriate profile name to use them with prowler. This is the only time they secret key will be shown. If you loose it, you will need to generate a replacement.\n\n## Extras\nWe are adding addition","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",385060734,"orgData",{"_90":91,"_92":93,"_94":95,"_96":33,"_97":98,"_99":100,"_101":102,"_103":104,"_105":106,"_107":98,"_108":98,"_109":98,"_110":21},"id","6a74dc0b7903447c9518f4a7b329896f","uuid","6a74dc0b-7903-447c-9518-f4a7b329896f","type","organization","orgname","full_name","","location","Saint Paul, Mn","company","Aethereal Engineering, LLC","profile_url","http://aethereal.io","date_joined","2017-11-27T23:04:25.992935Z","gravatar_url","gravatar_email","badge","is_active","recentTags",[113,149],{"_114":44,"_115":116,"_117":118,"_90":119,"_120":121,"_50":138,"_139":116,"_140":33,"_141":56,"_57":142,"_143":144,"_145":129,"_146":138,"_147":66,"_148":21},"content_type","creator",2407793,"full_size",302181402,19843789,"images",[122],{"_123":124,"_125":126,"_127":98,"_128":129,"_130":131,"_132":133,"_134":98,"_135":-5,"_136":118,"_63":66,"_137":-5},"architecture","amd64","digest","sha256:85c5884843a69f02dc03278793af4c104d26dfd47c9621d6a788300798a5b2e8","features","last_pulled","2026-10-04T16:14:04.001314596Z","last_pushed","2017-12-24T18:55:48Z","os","linux","os_features","os_version","size","variant","2017-12-24T18:55:47.61023Z","last_updater","last_updater_username","media_type","latest","repository",2686397,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_114":44,"_115":116,"_117":150,"_90":151,"_120":152,"_50":157,"_139":116,"_140":33,"_141":56,"_57":158,"_143":144,"_145":155,"_146":157,"_147":66,"_148":21},302181116,19843741,[153],{"_123":124,"_125":154,"_127":98,"_128":155,"_130":156,"_132":133,"_134":98,"_135":-5,"_136":150,"_63":66,"_137":-5},"sha256:789267fcafc3112539584fdce8532360f2a33b03676c4a0e9137f64183e66e15","2026-10-04T16:14:01.231507741Z","2017-12-24T18:40:35Z","2017-12-24T18:40:34.282295Z","add_docker","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":172,"_179":180,"_166":193,"_194":11},{"_40":173,"_42":174,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":175,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":176,"_79":21,"_80":178,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":177},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_181":182,"_183":-5,"_184":-5,"_185":186},"count",2,"next","previous","results",[187,190],{"_114":44,"_115":116,"_117":118,"_90":119,"_120":188,"_50":138,"_139":116,"_140":33,"_141":56,"_57":142,"_143":144,"_145":129,"_146":138,"_147":66,"_148":21},[189],{"_123":124,"_125":126,"_127":98,"_128":129,"_130":131,"_132":133,"_134":98,"_135":-5,"_136":118,"_63":66,"_137":-5},{"_114":44,"_115":116,"_117":150,"_90":151,"_120":191,"_50":157,"_139":116,"_140":33,"_141":56,"_57":158,"_143":144,"_145":155,"_146":157,"_147":66,"_148":21},[192],{"_123":124,"_125":154,"_127":98,"_128":155,"_130":156,"_132":133,"_134":98,"_135":-5,"_136":150,"_63":66,"_137":-5},[],"canDeleteTags","actionData","errors"]

aethereal/prowler

Tags for aethereal/prowler