Prowler Open Source Cloud Security Tool

Prowler is composed of several distinct components, each using a specific technology stack:

• SDK: Python 3.10+ (managed with uv) located in prowler/.
• API: Django 5.1, Django REST Framework (DRF), and Celery located in api/.
• UI: Next.js 16, React 19, and Tailwind 4 located in ui/.
• MCP: FastMCP 2.13.1 located in mcp_server/.

Prowler maps security checks to industry-standard compliance frameworks, allowing a single scan to generate both technical findings and framework-aligned evidence. This evaluation logic is consistent across Prowler Cloud, Prowler Local Server, and the Prowler CLI.

Supported frameworks include:

• CIS Benchmarks
• NIST 800-53
• NIST CSF
• NIS2
• ENS RD2022
• ISO 27001
• PCI-DSS
• SOC 2
• GDPR
• HIPAA
• AWS Well-Architected
• BSI C5
• CSA CCM
• MITRE ATT&CK
• KISA ISMS-P
• FedRAMP
• Prowler ThreatScore

A full catalog of available frameworks can be found at the Prowler Hub.

Prowler is divided into two main product families: managed/licensed products and open-source projects.

Prowler Products (Managed/Licensed)

• Prowler Cloud: A managed cloud security platform operated by the Prowler team.
• Prowler Hub: A free public library containing versioned checks, cloud service artifacts, and compliance frameworks.
• Prowler MCP: An MCP (Model Context Protocol) server that enables AI assistants and agents to connect to Prowler.
• Other Products: Includes Prowler Private Cloud and Prowler Lighthouse AI.

Open Source Projects

• Prowler CLI: A command-line tool used to execute security scans across all supported providers.
• Prowler Local Server: A self-hosted web application and API for managing security data.

Prowler can be integrated with external tools to enhance functionality and automate security assessment workflows. Supported integration targets include:

• Messaging Platforms: For real-time notifications (e.g., Slack).
• Project Management Tools: For tracking security findings (e.g., Jira).
• Cloud Services: For centralized security management (e.g., AWS Security Hub).

Prowler Lighthouse AI is a Cloud Security Analyst chatbot designed to help users understand, prioritize, and remediate security findings in cloud environments. It acts as a virtual security analyst by providing:

• Natural Language Querying: Ask questions about security findings in plain English (e.g., "What are my highest risk findings?").
• Detailed Remediation Guidance: Provides step-by-step instructions, including command-line or console steps, to fix identified issues.
• Enhanced Context and Analysis: Explains security concepts, provides risk assessments, and connects related findings to identify broader security patterns.

End-to-end (E2E) testing for the Prowler UI is implemented using Playwright. The testing framework follows specific architectural patterns and conventions to ensure stability and maintainability. Key components include:

• Playwright Setup: Configuration for the test runner and browser environments.
• Page Object Model (POM): A design pattern used to represent UI pages as classes, decoupling test logic from UI selectors.
• Authentication States: Pre-configured authentication states (e.g., admin.auth.setup) to avoid repetitive login steps in every test.
• Test Tagging: A convention for identifying specific tests, following the format @PROVIDER-E2E-001.
• Serial Execution: Certain tests require serial execution to prevent state interference.

For the complete implementation guide, refer to docs/developer-guide/end2end-testing.mdx.

Prowler employs a security-by-design approach across the development lifecycle, utilizing automated checks including pre-commit hooks, CI gates, branch protection, container scanning, and registry monitoring. Security controls are organized into six primary domains:

Documentation guides in this repository typically apply to one or more of the following Prowler product families:

• Prowler Cloud
• Prowler Private Cloud
• Prowler Local Server

If a guide contains an AppliesTo component, it specifies which of these products the instructions are intended for. For a complete overview of the product ecosystem, refer to the Prowler product families documentation.

Prowler for Vercel performs security audits across several service domains:

• Authentication: Token expiration and staleness.
• Deployment: Preview deployment access and production stability.
• Domain: DNS configuration, SSL certificates, and wildcard exposure.
• Project: Deployment protection, environment variable security, fork protection, and skew protection.
• Security: WAF, rate limiting, IP blocking, and managed rulesets.
• Team: SSO enforcement, directory sync, member access, and invitation hygiene.