Scanning your cloud account with Prowler: run, read, and prioritize findings

What a posture scanner does

Cloud security posture tools call read-only APIs to compare your configuration against a benchmark such as CIS or a provider best-practice framework. Prowler supports AWS, Azure, Google Cloud, Kubernetes, and Microsoft 365. ScoutSuite and the provider-native tools (AWS Security Hub, Defender for Cloud, Security Command Center) do similar work.

Scanners only read configuration. They do not test exploitability, and a scan is only as complete as the permissions you give it.

Give it read-only access

On AWS, use a dedicated role with the SecurityAudit and ViewOnlyAccess managed policies plus the small additional policy Prowler documents. On Azure, assign Reader plus the Entra directory read permissions it lists. Never run a scanner with administrator keys.

Lab: scan a sandbox account

Install Prowler in a Python virtual environment, assume the read-only role, and run a scan limited to a compliance framework. Prowler writes CSV, JSON-OCSF, and HTML reports to an output directory. Open the HTML report and filter by severity and status FAIL.

python3 -m venv ~/prowler && . ~/prowler/bin/activate
pip install prowler
prowler aws --profile lab-audit --compliance cis_3.0_aws -M html csv
# Azure equivalent, using an az login session:
prowler azure --az-cli-auth

Turning findings into work

Sort by severity, then group by check ID, not resource: one fix such as enabling S3 Block Public Access at the account level can close dozens of findings. Mark accepted risks with a reason in an allowlist file so future scans stay readable, and schedule the scan so you can track the trend.

• First: root and admin MFA, public storage, exposed management ports, disabled logging.
• Then: encryption defaults, key rotation, unused credentials.
• Last: low-severity hygiene and tagging.