Prowler: FAIL is this check, not an incident

The row is a check result

A posture scan prints a status such as FAIL for a check id and a resource. That status means the check’s comparison failed for that resource in this run. It does not say the resource was attacked, and it does not say how an attacker would use it.

PASS on a different check is a different row. Do not average them into one score for the resource unless the report itself printed that score and you cite it as the report’s score.

The scan time bounds the row

The finding is true of the configuration the scanner read at scan time. A fix applied later is a new scan. Do not mark the old FAIL as passed because someone said they clicked a setting.

If the scan time is missing, write “scan time not in the file.”

What to write down

File the check id, the resource id, the status, and the scan time. Grouping several resources that failed the same check is fine if you still list them. Do not replace the check id with a severity word alone.

Lab: one FAIL read as a breach

A lab scan at 2026-11-03T16:00:00Z shows check s3_bucket_public_access, resource lab-logs, status FAIL. A draft says the bucket was breached. No access log was attached.

The note quotes the check, the bucket, FAIL, and the scan time. The row is a configuration comparison. A breach is not in the row. The draft’s incident sentence is removed.

scan time: 2026-11-03T16:00:00Z
check: s3_bucket_public_access
resource: lab-logs
status: FAIL
access log: none attached
write: this check failed for this bucket
not: the bucket was breached