Our take
Activeregular commits and releases- Activity
- 86
- Community
- 94
- Issues
- 47
- Pull requests
- 70
- Releases more often than 89% of the projects we track
- More contributors than 78% of the projects we track
Prowler is a broad, actively maintained cloud security toolkit, suited to teams that can operate its Python CLI or Docker-based server and want checks across multiple cloud environments.
Good fit if
- You need repeatable cloud security checks and compliance mappings across more than one provider or target type.
- You want a Python CLI, GitHub Actions integration, or a self-hosted web interface for scan results.
- You can work with its Apache-2.0 license and, for Local Server, the Docker Compose-based setup.
Look elsewhere if
- You need only a lightweight single-provider check and do not need Prowler's broader checks or framework coverage.
- You cannot meet the CLI's Python requirement or operate Docker and Docker Compose for Local Server.
- Your required cloud provider or workflow is not supported by the available checks and interfaces.
All health signals
| Last commit | 2026-11-09 (today) |
|---|---|
| Commits, last 90 days | 100+ |
| Releases, last 12 months | 66 (latest 5.48.0, 2026-11-06) |
| Contributors | 100+ (top contributor: 11% of commits) |
| Issues closed, last 90 days | 1+ |
| Pull requests merged, last 90 days | 30 (typically merged in 0 days) |
| Project age | 10 years |
Checked on 2026-11-09 with the GitHub API.
Overview
Prowler is a Python-based open cloud security platform for automating security and compliance assessments across cloud environments. It offers a CLI and a self-hosted Local Server, with the project also describing Prowler Cloud as a hosted option. Its checks and compliance frameworks help security teams find misconfigurations, prioritize risk, and assess cloud environments against standards.
The CLI supports a broad set of cloud providers and related targets, while Local Server adds a web interface for running scans and viewing findings. The project is aimed at teams that want repeatable assessments and actionable security results rather than a manually assembled audit process.
Key Features
- Run security checks from the command line with
prowler <provider>. - Assess cloud accounts and related targets, including AWS, Azure, GCP, Kubernetes, GitHub, and others.
- Map findings to built-in compliance frameworks such as CIS, NIST, PCI-DSS, GDPR, and ISO 27001.
- Use Prowler Local Server for a web interface to execute scans and visualize results.
- Run scans in GitHub Actions, with options for SARIF output and sending findings to Prowler Cloud.
- Extend AWS scan results with Attack Paths graphs using Neo4j by default, or Amazon Neptune.
- Install the CLI through PyPI or use container images; deploy Local Server with Docker Compose.
Use Cases
- Cloud security teams can regularly check accounts for misconfigurations and prioritize findings using Prowler ThreatScore.
- Compliance teams can use framework mappings to assess cloud environments against relevant standards and regulations.
- Developers can run infrastructure-as-code checks in pull request workflows and publish findings as SARIF.
- Organizations seeking a shared scan interface can deploy Local Server to review results across provider accounts.
What you need
Detected in the repository
- Python >=3.10,<3.14 (from pyproject.toml)
- A Dockerfile, so it can run in a container; a Compose file sets up the related services
- A test suite and automated checks on GitHub Actions
License in plain words
Apache-2.0permissive
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the license, the NOTICE file and a note of your changes
- Share your changes: no
- Includes an explicit patent grant from the contributors:
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
Install the CLI with Python 3.10 or later, below 3.13, then run a provider scan:
pip install prowler
prowler aws
See the README and Prowler documentation for provider authentication, supported checks, Local Server installation, and other options.
Alternatives
- ScoutSuite: ScoutSuite assesses cloud accounts through provider APIs and presents findings in an HTML report, while Prowler also offers a self-hosted server and framework mapping.
| Project | Language | License | Stars | Status |
|---|---|---|---|---|
| prowler | Python | Apache-2.0 | 15.2k | Active |
| ScoutSuite | Python | GPL-2.0 | 7.9k | Inactive |
Considerations
- The CLI README specifies Python >=3.10 and <3.13, while the repository's project metadata lists >=3.10 and <3.14. Check the release and installation instructions for the version you plan to use.
- Local Server is more involved than the CLI: Docker Compose is required, and the documented stack includes an API, worker, scheduler, database, and other services. Review its configuration and credential handling before deploying it.
- The published check and framework counts are periodically updated, so confirm current coverage in Prowler Hub before relying on a particular control.
- The health data indicates active development, frequent releases, and a contributor base that is not concentrated in one person. It also reports limited recent issue closure data, so do not infer responsiveness from commit and release activity alone.
Found this useful?
Share it with someone who would like prowler.