# prowler: Automate Cloud Security and Compliance

This repository profile is provided by osrepos.com, an open source repository discovery platform.

Source: osrepos.com
Repository profile: https://osrepos.com/repo/prowler-cloud-prowler
Generated for open source discovery and AI-assisted research.

Prowler is a Python-based open cloud security platform for automated security and compliance assessments across cloud environments. Use its CLI or self-hosted Local Server to run checks, review findings, and map results to established frameworks.

GitHub: https://github.com/prowler-cloud/prowler
OSRepos URL: https://osrepos.com/repo/prowler-cloud-prowler

## Summary

Prowler is a Python-based open cloud security platform for automated security and compliance assessments across cloud environments. Use its CLI or self-hosted Local Server to run checks, review findings, and map results to established frameworks.

## Topics

- python
- security
- cli
- cloud-security
- cloud-compliance
- security-audit
- cspm

## Repository Information

Last analyzed by OSRepos: Mon Nov 09 2026 19:19:26 GMT+0000 (Western European Standard Time)
Detail views: 4
GitHub clicks: 1

## Safety Notice

OSRepos shares public repositories for knowledge and discovery only. Review source code, dependencies, licenses, and security implications before running or installing anything.

## Content

## Overview

Prowler is a Python-based open cloud security platform for automating security and compliance assessments across cloud environments. It offers a CLI and a self-hosted Local Server, with the project also describing Prowler Cloud as a hosted option. Its checks and compliance frameworks help security teams find misconfigurations, prioritize risk, and assess cloud environments against standards.

The CLI supports a broad set of cloud providers and related targets, while Local Server adds a web interface for running scans and viewing findings. The project is aimed at teams that want repeatable assessments and actionable security results rather than a manually assembled audit process.

## Key Features

- Run security checks from the command line with `prowler <provider>`.
- Assess cloud accounts and related targets, including AWS, Azure, GCP, Kubernetes, GitHub, and others.
- Map findings to built-in compliance frameworks such as CIS, NIST, PCI-DSS, GDPR, and ISO 27001.
- Use Prowler Local Server for a web interface to execute scans and visualize results.
- Run scans in GitHub Actions, with options for SARIF output and sending findings to Prowler Cloud.
- Extend AWS scan results with Attack Paths graphs using Neo4j by default, or Amazon Neptune.
- Install the CLI through PyPI or use container images; deploy Local Server with Docker Compose.

## Use Cases

- Cloud security teams can regularly check accounts for misconfigurations and prioritize findings using Prowler ThreatScore.
- Compliance teams can use framework mappings to assess cloud environments against relevant standards and regulations.
- Developers can run infrastructure-as-code checks in pull request workflows and publish findings as SARIF.
- Organizations seeking a shared scan interface can deploy Local Server to review results across provider accounts.

## Our Take
Prowler is a broad, actively maintained cloud security toolkit, suited to teams that can operate its Python CLI or Docker-based server and want checks across multiple cloud environments.

**Good fit if:**
- You need repeatable cloud security checks and compliance mappings across more than one provider or target type.
- You want a Python CLI, GitHub Actions integration, or a self-hosted web interface for scan results.
- You can work with its Apache-2.0 license and, for Local Server, the Docker Compose-based setup.

**Look elsewhere if:**
- You need only a lightweight single-provider check and do not need Prowler's broader checks or framework coverage.
- You cannot meet the CLI's Python requirement or operate Docker and Docker Compose for Local Server.
- Your required cloud provider or workflow is not supported by the available checks and interfaces.

## Project Health

| Signal | Value |
|---|---|
| Status | **Active**: regular commits and releases |
| Last commit | 2026-11-09 (today) |
| Commits, last 90 days | 100+ |
| Releases, last 12 months | 66 (latest 5.48.0, 2026-11-06) |
| Contributors | 100+ (top contributor: 11% of commits) |
| Issues closed, last 90 days | 1+ |
| Pull requests merged, last 90 days | 30 (typically merged in 0 days) |
| Project age | 10 years |

Checked on 2026-11-09 with the GitHub API.

## Project Facts

- Language: Python
- License: Apache-2.0
- Stars: 15.2k
- Forks: 2.5k
- Topics: aws, azure, cis-benchmark, cloud, cloudsecurity, compliance, cspm, devsecops
- Website: https://prowler.com
- Archived: no

## What You Need

Detected in the repository:

- Python >=3.10,<3.14 (from pyproject.toml)
- A Dockerfile, so it can run in a container; a Compose file sets up the related services
- A test suite and automated checks on GitHub Actions

## Getting Started

Install the CLI with Python 3.10 or later, below 3.13, then run a provider scan:

```console
pip install prowler
prowler aws
```

See the [README](https://github.com/prowler-cloud/prowler) and [Prowler documentation](https://docs.prowler.com/) for provider authentication, supported checks, Local Server installation, and other options.

## License in Plain Words

**Apache-2.0** (permissive).

- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the license, the NOTICE file and a note of your changes
- Share your changes: no
- Includes an explicit patent grant from the contributors

A summary, not legal advice: the LICENSE file is what applies.

## Alternatives

- [ScoutSuite](https://osrepos.com/repo/nccgroup-scoutsuite): ScoutSuite assesses cloud accounts through provider APIs and presents findings in an HTML report, while Prowler also offers a self-hosted server and framework mapping.

| Project | Language | License | Stars | Status |
|---|---|---|---|---|
| **prowler** | Python | Apache-2.0 | 15.2k | Active |
| [ScoutSuite](https://osrepos.com/repo/nccgroup-scoutsuite) | Python | GPL-2.0 | 7.9k | Inactive |

## Considerations

- The CLI README specifies Python >=3.10 and <3.13, while the repository's project metadata lists >=3.10 and <3.14. Check the release and installation instructions for the version you plan to use.
- Local Server is more involved than the CLI: Docker Compose is required, and the documented stack includes an API, worker, scheduler, database, and other services. Review its configuration and credential handling before deploying it.
- The published check and framework counts are periodically updated, so confirm current coverage in Prowler Hub before relying on a particular control.
- The health data indicates active development, frequent releases, and a contributor base that is not concentrated in one person. It also reports limited recent issue closure data, so do not infer responsiveness from commit and release activity alone.