Skip to main content
Now available on AWS Marketplace. Install Prowler Private Cloud in your own AWS account and pay on your AWS bill, with three plans: Pay as You Go, 10-Account Bundle and 25-Account Bundle. Choose a plan.
Prowler Private Cloud is the full Prowler platform, installed in the customer’s own AWS account from AWS Marketplace and billed on the AWS bill. Findings, resource data and Lighthouse AI prompts stay in that account and Region.
For AWS GovCloud (US), an air-gapped environment, an on-premises data center, or a different bundle size or contract term, contact us for a private offer.

​
Choose a Plan

Each plan is its own AWS Marketplace listing. All three install the same product and differ only in how many cloud accounts the price covers:
  • Paid accounts: AWS accounts, Azure subscriptions and Microsoft 365 tenants.
  • Other accounts: everything else Prowler scans, such as Google Cloud projects, Kubernetes clusters, GitHub and Okta.

​
Example: Pay as You Go

A month with 4 AWS accounts and 6 Google Cloud projects scanned:

​
Infrastructure Cost

AWS bills the infrastructure the installation runs on separately, at AWS prices. With the default size in us-east-1, it costs about 360 USD a month before scans. Scans add to that: each scan runs as its own task at about 0.12 USD for every hour it runs, and the database grows while scans run. A scan of one AWS account usually takes:
  • Up to 2,000 resources: about 10 minutes.
  • 2,000 to 10,000 resources: about 25 minutes.
  • Over 10,000 resources: about an hour.
For example, 10 AWS accounts scanned once a day, at about 20 minutes each: Other Regions cost more than us-east-1. Amazon Bedrock is billed per use, only when Lighthouse AI is on.
These figures are estimates based on AWS public list prices. AWS bills the infrastructure directly to your account, and the final amount depends on your Region, usage and any discounts you have with AWS. Prowler does not set or charge these costs.
About 360 USD a month for the default size in us-east-1, at AWS list prices, before scans:

​
How It Works

The installation runs in the customer’s AWS account, in the chosen Region. Users reach it through an Amazon CloudFront address, or a custom domain. Everything else runs in private subnets that cannot be reached from the internet. Scans use read-only access to the connected cloud accounts, and Prowler has no access to the installation.
Prowler Private Cloud on AWS: users reach Amazon CloudFront, which connects to an internal load balancer in a private network; the Prowler services run on Amazon ECS, with Amazon Aurora and Amazon ElastiCache for data and other AWS services in the same account; scans reach the connected accounts with read-only accessProwler Private Cloud on AWS: users reach Amazon CloudFront, which connects to an internal load balancer in a private network; the Prowler services run on Amazon ECS, with Amazon Aurora and Amazon ElastiCache for data and other AWS services in the same account; scans reach the connected accounts with read-only access

​
Install Prowler Private Cloud

1

Subscribe on AWS Marketplace

Open the plan’s listing on AWS Marketplace (links in Choose a Plan), click View purchase options, and subscribe. Then continue to the configuration and to launch. The launch page has a link that opens the AWS CloudFormation console with the Prowler template already loaded.
2

Choose a Supported Region

Before creating the stack, switch the console to a supported Region at the top right. The template refuses the others.
3

Fill In the Required Section

Enter:
  • Admin password: the password for the built-in account admin@prowler.local.
  • Notification email: the address that receives update, alarm and subscription notices.
  • Lighthouse AI: whether to turn it on. Leave it off in the Regions where it is not available.
  • Portal access: who can open the portal, from anywhere or only from an IP range.
Leave the optional fields and the version as they are, acknowledge the Identity and Access Management (IAM) capabilities, and create the stack. The installation takes about 35 minutes.
4

Confirm the Notification Email

AWS sends a subscription confirmation to the notification address. Confirm it: without it, no update, alarm or subscription notices arrive.
5

Sign In

Open the address in the stack’s Outputs tab (UiUrl), an Amazon CloudFront address until a custom domain is set up, and sign in as admin@prowler.local with the admin password set in step 3. The AWS account Prowler is installed in is already connected: start its first scan from Scans, and invite the team from Users.
6

Add Cloud Accounts

From Cloud Providers in the portal, add single AWS accounts, a whole AWS Organization, or other providers.

​
How Billing Works

  • Monthly count: each cloud account Prowler scans in a calendar month (UTC) counts once that month, however many scans it has.
  • AWS bill: the subscription appears on the AWS bill, line by line, including the accounts the plan includes at 0.00 USD.
  • Monthly statement: at the start of each month, the installation emails last month’s usage.
If the subscription ends, Prowler keeps working for 7 days and a daily email counts the days down. After that, new scans and premium features pause, but findings, history and reports stay. Subscribing again resumes everything within the hour.

​
Updates and Settings

New Prowler releases install automatically every night. Settings chosen at launch can be changed later with a stack update:
Without a custom domain, Prowler runs on its Amazon CloudFront address.
  1. Choose a subdomain that starts with prowler, such as prowler.example.com.
  2. Request an AWS Certificate Manager certificate for cloud.prowler.example.com, api.cloud.prowler.example.com and mcp.prowler.example.com in us-east-1. Request a second one in the installation’s Region, unless the domain is an Amazon Route 53 hosted zone in the same account.
  3. Open the AWS CloudFormation console in the installation’s Region, go to Stacks, select the Prowler stack, and click Update, then Make a direct update.
  4. Choose Use existing template and click Next.
  5. Fill in the Your own domain fields with the domain and the certificates, and leave every other parameter as it is. Click Next until the review page.
  6. Acknowledge the IAM capabilities and click Submit.
To turn Lighthouse AI on:
  1. Open the AWS CloudFormation console in the installation’s Region, go to Stacks, select the Prowler stack, and click Update, then Make a direct update.
  2. Choose Use existing template and click Next.
  3. Set Lighthouse AI to Enabled, and leave every other parameter as it is. Click Next until the review page.
  4. Acknowledge the IAM capabilities and click Submit. Lighthouse AI is ready within minutes and needs no keys.
To turn it off, delete its provider in the portal’s Lighthouse AI settings.

​
Uninstall

Contact support@prowler.com for the uninstall steps: the installation protects its data against accidental deletion, so deleting the stack on its own stops partway. Uninstalling does not cancel the subscription; cancel it in the AWS Marketplace console, under Manage subscriptions.

​
Get Support

Write to support@prowler.com, with the AWS account ID, the Region and the stack name.