AWS Authentication in Prowler

Prowler requires AWS credentials to function properly. Authentication is available through the following methods:

Required Permissions

To ensure full functionality, attach the following AWS managed policies to the designated user or role:

For certain checks, additional read-only permissions are required. Attach the following custom policy to your role: prowler-additions-policy.json

This method grants permanent access and is the recommended setup for production environments.

Download the Prowler Scan Role Template
Open the AWS Console, search for CloudFormation
Go to Stacks and click “Create stack” > “With new resources (standard)”
In Specify Template, choose “Upload a template file” and select the downloaded file
Click “Next”, provide a stack name and the External ID shown in the Prowler Cloud setup screen !!! info An External ID is required when assuming the ProwlerScan role to comply with AWS confused deputy prevention.
Acknowledge the IAM resource creation warning and proceed
Click “Submit” to deploy the stack