Skip to main content
By default Prowler is able to scan the following AWS partitions:
  • Commercial: aws
  • China: aws-cn
  • GovCloud (US): aws-us-gov
To check the available regions for each partition and service, refer to: aws_regions_by_service.json

​
Scanning AWS China and GovCloud Partitions in Prowler

When scanning the China (aws-cn) or GovCloud (aws-us-gov), ensure one of the following:
  • Your AWS credentials include a valid region within the desired partition.
  • Specify the regions to audit within that partition using the -f/--region flag.
Refer to: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html#configuring-credentials for more information about the AWS credential configuration.

​
Scanning Specific Regions

To scan a particular AWS region with Prowler, use: 
prowler aws -f/--region eu-west-1 us-east-1

​
AWS Credentials Configuration

For details on configuring AWS credentials, refer to the following Botocore file.

​
Scanning AWS Partitions in Prowler

​
AWS China

To scan an account in the AWS China partition (aws-cn):
  • By using the -f/--region flag: 
    prowler aws --region cn-north-1 cn-northwest-1
  • By using the region configured in your AWS profile at ~/.aws/credentials or ~/.aws/config: 
    [default]
aws_access_key_id = XXXXXXXXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXXXXXXX
region = cn-north-1
With this configuration, all partition regions will be scanned without needing the -f/--region flag

​
AWS GovCloud (US)

To scan an account in the AWS GovCloud (US) partition (aws-us-gov):
  • By using the -f/--region flag: 
    prowler aws --region us-gov-east-1 us-gov-west-1
  • By using the region configured in your AWS profile at ~/.aws/credentials or ~/.aws/config: 
    [default]
aws_access_key_id = XXXXXXXXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXXXXXXX
region = us-gov-east-1
With this configuration, all partition regions will be scanned without needing the -f/--region flag

​
AWS ISO (US & Europe)

The AWS ISO partitions—commonly referred to as “secret partitions”—are air-gapped from the Internet, and Prowler does not have a built-in way to scan them. To audit an AWS ISO partition, manually update aws_regions_by_service.json to include the partition, region, and services. For example: 
"iam": {
    "regions": {
    "aws": [
        "eu-west-1",
        "us-east-1",
    ],
    "aws-cn": [
        "cn-north-1",
        "cn-northwest-1"
    ],
    "aws-us-gov": [
        "us-gov-east-1",
        "us-gov-west-1"
    ],
    "aws-iso": [
        "aws-iso-global",
        "us-iso-east-1",
        "us-iso-west-1"
    ],
    "aws-iso-b": [
        "aws-iso-b-global",
        "us-isob-east-1"
    ],
    "aws-iso-e": [],
    }
},