Skip to main content
Prowler’s Infrastructure as Code (IaC) provider enables you to scan local or remote infrastructure code for security and compliance issues using Trivy. This provider supports a wide range of IaC frameworks and requires no cloud authentication for local scans.

​
Authentication

​
Private Repository Hosts

Prowler CLI scans a repository on an internal network with no extra configuration. On the CLI the operator supplies the repository URL themselves, so there is nothing to defend against and the check below does not apply. Prowler App rejects a repository URL that resolves to a non-public address, as an SSRF defense. There the URL arrives from a tenant and the worker must not be used to reach the internal network it runs in. The check covers both the connection test and the scan clone. To scan a self-hosted GitLab, Gitea or Bitbucket from Prowler App, declare the trusted ranges:
The value is a comma-separated list of IPs and CIDRs. A resolved address inside an allowlisted range is permitted; every other non-public address stays blocked, so link-local (169.254.169.254), loopback and the rest of the internal network remain protected. Malformed entries are rejected, and a non-empty allowlist is logged as a relaxed security control. The scan runs in the worker, not the API, so the variable has to reach the worker:
  • Docker Compose: set it in the root .env; it reaches the worker through the shared environment file.
  • Helm: add it under api.djangoConfig, which is rendered into the API ConfigMap that the worker inherits through envFrom.
Setting it only on the API container has no effect. The same variable applies to the Kubernetes and OpenStack providers. The Image provider has its own, PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS.