Security as Code: Hardening Your Cloud Infrastructure with Prowler and Python

prowler-cloud/prowler

Here is a breakdown of why it’s a game-changer and how you can get started.

As engineers, we want to move fast without breaking things—especially security. Prowler helps us achieve "Security as Code" by

Automated Auditing
It checks your infrastructure against over 250 controls (CIS Benchmark, PCI-DSS, ISO27001, etc.) automatically.

Visibility
It finds that one S3 bucket you accidentally left public or that IAM user with way too many permissions.

Multi-Cloud Support
While it started with AWS, it now supports Azure, GCP, and Kubernetes.

Developer-Friendly Output
It generates reports in HTML, CSV, and JSON (perfect for piping into other tools or custom dashboards).

The easiest way to run Prowler is via pip. Ensure you have your AWS credentials configured (via aws configure or environment variables) before running it.

pip install prowler
prowler -v

To run a general scan on your default AWS profile

prowler aws

If you only want to check your S3 buckets and IAM settings

prowler aws --service s3 iam

Since Prowler is written in Python, it fits perfectly into automated workflows. Here’s a conceptual example of how you might trigger a Prowler scan within a Python script to check for "Fail" results.

import subprocess
import json

def run_security_scan():
    print(" Starting Prowler Security Scan...")
    
    # Run Prowler and export results to JSON
    # We use 'quiet' mode to keep the logs clean
    command = "prowler aws --service s3 --output-formats json --quiet"
    
    try:
        subprocess.run(command, shell=True, check=True)
        
        # In a real scenario, you'd find the latest file in the output folder
        # For this example, let's assume we're parsing a known output file
        with open('output/prowler-output.json', 'r') as f:
            results = json.load(f)
            
        # Filter for critical failures
        critical_issues = [res for res in results if res['Status'] == 'FAIL' and res['Severity'] == 'critical']
        
        if critical_issues:
            print(f" Found {len(critical_issues)} critical security issues!")
            for issue in critical_issues:
                print(f"- {issue['CheckTitle']}: {issue['ResourceID']}")
        else:
            print(" No critical issues found. Great job!")
            
    except Exception as e:
        print(f" Scan failed: {e}")

if __name__ == "__main__":
    run_security_scan()

Use the Dashboard
Prowler can generate a beautiful HTML report (--output-formats html). It’s much easier to show this to your manager than a wall of text!

Integrate with AWS Security Hub
You can send Prowler findings directly to AWS Security Hub using the -S flag. This centralizes all your security alerts in one place.

CI/CD Gates
Set up a GitHub Action or GitLab CI job that runs Prowler on every pull request. If the scan finds a "Critical" failure, you can block the merge to prevent insecure infrastructure from reaching production.

Prowler takes the guesswork out of cloud security. Instead of manually clicking through the AWS Console, you get a repeatable, code-driven way to ensure your cloud is hardened.