Lion Cipher Lab
Audit your AWS account's security posture with Prowler, part 2: from a scan to an audit
- Cloud Security
- Intermediate
- ~60 min
- Free · no account required
Why it matters
A first scan tells you what is wrong. An audit has to say more: measured against which standard, over which accounts, regions and services, which failures are accepted and by whom, and who will fix the rest by when. Without those answers a Prowler report is a long list that nobody owns, and the easy way to make it shorter, switching checks off, blinds everyone who reads it next. This part covers the Prowler features that answer the first three questions: scoping, compliance frameworks and the mutelist. It also covers the outputs different readers need, and the register that answers the…
What you'll learn
- scoping a Prowler scan by region and service
- listing and running a compliance framework such as the CIS AWS Foundations Benchmark
- muting accepted risk with a Prowler mutelist
- choosing CSV, JSON-OCSF and HTML outputs for different readers
- assuming a role to audit another account
- turning findings into a ranked remediation register with owners
Steps in this lab
- What an audit asks that a scan does not
- Reuse Part 1's read-only profile, and scope before you scan
- Measure against a framework: list it, then scan to it
- Mute accepted risk; never switch the check off
- Write the outputs for the people who will read them
- Turn the findings into a ranked register
- Where Prowler stops, and what to pair it with