{"id":13819618,"url":"https://github.com/unchartedsky/prowler","last_synced_at":"2026-02-11T02:50:06.307Z","repository":{"id":144250633,"uuid":"138964583","full_name":"unchartedsky/prowler","owner":"unchartedsky","description":"Docker image for toniblyx/prowler","archived":false,"fork":false,"pushed_at":"2021-02-11T09:37:40.000Z","size":7,"stargazers_count":13,"open_issues_count":0,"forks_count":2,"subscribers_count":6,"default_branch":"master","last_synced_at":"2024-11-19T19:43:06.412Z","etag":null,"topics":["docker","security","unchartedsky"],"latest_commit_sha":null,"homepage":null,"language":"Dockerfile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/unchartedsky.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2018-06-28T04:05:09.000Z","updated_at":"2023-03-31T08:45:30.000Z","dependencies_parsed_at":"2024-01-13T15:39:37.754Z","dependency_job_id":"817c7e14-eed6-44dd-8827-66701a82797f","html_url":"https://github.com/unchartedsky/prowler","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/unchartedsky%2Fprowler","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/unchartedsky%2Fprowler/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/unchartedsky%2Fprowler/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/unchartedsky%2Fprowler/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/unchartedsky","download_url":"https://codeload.github.com/unchartedsky/prowler/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254488247,"owners_count":22079387,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","security","unchartedsky"],"created_at":"2024-08-04T08:00:50.895Z","updated_at":"2026-02-11T02:50:06.253Z","avatar_url":"https://github.com/unchartedsky.png","language":"Dockerfile","funding_links":[],"categories":["Dockerfile"],"sub_categories":[],"readme":"[![Docker Stars](https://img.shields.io/docker/stars/_/ubuntu.svg)](https://hub.docker.com/r/unchartedsky/prowler/)\n\n# Prowler on Kubernetes example\n\n[toniblyx/prowler](https://github.com/toniblyx/prowler) is:\n\n\u003e Tool based on AWS-CLI commands for AWS account security assessment and hardening, following guidelines of the [CIS Amazon Web Services Foundations Benchmark 1.1](https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf)\n\u003e \n\u003e ![](https://cloud.githubusercontent.com/assets/3985464/18489640/50fe6824-79cc-11e6-8a9c-e788b88a8a6b.png)\n\nThe motivation is that we want to get Prowler reports on regular basis without human effort. So I made it.\n\n## Step by step\n\nFirst, create IAM role `Prowler`:\n\n``` bash\naws iam create-role --role-name Prowler --assume-role-policy-document file://policy/prowler-trustpolicy.json\naws iam put-role-policy --role-name Prowler --policy-name Prowler --policy-document file://policy/prowler-policy.json\naws iam attach-role-policy --role-name Prowler --policy-arn arn:aws:iam::aws:policy/SecurityAudit\n```\n\nNow you are ready to run the cron job onto K8s cluster. With this example, you will get PDF report files through Slack channel every Sunday:\n\n``` yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: prowler-config\ndata:    \n  .slackcat: |\n    default_team = \"TheTeam\"\n    default_channel = \"YOUR_DEFAULT_SLACK_CHANNEL\"\n\n    [teams]\n      TheTeam = \"YOUR_SLACK_TOKEN\"\n\n  run.sh: |\n    #!/bin/bash -ex\n    FILENAME_SUFFIX=\"$(date -I)\"\n\n    mkdir -p \"${RESULT_DIR}\"\n    ./prowler | tee \"${RESULT_DIR}/report-${FILENAME_SUFFIX}.txt\" | ansi2html -la | tee \"${RESULT_DIR}/report-${FILENAME_SUFFIX}.html\"\n    cp -f \"${RESULT_DIR}/report-${FILENAME_SUFFIX}.txt\" \"${RESULT_DIR}/report-last.txt\"\n    cp -f \"${RESULT_DIR}/report-${FILENAME_SUFFIX}.html\" \"${RESULT_DIR}/report-last.html\"\n    xvfb-run /usr/bin/wkhtmltopdf \"${RESULT_DIR}/report-${FILENAME_SUFFIX}.html\" \"${RESULT_DIR}/report-${FILENAME_SUFFIX}.pdf\"\n    slackcat \"${RESULT_DIR}/report-${FILENAME_SUFFIX}.txt\"\n    slackcat \"${RESULT_DIR}/report-${FILENAME_SUFFIX}.pdf\"\n\n---\n\napiVersion: batch/v1beta1\nkind: CronJob\nmetadata:\n  name: prowler\n  labels:\n    app: prowler\nspec:\n  # See https://crontab.guru/#0_3_*_*_0\n  schedule: \"0 3 * * 0\"\n  jobTemplate:\n    spec:\n      template:\n        metadata:\n          annotations:\n            iam.amazonaws.com/role: arn:aws:iam::1234567890:role/Prowler\n          labels:\n            app: prowler\n        spec:\n          containers:\n          - name: prowler\n            image: unchartedsky/prowler:latest\n            command:\n            - ./run.sh\n            env:\n            - name: RESULT_DIR\n              value: /tmp/result\n            resources:\n              requests:\n                cpu: \"4000m\"\n                memory: 4000Mi\n              limits:\n                cpu: \"4000m\"\n                memory: 4000Mi\n            volumeMounts:\n            - name: conf-d\n              mountPath: /root/.slackcat\n              subPath: .slackcat\n              readOnly: true\n            - name: script-d\n              mountPath: /prowler/run.sh\n              subPath: run.sh\n              readOnly: true\n          volumes:\n          - name: conf-d\n            projected:\n              sources:\n              - configMap:\n                  name: prowler-config\n                  items:\n                  - key: .slackcat\n                    path: .slackcat\n          - name: script-d\n            projected:\n              defaultMode: 500\n              sources:\n              - configMap:\n                  name: prowler-config\n                  items:\n                  - key: run.sh\n                    path: run.sh\n          restartPolicy: Never\n  successfulJobsHistoryLimit: 10\n  failedJobsHistoryLimit: 10 \n```\n\n## Thanks to \n\n- [ralphbean/ansi2html](https://github.com/ralphbean/ansi2html) convert text with ansi color codes to HTML.\n- [wkhtmltopdf](https://wkhtmltopdf.org/) is open source (LGPLv3) command line tools to render HTML into PDF and various image formats using the Qt WebKit rendering engine.\n- [bcicen/slackcat](https://github.com/bcicen) is a CLI utility to post files and command output to slack.\n- [ jtblin/kube2iam](https://github.com/jtblin) provides different AWS IAM roles for pods running on Kubernetes \n\n## TODO\n\n- [ ] Generate the diff between a previous report and a new one using [JoshData/pdf-diff](https://github.com/JoshData/pdf-diff).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Funchartedsky%2Fprowler","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Funchartedsky%2Fprowler","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Funchartedsky%2Fprowler/lists"}