Which of my cloud accounts fail a compliance benchmark like CIS or DORA before an auditor finds out?

runs the mapped checks against the live environment and reports each control as pass or fail, tied back to the specific framework requirement it maps to

Are my SaaS tenants and identity providers configured as securely as my cloud infrastructure?

runs the same kind of check-based audit against M365, Google Workspace, Okta, and GitHub, naming the setting that fails and the service it belongs to

Which container images or Kubernetes clusters are running with settings that violate basic hardening rules?

inspects image layers and cluster resources for issues like missing resource limits, floating image tags, or disabled probes and reports each violation by resource

Have I already fixed the misconfiguration a new check was written for?

scores every existing account, project, or tenant against newly added checks the next time a scan runs, so a resolved issue shows as passing and an unresolved one shows up immediately

Is one cloud account or subscription drifting from the security posture of the others?

scans every configured provider account under one run and reports results per account, so an outlier fails checks the rest pass

Can I show an auditor evidence for a specific regulation instead of a generic security score?

groups findings under the named framework's own control numbers, so results can be handed over mapped to CIS, DORA, or DISA STIG language instead of the tool's own labels

Prowler release history — The Cyber Toolchain

5.47.0 Oct 29, 2026 · issue 125

Prowler adds Azure Application Gateway WAF/HTTP2 checks, subscription owner verification, and MCP tool intent annotations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 5.47.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.47.0

Prowler adds network_application_gateway_waf_enabled and network_application_gateway_http2_enabled checks for Azure Application Gateways and their WAF policies, mapped to CIS 5.0 and 6.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Prowler adds iam_subscription_owners_between_2_and_3 check for Azure to verify each subscription has between two and three principals with the Owner role, including owners inherited from management groups, mapped to CIS 5.0 and 6.0.
Prowler's MCP Server now annotates every tool with readOnlyHint and destructiveHint so MCP clients can distinguish read-only listing calls from writes; mute rule and mutelist writes are marked destructive.
Prowler's Issues list now leads with the verdict, shows the attack path under each title, and adds a Why column with five evidence legs; the menu entry is renamed to Exploitability issues.
Prowler's add-provider wizard now connects every provider — AWS, Azure, GCP, Microsoft 365, GitHub, Alibaba Cloud, and Cloudflare — in one step, with teammate invitations available for all providers and Lighthouse AI assistance beside the wizard.

+1 more show less

Prowler's AWS security group internet exposure checks now treat CIDRs in a single ingress rule that together cover 0.0.0.0/0 or ::/0 (such as 0.0.0.0/1 plus 128.0.0.0/1) as open to the internet.

Prowler adds network_application_gateway_waf_enabled and network_application_gateway_http2_enabled checks for Azure Application Gateways and their WAF policies, mapped to CIS 5.0 and 6.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Prowler adds iam_subscription_owners_between_2_and_3 check for Azure to verify each subscription has between two and three principals with the Owner role, including owners inherited from management groups, mapped to CIS 5.0 and 6.0.
Prowler's MCP Server now annotates every tool with readOnlyHint and destructiveHint so MCP clients can distinguish read-only listing calls from writes; mute rule and mutelist writes are marked destructive.

3 more in Everything

5.46.0 Oct 26, 2026 · issue 122

Prowler 5.46.0 adds an Issues page, GCP Vertex AI Workbench checks, new AWS Bedrock/Cognito/WAFv2 checks, PHP runtime coverage, and edition-aware Google Workspace findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 5.46.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.46.0

└──▷ TRY IT

Run only the new Vertex AI Workbench checks against a GCP project to identify publicly reachable or over-privileged notebook instances.

$ prowler gcp --checks vertexai_workbench_instance_public_ip_disabled vertexai_workbench_instance_root_access_disabled vertexai_workbench_instance_terminal_access_disabled vertexai_workbench_instance_file_download_disabled vertexai_workbench_instance_auto_upgrade_enabled

Scope findings metadata API calls to only the provider groups the caller role can see, confirming the new per-role scoping is in effect.

$ curl -s -H 'Authorization: Bearer <token>' 'https://<prowler-api>/api/v1/resources/metadata/latest'

Run the new WAFv2 and Bedrock checks together to audit whether Web ACLs and Bedrock guardrails meet baseline security requirements.

$ prowler aws --checks wafv2_webacl_managed_rule_groups_enabled bedrock_guardrail_sensitive_information_filter_enforced bedrock_model_invocation_logging_text_data_enabled bedrock_api_key_no_long_term_credentials

Adds bedrock_guardrail_sensitive_information_filter_enforced, which flags Bedrock guardrails whose PII entities or custom regexes take no action on the output path, and bedrock_model_invocation_logging_text_data_enabled, which verifies that model invocation logging delivers prompt and response text instead of only naming a destination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds cognito_user_pool_account_recovery_sms_not_preferred check, which verifies that Cognito user pools do not rank SMS first for account recovery.
Adds wafv2_webacl_managed_rule_groups_enabled check, which verifies that WAFv2 Web ACLs reference at least one managed rule group.
Adds a new GCP vertexai service with five Workbench checks — vertexai_workbench_instance_public_ip_disabled, vertexai_workbench_instance_root_access_disabled, vertexai_workbench_instance_terminal_access_disabled, vertexai_workbench_instance_file_download_disabled, and vertexai_workbench_instance_auto_upgrade_enabled — mapped to PCI DSS 4.0 and CCC MLDE requirements.
Adds new PHP version checks across platforms: a new GCP appengine service with the appengine_version_php_runtime_supported check flagging App Engine serving versions on PHP runtimes without security fixes, the elasticbeanstalk_environment_php_platform_updated check flagging Elastic Beanstalk PHP environments on branches without security fixes or outdated platform versions, and the lightsail_instance_php_blueprint_updated check flagging Lightsail instances created from PHP blueprints for manual verification of the PHP release.

+5 more show less

Improves Azure App Service runtime checks: raises the default php_latest_version for app_ensure_php_version_is_latest from 8.2 to 8.5 in both the SDK and the Prowler App scan configuration template, and makes app_ensure_php_version_is_latest, app_ensure_python_version_is_latest, and app_ensure_java_version_is_latest pass any runtime at or above the configured minimum instead of failing every version newer than the configured one.
Adds an Issues page and overview cards in Prowler Cloud, grouping scan findings into issues with verdicts, verdict filters, accessible issue details, and scoped finding evidence.
Improves Google Workspace checks and findings: findings now state when a feature is not available on the tenant edition (e.g. Drive DLP rules, session control, shared drive sharing on Business Starter), requiring the optional apps.licensing scope, and checks now pass with the reason stated when an app is turned off for everyone and no organizational unit or group re-enables it.
Improves bedrock_api_key_no_long_term_credentials to report Bedrock long-term API keys that never expire (keys created without an expiration period were previously skipped and produced no finding).
Restricts GET /resources/metadata, GET /resources/metadata/latest, GET /findings/metadata, and GET /findings/metadata/latest to honour the provider groups of the caller role instead of aggregating every provider in the tenant.

Adds bedrock_guardrail_sensitive_information_filter_enforced, which flags Bedrock guardrails whose PII entities or custom regexes take no action on the output path, and bedrock_model_invocation_logging_text_data_enabled, which verifies that model invocation logging delivers prompt and response text instead of only naming a destination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds cognito_user_pool_account_recovery_sms_not_preferred check, which verifies that Cognito user pools do not rank SMS first for account recovery.
Adds wafv2_webacl_managed_rule_groups_enabled check, which verifies that WAFv2 Web ACLs reference at least one managed rule group.
Adds a new GCP vertexai service with five Workbench checks — vertexai_workbench_instance_public_ip_disabled, vertexai_workbench_instance_root_access_disabled, vertexai_workbench_instance_terminal_access_disabled, vertexai_workbench_instance_file_download_disabled, and vertexai_workbench_instance_auto_upgrade_enabled — mapped to PCI DSS 4.0 and CCC MLDE requirements.
Adds new PHP version checks across platforms: a new GCP appengine service with the appengine_version_php_runtime_supported check flagging App Engine serving versions on PHP runtimes without security fixes, the elasticbeanstalk_environment_php_platform_updated check flagging Elastic Beanstalk PHP environments on branches without security fixes or outdated platform versions, and the lightsail_instance_php_blueprint_updated check flagging Lightsail instances created from PHP blueprints for manual verification of the PHP release.

+1 more show less

Adds an Issues page and overview cards in Prowler Cloud, grouping scan findings into issues with verdicts, verdict filters, accessible issue details, and scoped finding evidence.

4 more in Everything

docs update Oct 8, 2026 · issue 097

Prowler MCP Server adds namespaced tool groups for cloud scan scheduling, findings triage, Jira integration, and alert rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds prowler_cloud_* tools (Cloud MCP Server only) for Alerts, Findings Triage, Scan Scheduling, and Scan Configurations — capabilities not available in the Local MCP Server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Scan Configurations management via prowler_cloud_*: create reusable check and compliance selections and attach them to providers.
Adds Findings Triage via prowler_cloud_*: record review statuses and notes for individual findings without suppressing them.
Adds Scan Scheduling via prowler_cloud_*: configure daily, interval, weekly, or monthly recurring scans one provider at a time or in bulk.
Adds Alerts management via prowler_cloud_*: build and dry-run alert rule conditions, manage email recipients, and review fired alerts.

+3 more show less

Adds Integrations Management tools for setting up and troubleshooting where Prowler sends results (Amazon S3, AWS Security Hub, Jira) and turning findings into Jira work items.
Adds User & Role Management tools: list tenant users, identify the authenticated user, browse RBAC roles, and set a user's role.
Exposes prowler_*, prowler_hub_*, and prowler_docs_* tool namespaces shared across both Local and Cloud MCP Servers.

8 details in Everything

docs update Sep 29, 2026 · issue 089

Prowler: Adds DELETE /api/v1/tasks/{id} permission check requiring the permission of the operation that queued the task, and GET /api/v1/tasks now hides tasks of providers outside the role's visibility.

└──▷ TRY IT

Immediately re-check up to 10 specific resources after a fix, without waiting for the next full scan.

$ curl -X POST https://<prowler-host>/api/v1/scans \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"resource_uids": ["arn:aws:s3:::my-bucket", "arn:aws:ec2:us-east-1:123456789012:instance/i-0abc123"]}'

List only partial scans to review re-check history separately from full scans.

$ curl -X GET 'https://<prowler-host>/api/v1/scans?filter[is_partial]=true' \
  -H 'Authorization: Bearer <token>'

Point Prowler self-hosted output to a MinIO bucket in an air-gapped environment instead of AWS S3.

$ DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL=https://minio.internal:9000 \
PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS=5 \
docker compose up -d

Adds Lighthouse AI ability to launch a partial scan targeting specific resources to confirm remediations.
Streamlines AWS provider onboarding to a single-step wizard that reads the account ID from the role ARN and handles credentials and connection test in one submit.

Adds Lighthouse AI ability to launch a partial scan targeting specific resources to confirm remediations.

1 more in Everything

5.44.0 Sep 29, 2026 · issue 089

Prowler 5.44.0 adds partial resource re-checks, S3-compatible storage via DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL, and PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS for retry control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 5.44.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.44.0

└──▷ TRY IT

Immediately re-check up to 10 specific resources after a remediation, without waiting for the next full scan.

$ curl -X POST https://<your-prowler-api>/api/v1/scans \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"resource_uids": ["arn:aws:s3:::my-bucket", "arn:aws:ec2:us-east-1:123456789012:instance/i-0abc123"]}'

Point a self-hosted Prowler deployment at MinIO (or another S3-compatible store) for scan report storage without affecting AWS provider role assumptions.

.env

DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL=http://minio.internal:9000

Cap Boto3 retries for the AWS provider in environments where unreachable partition endpoints cause long delays during connection tests.

.env

PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS=3

Adds POST /api/v1/scans support for resource_uids (up to 10 resources) to launch partial scans, with is_partial exposed on scan objects and a filter[is_partial] query parameter on scan list endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL environment variable to direct scan output uploads and downloads at S3-compatible object storage such as MinIO, without polluting process-wide AWS environment variables.
Adds PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS environment variable to control Boto3 retry attempts for the AWS provider; set to 0 to disable retries entirely.
Adds prowler_trigger_scan MCP tool support for a resource_uids argument to launch partial scans, and exposes is_partial on prowler_list_scans and prowler_get_scan with an is_partial filter on prowler_list_scans.
Adds a Re-check resource action in the Findings page actions menu and resource detail drawer, launching a partial scan that re-runs only the checks that last reported on that resource.

+2 more show less

Connects AWS accounts in a single wizard step: the account ID is read from the role ARN (or typed for static access keys), the role is assumed, and credentials are stored and tested in one submit.
Unifies latest-scan resolution across all endpoints so findings, compliance, and mute rules always read from the same scan for a given provider.

Adds POST /api/v1/scans support for resource_uids (up to 10 resources) to launch partial scans, with is_partial exposed on scan objects and a filter[is_partial] query parameter on scan list endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL environment variable to direct scan output uploads and downloads at S3-compatible object storage such as MinIO, without polluting process-wide AWS environment variables.
Adds PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS environment variable to control Boto3 retry attempts for the AWS provider; set to 0 to disable retries entirely.
Adds a Re-check resource action in the Findings page actions menu and resource detail drawer, launching a partial scan that re-runs only the checks that last reported on that resource.

3 more in Everything

docs update Sep 22, 2026 · issue 082

Prowler: Adds fedramp_20x_frr_class_c_2026 framework covering the 158 FedRAMP Class C rules for cloud service providers, with configurable checks mapped to rule text and an audit_config that cannot override hard requirements.

└──▷ TRY IT

Run Prowler against an Azure US Government tenant so Defender and Key Vault checks resolve to sovereign-cloud endpoints.

$ prowler azure --azure-region AzureUSGovernment

Adds inspector2_active_findings_within_max_age check to flag active Inspector findings first observed more than inspector2_active_finding_max_age_days days ago (default 192).
Adds elbv2_listener_fips_tls_enabled check to report HTTPS/TLS load balancer listeners not using a FIPS security policy.
Adds transfer_server_fips_security_policy_enabled check to report Transfer Family servers not using a FIPS security policy.
Azure Defender security contacts and Key Vault key rotation policy clients now use the sovereign-cloud endpoints matching the --azure-region selection (e.g., AzureUSGovernment, AzureChinaCloud) instead of hardcoded management.azure.com and vault.azure.net.
Covers Microsoft 365 Defender Standard and Strict preset security policies via the existing defender_strict_preset_security_policy_enabled check, restoring findings that were previously dropped with a KeyError on tenants using preset policies.

+1 more show less

Supports filter[state__in] on the invitations API endpoint without returning a server error, and re-inviting an expired address now marks the old invitation expired and creates a new one instead of returning a generic error.

Adds inspector2_active_findings_within_max_age check to flag active Inspector findings first observed more than inspector2_active_finding_max_age_days days ago (default 192).
Adds elbv2_listener_fips_tls_enabled check to report HTTPS/TLS load balancer listeners not using a FIPS security policy.
Adds transfer_server_fips_security_policy_enabled check to report Transfer Family servers not using a FIPS security policy.

3 more in Everything

└──▷ BREAKING ON UPGRADE

!The pilot framework IDs fedramp_20x_ksi_low_aws, fedramp_20x_ksi_low_azure, and fedramp_20x_ksi_low_gcp are replaced by fedramp_20x_ksi_2026; any automation or stored results referencing the old IDs must be updated.

5.43.0 Sep 21, 2026 · issue 082

Prowler 5.43.0 adds FedRAMP 20x 2026 frameworks, seven AWS Inspector/FIPS checks, partition failover, and a self-registration toggle⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 5.43.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.43.0

Adds fedramp_20x_ksi_2026 universal compliance framework covering the 46 FedRAMP Key Security Indicators across AWS, Azure, GCP, Kubernetes, and M365 from a single definition, replacing the pilot per-provider frameworks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds fedramp_20x_frr_class_c_2026 universal compliance framework covering 158 FedRAMP Class C provider rules across AWS, Azure, GCP, Kubernetes, and M365.
Adds seven new AWS checks: inspector2_coverage_scan_status_active, inspector2_coverage_recently_scanned (configurable via inspector2_max_days_since_last_scan, default 3), inspector2_active_findings_no_known_exploited_vulnerabilities, inspector2_active_findings_kev_within_due_date, inspector2_active_findings_within_max_age (configurable via inspector2_active_finding_max_age_days, default 192), elbv2_listener_fips_tls_enabled, and transfer_server_fips_security_policy_enabled.
Adds inspector2:BatchGetFindingDetails to the Prowler additions policy and CloudFormation scan role so KEV checks can pull CISA Known Exploited Vulnerability data directly from Inspector without an external feed; missing permission reports MANUAL instead of a false FAIL.
Adds UI_SELF_REGISTRATION_ENABLED environment variable for Prowler Private Cloud deployments; set to false to make sign-up invitation-only, hiding the Sign up link and Create organization option.

+5 more show less

Adds DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL environment variable to sign report download URLs against a browser-reachable storage host, enabling downloads on deployments where object storage is only reachable inside the container network.
Adds smn_topic_subscriptions check for Huawei Cloud, reporting SMN topics that have no subscriptions configured.
Adds AWS partition bootstrap failover: when PROWLER_AWS_PARTITION is set, bootstrap STS calls try up to two additional regions in the partition on connection errors or timeouts, so GovCloud scans succeed on networks that route only to one regional endpoint.
Adds registry marketplace and external provider onboarding for Private Cloud, with permission-based access, schema-driven credentials, connection checks, and scan launch.
Expired invitations are now re-invitable: a pending invitation past its expiry is marked expired and a new invitation is created for the same email rather than returning a generic error; filter[state__in] on the invitations endpoint no longer returns a server error.

Adds fedramp_20x_ksi_2026 universal compliance framework covering the 46 FedRAMP Key Security Indicators across AWS, Azure, GCP, Kubernetes, and M365 from a single definition, replacing the pilot per-provider frameworks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds fedramp_20x_frr_class_c_2026 universal compliance framework covering 158 FedRAMP Class C provider rules across AWS, Azure, GCP, Kubernetes, and M365.
Adds seven new AWS checks: inspector2_coverage_scan_status_active, inspector2_coverage_recently_scanned (configurable via inspector2_max_days_since_last_scan, default 3), inspector2_active_findings_no_known_exploited_vulnerabilities, inspector2_active_findings_kev_within_due_date, inspector2_active_findings_within_max_age (configurable via inspector2_active_finding_max_age_days, default 192), elbv2_listener_fips_tls_enabled, and transfer_server_fips_security_policy_enabled.
Adds UI_SELF_REGISTRATION_ENABLED environment variable for Prowler Private Cloud deployments; set to false to make sign-up invitation-only, hiding the Sign up link and Create organization option.
Adds DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL environment variable to sign report download URLs against a browser-reachable storage host, enabling downloads on deployments where object storage is only reachable inside the container network.

+2 more show less

Adds smn_topic_subscriptions check for Huawei Cloud, reporting SMN topics that have no subscriptions configured.
Adds registry marketplace and external provider onboarding for Private Cloud, with permission-based access, schema-driven credentials, connection checks, and scan launch.

3 more in Everything

└──▷ BREAKING ON UPGRADE

!The pilot framework IDs fedramp_20x_ksi_low_aws, fedramp_20x_ksi_low_azure, and fedramp_20x_ksi_low_gcp are replaced by fedramp_20x_ksi_2026; any automation or stored results referencing the pilot IDs must be updated.

docs update Sep 11, 2026 · issue 071

Prowler: Adds --aws-connect-timeout and --aws-read-timeout CLI flags, plus PROWLER_AWS_BOTO3_CONNECT_TIMEOUT and PROWLER_AWS_BOTO3_READ_TIMEOUT environment variables, to tune Boto3 timeouts for restricted-egress networks; lowers the default connect timeout from 60 s to 10 s while keeping the read timeout at 60 s.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Scan a GovCloud account through VPC endpoints only, cutting per-service timeout from 60 s to 5 s and disabling retries to surface unreachable endpoints quickly.

$ prowler aws --region us-gov-west-1 --aws-connect-timeout 5 --aws-read-timeout 60 --aws-retries-max-attempts 0

Scan an AWS ISO partition region in an air-gapped deployment without editing aws_regions_by_service.json.

$ prowler aws --region us-isob-east-1

Adds support for AWS ISO partitions (aws-iso, aws-iso-b, aws-iso-e, aws-iso-f), resolving regions and services from botocore endpoint metadata with no credentials or network access, so ISO regions like us-isob-east-1 are accepted by --region and --excluded-region without a hand-edited aws_regions_by_service.json.
Adds PROWLER_AWS_PARTITION support to keep bootstrap STS calls inside the configured partition's region, preventing timeouts in air-gapped deployments such as GovCloud VPC-endpoint-only installs.
Honors TRIVY_CACHE_DIR in the Image provider so Trivy's vulnerability database persists across scans; combine with TRIVY_SKIP_DB_UPDATE=true to scan images on hosts without internet access.

Adds support for AWS ISO partitions (aws-iso, aws-iso-b, aws-iso-e, aws-iso-f), resolving regions and services from botocore endpoint metadata with no credentials or network access, so ISO regions like us-isob-east-1 are accepted by --region and --excluded-region without a hand-edited aws_regions_by_service.json.
Adds PROWLER_AWS_PARTITION support to keep bootstrap STS calls inside the configured partition's region, preventing timeouts in air-gapped deployments such as GovCloud VPC-endpoint-only installs.

1 more in Everything

└──▷ BREAKING ON UPGRADE

!--aws-retries-max-attempts 0 now disables retries entirely (one attempt per call) instead of silently falling back to three; any automation relying on the old silent-fallback behaviour will now make only a single attempt.

5.42.0 Sep 11, 2026 · issue 071

Prowler 5.42.0 adds AWS ISO partition support, configurable Boto3 timeouts, and a persistent Trivy vulnerability database cache.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch 5.42.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.42.0

└──▷ TRY IT

Scan a GovCloud account from a host that reaches AWS only through VPC endpoints, cutting per-region timeout from ~4 minutes to ~10 seconds per unreachable service.

$ prowler aws --region us-gov-west-1 --aws-connect-timeout 10 --aws-read-timeout 60 --aws-retries-max-attempts 0

Scan container images in an air-gapped environment by pointing Prowler at a pre-populated Trivy database and skipping the download.

$ export TRIVY_CACHE_DIR=/mnt/trivy-db
export TRIVY_SKIP_DB_UPDATE=true
prowler image myregistry.internal/myapp:latest

Scan an AWS ISO partition region that was previously unsupported without a hand-edited region file.

$ prowler aws --region us-isob-east-1

Adds --aws-connect-timeout and --aws-read-timeout CLI flags, plus PROWLER_AWS_BOTO3_CONNECT_TIMEOUT and PROWLER_AWS_BOTO3_READ_TIMEOUT environment variables, to control per-call AWS API wait times; --aws-retries-max-attempts 0 now disables Boto3 retries entirely instead of silently falling back to three attempts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds support for AWS ISO partitions (aws-iso, aws-iso-b, aws-iso-e, aws-iso-f) in the service region matrix, so ISO regions such as us-isob-east-1 are accepted by --region and --excluded-region without a hand-edited aws_regions_by_service.json.
Honors TRIVY_CACHE_DIR in the Image provider so the Trivy vulnerability database is downloaded once and reused across scans; pairing it with TRIVY_SKIP_DB_UPDATE=true enables air-gapped image scanning against a pre-populated database.
Lowers the default Boto3 connect timeout from 60 seconds to 10 seconds, cutting scan time in restricted-egress networks (VPC endpoints, GovCloud, private deployments) where unreachable service endpoints previously cost up to four 60-second attempts per region.
Adds a compliance catalog integrity test that enforces unique requirement IDs, no duplicate check references within a requirement, and that every referenced check exists for its provider, spanning 42 frameworks across AWS, Azure, GCP, GitHub, Kubernetes, and Microsoft 365.

+1 more show less

Bootstraps STS calls in the configured region when PROWLER_AWS_PARTITION is set and the region belongs to that partition, preventing routing failures in deployments that reach AWS only through their own VPC endpoints.

Adds --aws-connect-timeout and --aws-read-timeout CLI flags, plus PROWLER_AWS_BOTO3_CONNECT_TIMEOUT and PROWLER_AWS_BOTO3_READ_TIMEOUT environment variables, to control per-call AWS API wait times; --aws-retries-max-attempts 0 now disables Boto3 retries entirely instead of silently falling back to three attempts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds support for AWS ISO partitions (aws-iso, aws-iso-b, aws-iso-e, aws-iso-f) in the service region matrix, so ISO regions such as us-isob-east-1 are accepted by --region and --excluded-region without a hand-edited aws_regions_by_service.json.
Adds a compliance catalog integrity test that enforces unique requirement IDs, no duplicate check references within a requirement, and that every referenced check exists for its provider, spanning 42 frameworks across AWS, Azure, GCP, GitHub, Kubernetes, and Microsoft 365.

3 more in Everything

└──▷ BREAKING ON UPGRADE

!The default Boto3 connect timeout is lowered from 60 seconds to 10 seconds; scans that relied on the longer default to reach slow or high-latency AWS endpoints may now time out where they previously succeeded.

docs update Sep 10, 2026 · issue 070

Prowler adds OCSF findings import via UI, CLI, and API, plus Boto3 retrier and timeout configuration for AWS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Supports uploading OCSF scan results to Prowler Cloud via the UI, CLI, or API using the new Import Findings capability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

docs update Sep 10, 2026 · issue 070

Prowler image scans now support a persistent Trivy vulnerability database cache via TRIVY_CACHE_DIR, enabling air-gapped and faster rescans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Persist the Trivy vulnerability DB so it is downloaded once and reused on every subsequent image scan, saving time in CI pipelines.

$ TRIVY_CACHE_DIR="$HOME/.cache/trivy" prowler image <image>

Scan a container image in an air-gapped environment using a pre-populated Trivy database copied from an internet-connected machine.

$ TRIVY_CACHE_DIR=/mnt/trivy-db TRIVY_SKIP_DB_UPDATE=true TRIVY_SKIP_JAVA_DB_UPDATE=true prowler image <image>

Supports TRIVY_CACHE_DIR environment variable to persist Trivy's vulnerability database across scans, avoiding a fresh download on every run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports TRIVY_SKIP_DB_UPDATE=true and TRIVY_SKIP_JAVA_DB_UPDATE=true environment variables to run image scans against a pre-populated database with no network access, enabling air-gapped deployments.

2 details in Everything

docs update Sep 9, 2026 · issue 069

Prowler can now ingest external OCSF scan results into Prowler Cloud via UI, CLI, or API.

docs update Sep 2, 2026 · issue 062

Prowler adds browser-based findings import, Slack alerts, on-premises registry scanning, 10 new AWS checks, and CIS Google Workspace v1.4.0 compliance

└──▷ TRY IT

Scan a private on-premises container registry over an internal CIDR, bypassing certificate validation for a self-signed cert — keep restricted to trusted internal networks.

$ PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS=10.0.0.0/8,192.168.1.50 prowler --registry-insecure

Configure which CloudWatch log group prefixes are checked for Bedrock AgentCore data protection policies.

config.yaml

agentcore_log_group_name_prefixes:
  - /aws/bedrock/agentcore/
  - /custom/agentcore/

Enable back-links from Jira issues to Prowler findings when running Prowler Local Server.

.env

DJANGO_UI_BASE_URL=https://prowler.example.internal

Adds PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS environment variable accepting a comma-separated list of IPs and CIDRs to enable scanning of on-premises and private-network container registries, while all other non-public addresses remain blocked by the SSRF guard.
Adds --registry-insecure flag that now propagates to Trivy via TRIVY_INSECURE, allowing images behind self-signed certificates to be pulled and scanned (not just enumerated) — intended for trusted internal registries only.
New check bedrock_knowledge_base_encrypted_with_cmk verifies each Bedrock knowledge-base data source uses a customer-managed KMS key for transient storage during chunking and embedding.
Adds NCSC Cyber Essentials v3.3 (April 2026) as a universal compliance framework with 28 requirements across five control themes, with 16 requirements mapped to Azure checks.
Adds CIS Google Workspace Foundations Benchmark v1.4.0 compliance framework; reworks mapped Google Workspace checks to evaluate the full audit procedure rather than a single condition.

+5 more show less

Prowler MCP Server tools prowler_docs_search, prowler_docs_get_document, prowler_hub_get_check_code, and prowler_hub_get_check_fixer now surface failures as MCP tool execution errors (isError: true) rather than successful responses containing an {"error": ...} object.
MCP tool prowler_get_compliance_framework_state_details now rejects calls that supply both scan_id and provider_id simultaneously instead of silently ignoring provider_id.
Sets DJANGO_UI_BASE_URL in the API environment to enable Prowler Local Server to include a back-link to the originating finding in every Jira issue it creates.
Adds browser-based Import Findings dialog on the Scans page for drag-and-drop or file-picker upload of .ocsf.json reports, with inline job tracking, record/invalid counts, and retry on failure; requires the Manage Ingestions permission.
Lighthouse AI answers can now be rated thumbs up or thumbs down with an optional free-text feedback field, collected per answer in the chat.

10 details in Everything

5.41.0 Sep 2, 2026 · issue 062

Prowler 5.41.0 adds 10 new AWS checks, CIS Google Workspace v1.4.0, private-registry scanning, and browser-based findings import

└──▷ GET THIS VERSION

$ git clone --branch 5.41.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.41.0

└──▷ USE IT

Scope the AgentCore log-group data-protection check to your organization's specific log group prefixes.

config.yaml

agentcore_log_group_name_prefixes:
  - "/aws/bedrock/agentcore/prod-"
  - "/aws/bedrock/agentcore/staging-"

Enable finding-to-issue deep links in Jira by pointing the API at your Prowler Cloud UI base URL.

.env

DJANGO_UI_BASE_URL=https://cloud.prowler.com

Adds PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS environment variable accepting a comma-separated list of IPs and CIDRs to allow the Image provider to reach on-premises registries while keeping all other non-public addresses blocked by the SSRF guard.
Adds --registry-insecure flag propagation to Trivy via TRIVY_INSECURE, enabling pull and scan of images behind self-signed certificates on trusted internal registries.
Adds agentcore_log_group_name_prefixes key to config.yaml to configure which CloudWatch log group prefixes the new cloudwatch_log_group_agentcore_data_protection_policy_enabled check evaluates.
Adds DJANGO_UI_BASE_URL API environment variable; when set, Jira issues created from findings include a direct link back to the finding filtered by its UID.
New check iam_policy_passrole_to_bedrock_agentcore_restricted flags customer-managed IAM policies that allow iam:PassRole over every role where the passed role can reach Bedrock AgentCore.

+16 more show less

New check iam_policy_no_agentcore_workload_access_token_wildcard flags customer-managed IAM policies granting bedrock-agentcore:GetWorkloadAccessToken, GetWorkloadAccessTokenForJWT, or GetWorkloadAccessTokenForUserId on resources reaching workload identities beyond the caller's own.
New check cloudwatch_log_group_agentcore_data_protection_policy_enabled verifies Bedrock AgentCore log groups have a CloudWatch Logs data protection policy masking sensitive data.
New check guardduty_runtime_monitoring_enabled flags GuardDuty detectors without unified Runtime Monitoring (covering EC2, ECS on Fargate, and EKS).
New check guardduty_ai_protection_enabled flags GuardDuty detectors without AI Protection for Bedrock, Bedrock AgentCore, and SageMaker AI CloudTrail data events.
New check ecr_registry_enhanced_scanning_enabled verifies the ECR registry uses enhanced scanning (Amazon Inspector with continuous rescanning) instead of basic scanning.
New check eks_cluster_vpc_cni_network_policy_enforced flags EKS clusters whose Amazon VPC CNI managed add-on does not enforce Kubernetes network policy.
New check iam_role_service_trust_restricts_source_to_account flags IAM roles whose trust policy allows an AWS service principal to assume the role without a source-account constraint.
New check elasticbeanstalk_environment_no_secrets_in_configuration scans Elastic Beanstalk environment option settings for hardcoded secrets.
New check memorydb_cluster_in_transit_encryption_enabled verifies MemoryDB clusters have in-transit encryption (TLS) enabled.
Ships the CIS Google Workspace Foundations Benchmark v1.4.0 compliance framework with reworked checks covering Gmail spoofing, 2-Step Verification, password expiration, and alert severity defaults.
Jira issues created from findings now carry labels prowler, prowler-<provider>, prowler-<severity>, prowler-<check-id>, and prowler-finding-<finding-uid> for JQL filtering and automation matching.
Adds browser-based Import Findings dialog on the Scans page (Prowler Cloud and Private Cloud) accepting .ocsf.json reports via drag-and-drop or file picker, with inline job-completion and error reporting (requires Manage Ingestions permission).
MCP server tools now report failures as proper MCP tool execution errors (isError: true) instead of successful responses carrying an {"error": ...} payload; affects prowler_docs_search, prowler_docs_get_document, prowler_hub_get_check_code, prowler_hub_get_check_fixer, and prowler_get_compliance_framework_state_details.
Image provider registry scans now enumerate repositories in parallel, skip non-image OCI artifacts (Helm charts, cosign signatures, SBOM attestations), and continue scanning remaining images when Trivy fails on a single image.
Image provider authentication now falls back to Basic when a registry rejects a bearer token, and upgrades to bearer when the server responds with a Bearer challenge to a Basic or anonymous request.
Slack integration connection check now displays its result (including the refused or reached channels) directly on the integration card, not only in a transient toast notification (Prowler Cloud only).

21 details in Everything

docs update Sep 2, 2026 · issue 062

Prowler image provider adds PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS to safely scan on-premises registries on private networks.

Adds PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS environment variable accepting a comma-separated list of IPs and CIDRs (e.g. 192.168.65.254/32,10.20.0.0/16) to allowlist private network ranges for on-premises registry scanning, while keeping link-local, loopback, and unlisted private addresses blocked as SSRF protection.
Malformed entries in PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS cause a startup failure, and any non-empty allowlist is logged as a relaxed security control so operators have a clear audit trail.

2 details in Everything

docs update Sep 2, 2026 · issue 062

Prowler adds Slack alert destinations, NCSC Cyber Essentials 3.3, 15 new checks across 7 providers, and an AI feedback mechanism.

Adds Slack as an alert destination: connect a workspace from the Integrations page, authorize destination channels, and select them in the alert modal's Destination channels selector alongside the existing Recipients email selector.
Adds NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026) as a universal compliance framework with 28 requirements across five control themes: Firewalls, Secure Configuration, Security Update Management, User Access Control, and Malware Protection — 16 requirements map to Azure checks, 12 reported as Manual.
New ecr_repository_image_no_secrets check scans the latest image of each ECR repository — both configuration and filesystem layers — for hardcoded secrets.
New bedrock_guardrail_contextual_grounding_filter_enabled check verifies Bedrock guardrails enable both contextual grounding filters.
New bedrock_custom_model_encrypted_with_cmk check verifies Bedrock custom models are encrypted at rest with a customer-managed KMS key.

+14 more show less

New bedrock_knowledge_base_encrypted_with_cmk check verifies each Bedrock knowledge-base data source encrypts transient chunking/embedding storage with a customer-managed KMS key.
New bedrock_agent_role_not_shared_across_agents check verifies every Bedrock agent has a dedicated execution role.
New rolesanywhere_profile_restricts_session_permissions check flags IAM Roles Anywhere profiles referencing an administrative role without a scoping session policy or managed policies.
New iam_workload_identity_pool_provider_attribute_condition check flags GCP Workload Identity Federation providers that trust a multi-tenant issuer without an attribute condition.
New organization_default_workflow_permissions_read_only check verifies GitHub organizations enforce read-only default GITHUB_TOKEN permissions for workflows.
New repository_default_workflow_permissions_read_only check verifies GitHub repositories enforce read-only default GITHUB_TOKEN permissions for workflows.
New organization_actions_pull_request_approval_disabled check verifies GitHub organizations prevent Actions from creating and approving pull requests.
New defender_domain_dmarc_records_published check verifies every Exchange Online domain publishes a DMARC record with an enforcing policy (p=quarantine or p=reject).
New oss_bucket_versioning_enabled check verifies Alibaba Cloud OSS buckets have versioning enabled.
New oss_bucket_server_side_encryption_enabled check verifies Alibaba Cloud OSS buckets define a default server-side encryption rule (AES256 or KMS).
New vpc_security_group_open_egress check flags Huawei Cloud VPC security groups that allow open egress to the internet.
New ske_cluster_no_public_endpoint check flags STACKIT SKE clusters whose Kubernetes API endpoint is reachable from the internet (ACL disabled or allowed CIDR contains 0.0.0.0/0 or ::/0).
Adds an Imported provider indicator in the providers table for providers whose findings were loaded via the Prowler CLI Import Findings workflow, distinguishing them from live connected providers.
Adds per-answer thumbs-up/thumbs-down feedback with an optional description field to every Lighthouse AI chat response.

19 details in Everything

docs update Aug 28, 2026 · issue 058

Prowler adds Slack alert destinations, NCSC Cyber Essentials 3.3, 15 new checks across 7 providers, and an Imported provider indicator.

Adds rolesanywhere_profile_restricts_session_permissions check to flag IAM Roles Anywhere profiles referencing an administrative role without a scoping session or managed policy.
Adds iam_workload_identity_pool_provider_attribute_condition GCP check to flag Workload Identity Federation providers that trust a multi-tenant issuer without an attribute condition.
Adds oss_bucket_versioning_enabled Alibaba Cloud check to verify OSS buckets have versioning enabled.
Adds ske_cluster_no_public_endpoint STACKIT check to flag SKE clusters whose Kubernetes API endpoint is reachable from the whole internet (ACL disabled or allowed CIDRs contain 0.0.0.0/0 or ::/0).
Adds Slack as an alert channel destination: connect a Slack workspace from the Integrations page, authorize destination channels, and select them in the alert modal's Destination channels selector alongside the existing email Recipients selector.

+1 more show less

Adds per-answer thumbs-up/thumbs-down feedback with an optional description field directly in the Lighthouse AI chat.

6 details in Everything

docs update Aug 28, 2026 · issue 058

Prowler Cloud adds Alerts for findings with delivery to email and Slack, plus a new Slack workspace integration.

New Alerts feature lets you create alerts from Prowler Cloud findings and deliver them to email recipients and Slack channels, triggered after scans or on a daily digest schedule.
New Slack Integration allows connecting a Slack workspace to Prowler Cloud or Prowler Private Cloud, authorizing specific channels for Prowler to post findings notifications into.

2 details in Everything

5.40.0 Aug 28, 2026 · issue 058

Prowler 5.40.0 adds 15 new checks across 7 providers, NCSC Cyber Essentials 3.3, and Slack alert destinations

└──▷ GET THIS VERSION

$ git clone --branch 5.40.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.40.0

New ecr_repository_image_no_secrets check scans the latest image of each ECR repository — both configuration and filesystem layers — for hardcoded secrets.
New bedrock_guardrail_contextual_grounding_filter_enabled check verifies that Bedrock guardrails enable both contextual grounding filters, blocking unsupported or off-topic responses.
New bedrock_custom_model_encrypted_with_cmk check verifies that Bedrock custom models are encrypted at rest with a customer-managed KMS key rather than an AWS-owned key.
New bedrock_knowledge_base_encrypted_with_cmk check verifies that each Bedrock knowledge-base data source encrypts transient chunking/embedding storage with a customer-managed KMS key.
New bedrock_agent_role_not_shared_across_agents check verifies that every Bedrock agent has a dedicated execution role so no agent inherits another's permissions.

+14 more show less

New rolesanywhere_profile_restricts_session_permissions check flags IAM Roles Anywhere profiles that reference an administrative role without scoping down vended sessions via a session policy or managed policies.
New iam_workload_identity_pool_provider_attribute_condition check (GCP) flags Workload Identity Federation providers that trust a multi-tenant issuer without an attribute condition restricting which external identities can impersonate federated principals.
New organization_default_workflow_permissions_read_only check (GitHub) verifies that workflows receive a read-only default GITHUB_TOKEN at the organization level.
New repository_default_workflow_permissions_read_only check (GitHub) verifies that workflows receive a read-only default GITHUB_TOKEN at the repository level.
New organization_actions_pull_request_approval_disabled check (GitHub) verifies that organizations prevent GitHub Actions from creating and approving pull requests.
New defender_domain_dmarc_records_published check (Microsoft 365) verifies that every Exchange Online domain publishes a DMARC record with an enforcing policy (p=quarantine or p=reject).
New oss_bucket_versioning_enabled check (Alibaba Cloud) verifies that OSS buckets have versioning enabled for recovery from accidental or malicious object overwrite and deletion.
New oss_bucket_server_side_encryption_enabled check (Alibaba Cloud) verifies that OSS buckets define a default server-side encryption rule (AES256 or KMS).
New vpc_security_group_open_egress check (Huawei Cloud) flags VPC security groups that allow open egress to the internet.
New ske_cluster_no_public_endpoint check (STACKIT) flags SKE clusters whose Kubernetes API endpoint is publicly reachable because the ACL extension is disabled or its allowed CIDR list contains 0.0.0.0/0 or ::/0.
Adds NCSC Cyber Essentials 3.3 (Requirements for IT Infrastructure v3.3, April 2026) as a universal compliance framework with 28 requirements across five control themes: Firewalls, Secure Configuration, Security Update Management, User Access Control, and Malware Protection — with Azure provider coverage for 16 requirements.
Slack workspace integration (Prowler Cloud / Prowler Private Cloud): connect a workspace from the Integrations page, authorize destination channels, and select them in alert rules alongside email recipients; the alerts list shows both in a unified Destinations column.
Lighthouse AI answers now support thumbs-up/thumbs-down feedback with an optional free-text detail field, collected per answer directly in the chat.
Providers table now shows an Imported provider indicator for providers whose findings were uploaded via the Prowler CLI, distinguishing them from connected providers at a glance.

19 details in Everything

docs update Aug 26, 2026 · issue 057

Prowler adds Slack integration and multi-cloud organization hierarchy support across AWS, GCP, and Azure

New Slack integration lets teams connect a Slack workspace to Prowler Cloud or Prowler Private Cloud, select the target channel, and verify the connection for alert delivery.
New Organizations support provides onboarding and visibility across organization hierarchies for AWS, Google Cloud, and Azure in a unified view.
New Azure Management Groups support in Prowler enables scoping and onboarding across Azure Management Group hierarchies.

3 details in Everything

docs update Aug 13, 2026 · issue 044

Prowler adds a developer integration framework with a Jira Cloud integration class for sending findings as issues.

└──▷ USE IT

Authenticate to Jira Cloud and push a list of Prowler findings as individual Jira issues under a specific project and issue type.

python

from prowler.lib.outputs.jira import Jira

jira = Jira(
    redirect_uri="http://localhost:8080",
    client_id="client_id",
    client_secret="client_secret",
)
jira.send_findings(findings=findings, project_key="SEC", issue_type="Bug")

Validate Jira Cloud credentials before configuring the integration in a pipeline, returning a Connection object with error details on failure.

python

from prowler.lib.outputs.jira import Jira

conn = Jira.test_connection(
    redirect_uri="http://localhost:8080",
    client_id="client_id",
    client_secret="client_secret",
    raise_on_exception=False,
)
print(conn.is_connected, conn.error)

New Jira integration class (in prowler/lib/outputs) exposes send_findings(findings, project_key, issue_type), test_connection(redirect_uri, client_id, client_secret, raise_on_exception), get_projects(), get_available_issue_types(project_key), get_access_token(), refresh_access_token(), auth_code_url(), and input_authorization_code() for pushing Prowler findings into Jira Cloud as issues via the Atlassian REST API.
Adds an integration authflow using AUTH_URL (https://auth.atlassian.com/authorize), TOKEN_URL (https://auth.atlassian.com/oauth/token), and API_TOKEN_URL (https://api.atlassian.com/oauth/token/accessible-resources) with OAuth 2.0 scopes read:jira-user, read:jira-work, and write:jira-work.
Publishes a developer guide for building custom integrations targeting messaging platforms (e.g. Slack), project management tools (e.g. Jira), and cloud services (e.g. AWS Security Hub) using the prowler/lib/outputs folder as the reference implementation location.

3 details in Everything

docs update Aug 13, 2026 · issue 044

Prowler adds Compliance Watchlist, multi-domain SAML SSO, 20 new AWS privilege-escalation Attack Paths, and per-architecture SBOMs.

Adds iam_policy_allows_privilege_escalation check with 22 additional escalation combinations, plus 20 new AWS privilege-escalation Attack Paths queries covering iam:PassRole paths across AWS Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, Systems Manager, and Step Functions — also covering existing-resource abuse, permissions-boundary removal, role assumption, and IAM Identity Center permission-set policy injection.
Attack Paths query catalog now exposes each AWS query's outcome category, distinguishing code execution, privilege escalation, public exposure, and resource inventory.
New Compliance Watchlist lets organizations pin frameworks from any compliance view, manage them through a searchable catalog, and filter the Compliance section to show only pinned frameworks — Overview page reports the latest score for every pinned framework.
SAML SSO now supports one configuration authorizing a primary email domain plus up to 19 additional domains through a single Identity Provider and one stable Assertion Consumer Service (ACS) URL.
Users table now shows each account's sign-in methods as tags, including email/password, Google, GitHub, SAML with linked domains, and Partner SSO.

+4 more show less

Adds 12 new checks for CIS Microsoft 365 Foundations Benchmark v7.0.0 across Admin Center, Defender, Entra ID, Exchange Online, and Microsoft Teams.
Prowler API, UI, SDK, and MCP container images now publish per-architecture SBOMs and build-provenance attestations; Prowler Cloud and Prowler Private Cloud production images carry the same attestations.
SDK and API container builds now verify checksums of downloaded PowerShell, Trivy, and zizmor binaries before installation.
Grype now complements Trivy across container-image security gates, detecting components and vulnerabilities that manifest-based scanners can miss and blocking fixable high and critical findings.

9 details in Everything

docs update Aug 13, 2026 · issue 044

Prowler adds a guided wizard to discover and onboard Azure subscriptions via Management Groups.

5.39.0 Aug 13, 2026 · issue 044

Prowler 5.39.0 adds CMMC 2.0, Azure Management Group onboarding, 20+ M365 checks, and two new AWS hardcoded-secret detections.

└──▷ GET THIS VERSION

$ git clone --branch 5.39.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.39.0

Adds batch_job_definition_no_secrets check for AWS, scanning Batch job definition environment variables and command parameters for hardcoded secrets.
Adds awslambda_layer_no_secrets_in_content check for AWS, scanning Lambda layer package content for hardcoded secrets.
Adds GET /api/v1/users/me membership relationships now identify the active tenant with meta.active for both JWT and API key authentication.
Adds prowler_send_findings_to_jira MCP tool gains Cloud-only grouped dispatch: select failed findings by check IDs against the latest completed scan and send one Jira work item per check listing up to 50 affected resources, with per-group error reporting.
Adds CMMC 2.0 as a universal compliance framework covering all 149 requirements across Levels 1, 2, and 3, mapped to checks across AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud, and Microsoft 365.

+9 more show less

Adds 20 new Microsoft 365 Entra ID checks for CIS Microsoft 365 Foundations Benchmark v7.0.0, covering password protection, default user permissions, Conditional Access, sessions and authentication methods, and PIM and access reviews.
Adds Azure Management Group onboarding in Prowler Cloud: onboard all subscriptions under a tenant at once by entering the Microsoft Entra tenant ID and authenticating with a single tenant-wide service principal (Cloud/Private Cloud only).
Adds Lighthouse AI Skills menu on every finding in Prowler Cloud, offering Contextual Fix, Triage Decision, Systemic Scope, and a free-form prompt, with follow-up actions including creating a Jira issue or muting the finding (Cloud/Private Cloud only).
Adds Resolved triage status for MANUAL findings in Prowler Cloud, recording written evidence and verifying the finding as an effective PASS for 90 days or until a real failure is detected (Cloud/Private Cloud only).
Adds eight organization MCP tools to the Prowler Cloud MCP server, enabling agents to onboard and manage entire AWS Organizations, GCP organizations, and Azure tenant root management groups end to end (Cloud/Private Cloud only).
Redesigns the Attack Paths graph to group same-class resources into expandable nodes with counts and terminates every path in an explicit outcome node naming the destination impact: code execution, privilege escalation, public exposure, or resource inventory (Cloud/Private Cloud only).
Adds Manage Lighthouse AI role permission in role forms and role details, allowing the Lighthouse AI configuration permission to be granted or restricted independently of other permissions (Cloud/Private Cloud only).
Surfaces pre-configured credential creation links in the add-provider wizard: Cloudflare exposes a User API Token template and an Account-Owned template pinned to the entered Cloudflare Account ID; GitHub exposes a personal-repositories template and an organization-scanning template pinned to the entered identifier.
Scales organization_repository_creation_limited GitHub check severity to low when repository creation is limited to private or internal visibility.

14 details in Everything

5.38.0 Aug 6, 2026 · issue 037

Prowler 5.38.0 adds 20 Attack Paths privilege-escalation queries, 12 M365 checks, SAML multi-domain SSO, and compliance watchlists.

└──▷ GET THIS VERSION

$ git clone --branch 5.38.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.38.0

Adds admincenter_shared_bookings_disabled check for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 control 1.3.9.
Adds defender_priority_account_protection_enabled and defender_strict_preset_security_policy_enabled checks for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 controls 2.4.1 and 2.4.2.
Adds exchange_owa_mailbox_policy_personal_accounts_disabled and exchange_organization_reject_direct_send_enabled checks for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 controls 6.3.2 and 6.5.5.
Adds teams_external_access_trial_tenants_blocked check for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 control 8.2.4.
Adds entra_device_registration_join_restricted, entra_device_registration_max_devices_per_user_limited, entra_device_registration_global_admins_not_local_admins, entra_device_registration_registering_user_not_local_admin, entra_device_registration_laps_enabled, and entra_policy_default_user_cannot_read_bitlocker_keys checks for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 device registration controls (5.1.4.x).

+9 more show less

Attack Paths adds 20 AWS privilege-escalation detection queries from pathfinding.cloud, covering service iam:PassRole escalations across AWS Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM, and Step Functions, plus CodeDeploy/Step Functions existing-resource abuse, permissions-boundary removal with role assumption, and IAM Identity Center permission-set policy injection.
Attack Paths query metadata now exposes an outcome category (Code execution, Privilege escalation, Public exposure, or Resource inventory) on the queries endpoint, enabling terminal outcome nodes in the graph.
iam_policy_allows_privilege_escalation check gains 22 additional escalation combinations from pathfinding.cloud across AWS Batch, Braket, CodeDeploy, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, and EventBridge Scheduler.
Compliance Watchlist (Prowler Cloud/Private Cloud) lets teams pin frameworks from any compliance view, filter the Compliance section to pinned frameworks only, and see pinned framework scores on the Overview page.
SAML SSO now supports one primary email domain plus up to 19 additional domains under a single Identity Provider configuration and a single stable ACS URL (Prowler Cloud/Private Cloud).
Users table in Prowler Cloud now shows each account's sign-in methods as tags, including email/password, Google, GitHub, SAML with linked domains, and Partner SSO.
Prowler API, UI, SDK, and MCP container images now publish per-architecture SBOMs and build-provenance attestations as OCI attestations.
Grype now runs alongside Trivy across container-image security gates, blocking on fixable high and critical findings.
API and SDK container builds now verify checksums of downloaded PowerShell, Trivy, and zizmor binaries before installation.

14 details in Everything

5.38.0 Aug 6, 2026 · issue 006

Prowler 5.38.0 adds 20 Attack Paths privilege-escalation queries, 12 M365 checks, SAML multi-domain SSO, and compliance watchlists.

└──▷ GET THIS VERSION

$ git clone --branch 5.38.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.38.0

Adds admincenter_shared_bookings_disabled check for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 control 1.3.9.
Adds defender_priority_account_protection_enabled and defender_strict_preset_security_policy_enabled checks for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 controls 2.4.1 and 2.4.2.
Adds exchange_owa_mailbox_policy_personal_accounts_disabled and exchange_organization_reject_direct_send_enabled checks for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 controls 6.3.2 and 6.5.5.
Adds teams_external_access_trial_tenants_blocked check for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 control 8.2.4.
Adds entra_device_registration_join_restricted, entra_device_registration_max_devices_per_user_limited, entra_device_registration_global_admins_not_local_admins, entra_device_registration_registering_user_not_local_admin, entra_device_registration_laps_enabled, and entra_policy_default_user_cannot_read_bitlocker_keys checks for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 device registration controls (5.1.4.x).

+9 more show less

Attack Paths adds 20 AWS privilege-escalation detection queries from pathfinding.cloud, covering service iam:PassRole escalations across AWS Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM, and Step Functions, plus CodeDeploy/Step Functions existing-resource abuse, permissions-boundary removal with role assumption, and IAM Identity Center permission-set policy injection.
Attack Paths query metadata now exposes an outcome category (Code execution, Privilege escalation, Public exposure, or Resource inventory) on the queries endpoint, enabling terminal outcome nodes in the graph.
iam_policy_allows_privilege_escalation check gains 22 additional escalation combinations from pathfinding.cloud across AWS Batch, Braket, CodeDeploy, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, and EventBridge Scheduler.
Compliance Watchlist (Prowler Cloud/Private Cloud) lets teams pin frameworks from any compliance view, filter the Compliance section to pinned frameworks only, and see pinned framework scores on the Overview page.
SAML SSO now supports one primary email domain plus up to 19 additional domains under a single Identity Provider configuration and a single stable ACS URL (Prowler Cloud/Private Cloud).
Users table in Prowler Cloud now shows each account's sign-in methods as tags, including email/password, Google, GitHub, SAML with linked domains, and Partner SSO.
Prowler API, UI, SDK, and MCP container images now publish per-architecture SBOMs and build-provenance attestations as OCI attestations.
Grype now runs alongside Trivy across container-image security gates, blocking on fixable high and critical findings.
API and SDK container builds now verify checksums of downloaded PowerShell, Trivy, and zizmor binaries before installation.

14 details in Everything

docs update Aug 4, 2026 · issue 035

Prowler Cloud Lighthouse adds a context-aware chat panel that scopes questions to the current page and open finding/resource.

New context-aware chat panel automatically attaches the current app page and any open finding or resource metadata to each message, so queries like explain this resolve against what is on screen — active context is shown as a chip in the composer.

1 detail in Everything

docs update Aug 4, 2026 · issue 035

Prowler adds Huawei Cloud, 11 Nitro Enclaves checks, 4 Attack Path queries, OCSF MITRE ATT&CK enrichment, GCP org onboarding, and MCP tool families for integrations/users/roles.

└──▷ TRY IT

Scan a Huawei Cloud account for the first time using IAM access key credentials.

$ HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id" HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key" prowler huaweicloud

Adds HUAWEICLOUD_ACCESS_KEY_ID and HUAWEICLOUD_SECRET_ACCESS_KEY environment variables to enable scanning of Huawei Cloud accounts via Prowler CLI, covering 25 checks across CTS, ECS, ELB, EVS, IAM, KMS, OBS, RDS, VPC, and WAF services plus the CIS Huawei Cloud Foundations Benchmark 1.0 compliance framework.
Adds 11 new AWS Nitro Enclaves CSPM checks in the ec2_confidential_workload_host_* family (IMDSv2 enforcement, public IP exposure, unrestricted ingress, exposed vsock proxy ports, stopped hosts) and kms_key_enclave_* family (attestation enforcement, bypass, deployment binding, debug-mode, PCR mismatches, unknown enclave images), mapped across 23 compliance frameworks including NIST 800-53 Rev 5, PCI-DSS v4.0, ISO 27001:2022, SOC 2, HIPAA, and MITRE ATT&CK.
Adds codecommit_repository_no_secrets check under the new codecommit service, scanning files at the tip of each repository's default branch for hardcoded secrets.
Adds glue_catalog_connection_no_secrets check to detect secrets in Glue Data Catalog connection properties.
Adds ec2_instance_stopped_older_than_specific_days check to detect EC2 instances stopped longer than a configurable number of days (default 30).

+8 more show less

Adds sagemaker_endpoint_config_kms_encryption_enabled check to verify SageMaker endpoint configurations use a KMS key for storage volume encryption.
Adds four AWS privilege-escalation Attack Paths detection queries: STS-002 (cross-account role trust), STS-003 (wildcard role trust), IAM-022 (user permissions-boundary removal), and SSO-001 (IAM Identity Center permission-set escalation).
OCSF detection finding output now populates finding_info.analytic with the Prowler check rule and finding_info.attacks with MITRE ATT&CK technique and tactic objects for findings with MITRE ATT&CK compliance metadata.
Prowler MCP Server gains three tool families — Integrations (Amazon S3, AWS Security Hub, Jira lifecycle management and Jira ticket creation), Users (tenant user listing and authenticated-user identification), and Roles (RBAC role browsing and user-role assignment) — available on both the Cloud and self-hosted Local MCP Server.
Prowler MCP Cloud Server at https://mcp.prowler.com/mcp adds 32 tools in the prowler_cloud_* namespace covering Alerts (rule creation/management, dry-run, and fired-alert history), Findings Triage (status and notes), Scan Scheduling (daily, interval, weekly, or monthly per-provider or bulk), and Scan Configurations (reusable check/compliance selections attached to providers).
Lighthouse AI in Prowler Cloud gains page-aware context (current page, open finding or resource, and its metadata) and access to all Prowler MCP Server tool families, gated by RBAC.
GCP Organization onboarding now supports a single guided flow: provide an organization-level credential, browse the full folder/project hierarchy in a selection tree, set aliases, test the connection, and register each selected project as a provider in one operation.
Compliance section now groups results for all providers of the same type under a single framework card with per-provider breakdown, findings drill-down, and a combined executive PDF report; the tabs are renamed to Single Scan and Multiple Scans, with Multiple Scans as the new default landing tab.

13 details in Everything

advisory CVE-2026-73262 Aug 3, 2026 · issue 128

CVE-2026-73262: Stored XSS in HTML reports through unescaped cloud resource tags (CVSS 5.4, affects <= 5.36.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

5.37.0 Aug 3, 2026 · issue 035

Prowler 5.37.0 adds Huawei Cloud, 11 Nitro Enclave checks, 4 attack-path queries, MCP integrations/users/roles, and OCSF MITRE ATT&CK enrichment.

└──▷ GET THIS VERSION

$ git clone --branch 5.37.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.37.0

└──▷ TRY IT

Scan a Huawei Cloud account for the first time using IAM user access key credentials.

$ export HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id"
export HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key"
prowler huaweicloud

Adds HUAWEICLOUD_ACCESS_KEY_ID and HUAWEICLOUD_SECRET_ACCESS_KEY environment variables to authenticate a new huaweicloud provider, enabling prowler huaweicloud scans across 25 checks covering CTS, ECS, ELB, EVS, IAM, KMS, OBS, RDS, VPC, and WAF, plus the CIS Huawei Cloud Foundations Benchmark 1.0.
Adds 11 new AWS Nitro Enclaves CSPM checks: five ec2_confidential_workload_host_* checks for parent-instance hygiene (IMDSv2, public IP, ingress, vsock proxy ports, host state) and six kms_key_enclave_* checks for KMS attestation-policy correctness, mapped across 23 compliance frameworks including NIST 800-53 Rev 5, PCI-DSS v4.0, ISO 27001:2022, SOC 2, HIPAA, and MITRE ATT&CK.
Adds four AWS privilege-escalation Attack Path queries: STS-002 (cross-account role trust), STS-003 (wildcard role trust), IAM-022 (user permissions-boundary removal), and SSO-001 (IAM Identity Center permission-set escalation).
Adds codecommit_repository_no_secrets check (and new codecommit service) to scan files at the tip of each repository's default branch for hardcoded secrets.
Adds glue_catalog_connection_no_secrets check to detect secrets in Glue Data Catalog connection properties.

+8 more show less

Adds sagemaker_endpoint_config_kms_encryption_enabled check to verify SageMaker endpoint configurations use a KMS key for storage volume encryption.
Populates finding_info.analytic and finding_info.attacks in OCSF detection finding output with Prowler check rules and MITRE ATT&CK technique/tactic objects for findings that carry MITRE ATT&CK compliance metadata.
Extends Prowler MCP Server (Cloud and self-hosted Local) with three new tool families: Integrations (full lifecycle for Amazon S3, AWS Security Hub, and Jira — create, update, re-check, delete, and dispatch findings as Jira work items), Users (list tenant users and identify the authenticated user), and Roles (browse RBAC roles, inspect capabilities, and set a user's role).
Adds a prowler_cloud_* namespace of 32 Cloud-only MCP tools (exposed at https://mcp.prowler.com/mcp) covering Alerts (create/manage alert rules, dry-run conditions, browse fired-alert history), Findings Triage (set triage status and attach notes), Scan Scheduling (daily, interval, weekly, or monthly recurring scans per provider or bulk), and Scan Configurations (build reusable configs and attach to providers).
Lighthouse AI (Prowler Cloud/Private Cloud) is now context-aware: messages carry the current page, open finding or resource, and its metadata, and Lighthouse can now invoke all MCP tool families (scan configurations, scheduling, finding triage, alert rules, integrations, users, and roles) subject to RBAC.
Compliance view in Prowler Cloud now groups frameworks across all providers of the same type, rolling up into a consolidated posture with per-provider breakdown, findings drill-down, and combined executive PDF report; tabs are renamed to Single Scan and Multiple Scans, with Multiple Scans as the new default.
GCP Organization onboarding in Prowler Cloud is now a single guided flow: provide an org-level credential, select folders and projects from a hierarchy tree, set aliases, test the connection, and register each project as a provider.
Attack Paths query info panel now links every query to its page on Prowler Hub.

13 details in Everything

5.37.0 Aug 3, 2026 · issue 006

Prowler 5.37.0 adds Huawei Cloud, 11 Nitro Enclave checks, 4 attack-path queries, MCP integrations/users/roles, and OCSF MITRE ATT&CK enrichment.

└──▷ GET THIS VERSION

$ git clone --branch 5.37.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.37.0

└──▷ TRY IT

Scan a Huawei Cloud account for the first time using IAM user access key credentials.

$ export HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id"
export HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key"
prowler huaweicloud

Adds HUAWEICLOUD_ACCESS_KEY_ID and HUAWEICLOUD_SECRET_ACCESS_KEY environment variables to authenticate a new huaweicloud provider, enabling prowler huaweicloud scans across 25 checks covering CTS, ECS, ELB, EVS, IAM, KMS, OBS, RDS, VPC, and WAF, plus the CIS Huawei Cloud Foundations Benchmark 1.0.
Adds 11 new AWS Nitro Enclaves CSPM checks: five ec2_confidential_workload_host_* checks for parent-instance hygiene (IMDSv2, public IP, ingress, vsock proxy ports, host state) and six kms_key_enclave_* checks for KMS attestation-policy correctness, mapped across 23 compliance frameworks including NIST 800-53 Rev 5, PCI-DSS v4.0, ISO 27001:2022, SOC 2, HIPAA, and MITRE ATT&CK.
Adds four AWS privilege-escalation Attack Path queries: STS-002 (cross-account role trust), STS-003 (wildcard role trust), IAM-022 (user permissions-boundary removal), and SSO-001 (IAM Identity Center permission-set escalation).
Adds codecommit_repository_no_secrets check (and new codecommit service) to scan files at the tip of each repository's default branch for hardcoded secrets.
Adds glue_catalog_connection_no_secrets check to detect secrets in Glue Data Catalog connection properties.

+8 more show less

Adds sagemaker_endpoint_config_kms_encryption_enabled check to verify SageMaker endpoint configurations use a KMS key for storage volume encryption.
Populates finding_info.analytic and finding_info.attacks in OCSF detection finding output with Prowler check rules and MITRE ATT&CK technique/tactic objects for findings that carry MITRE ATT&CK compliance metadata.
Extends Prowler MCP Server (Cloud and self-hosted Local) with three new tool families: Integrations (full lifecycle for Amazon S3, AWS Security Hub, and Jira — create, update, re-check, delete, and dispatch findings as Jira work items), Users (list tenant users and identify the authenticated user), and Roles (browse RBAC roles, inspect capabilities, and set a user's role).
Adds a prowler_cloud_* namespace of 32 Cloud-only MCP tools (exposed at https://mcp.prowler.com/mcp) covering Alerts (create/manage alert rules, dry-run conditions, browse fired-alert history), Findings Triage (set triage status and attach notes), Scan Scheduling (daily, interval, weekly, or monthly recurring scans per provider or bulk), and Scan Configurations (build reusable configs and attach to providers).
Lighthouse AI (Prowler Cloud/Private Cloud) is now context-aware: messages carry the current page, open finding or resource, and its metadata, and Lighthouse can now invoke all MCP tool families (scan configurations, scheduling, finding triage, alert rules, integrations, users, and roles) subject to RBAC.
Compliance view in Prowler Cloud now groups frameworks across all providers of the same type, rolling up into a consolidated posture with per-provider breakdown, findings drill-down, and combined executive PDF report; tabs are renamed to Single Scan and Multiple Scans, with Multiple Scans as the new default.
GCP Organization onboarding in Prowler Cloud is now a single guided flow: provide an org-level credential, select folders and projects from a hierarchy tree, set aliases, test the connection, and register each project as a provider.
Attack Paths query info panel now links every query to its page on Prowler Hub.

13 details in Everything

docs update Aug 1, 2026 · issue 032

Prowler adds Huawei Cloud provider support, scanning compute, storage, IAM, networking, and more across all three Huawei clouds.

└──▷ TRY IT

Scan your entire Huawei Cloud Europe account for misconfigurations across all supported services.

$ export HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id"
export HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key"
prowler huaweicloud --cloud europe

Check only IAM and OBS bucket public-access findings across two specific International regions.

$ export HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id"
export HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key"
prowler huaweicloud --region ap-southeast-1 ap-southeast-2 --checks obs_bucket_public_access iam_user_mfa_enabled

Scope a scan to IAM checks only across all China regions using environment variables instead of flags.

$ export HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id"
export HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key"
export HUAWEICLOUD_CLOUD="cn"
prowler huaweicloud --services iam

New huaweicloud provider enables security misconfiguration scanning across Huawei Cloud compute (ECS), storage (OBS, EVS), networking (VPC, ELB), IAM, KMS, RDS, CTS, and WAF services.
Supports all three Huawei Cloud environments — International (.com), China (.com/cn-* regions), and Huawei Cloud Europe (.eu) — with automatic endpoint selection per region.
New --cloud flag (values: international, europe, china) expands a scan to every region in the selected cloud without manual region listing.
Credentials read exclusively from HUAWEICLOUD_ACCESS_KEY_ID and HUAWEICLOUD_SECRET_ACCESS_KEY environment variables, keeping secrets out of shell history and process listings.
Automatic per-region project ID resolution enables multi-region scans without any project configuration.

+1 more show less

Unsupported regions for a given service are silently skipped and logged, so whole-cloud scans never fail on partial service availability.

6 details in Everything

docs update Aug 1, 2026 · issue 032

Prowler adds Huawei Cloud as a supported cloud provider for security assessments.

docs update Aug 1, 2026 · issue 032

Prowler adds E2E Networks provider, cross-provider compliance, Lighthouse AI actions, one-step AWS Organizations onboarding, and new checks across AWS/Azure/Kubernetes.

└──▷ TRY IT

Scan an E2E Networks account for misconfigurations across compute, networking, and storage using the new provider.

$ export E2E_NETWORKS_API_KEY="your-api-key"
export E2E_NETWORKS_AUTH_TOKEN="your-auth-token"
export E2E_NETWORKS_PROJECT_ID="your-project-id"
prowler e2enetworks

New provider: Scans E2E Networks with 27 checks covering compute, networking, security groups, load balancers, storage, and managed databases via prowler e2enetworks.
Cross-Provider Compliance rolls up the most recent scan of every compatible provider into a single compliance posture per framework (CIS Controls 8.1, CSA CCM 4.0, DORA 2022/2554) with a combined executive PDF report.
Lighthouse AI can now take actions: connect/remove providers, trigger and schedule scans, update scan settings, and manage mutelists — all gated by RBAC.
Lighthouse AI side panel lets users ask questions about findings without leaving the current page, with tabs switching between Details and AI chat.
One-step AWS Organizations onboarding deploys the management account role and a service-managed StackSet to every member account via a single CloudFormation quick-create link.

+15 more show less

Scan configurations now accept excluded_checks and excluded_services to skip individual checks or entire services, reducing noise and scan time.
New tutorials for connecting AI agents to Prowler Cloud via API key to query security posture programmatically.
Attack Paths queries now record which built-in queries returned data per scan; the query selector hides confirmed-empty queries and all queries are published on Prowler Hub.
Finding Groups and mixed selections can now be sent to Jira as one grouped issue or separate issues, with Prowler context and deep links preserved.
OCI provider credentials no longer require a region, simplifying onboarding.
New AWS check sagemaker_notebook_instance_no_secrets scans SageMaker notebook OnCreate/OnStart lifecycle scripts for hardcoded secrets.
New AWS check ec2_ami_account_block_public_access verifies AMI block public access is enabled at the account level per region.
New AWS check datapipeline_pipeline_no_secrets_in_definition scans Data Pipeline object fields and parameter values for hardcoded secrets.
New AWS check elbv2_listener_pqc_tls_enabled verifies ELBv2 HTTPS/TLS listeners use post-quantum TLS security policies with TLS 1.2+.
New AWS check amplify_app_no_secrets_in_environment scans Amplify app and branch environment variables and build settings for hardcoded secrets.
New Azure check app_function_ensure_http_is_redirected_to_https verifies Function Apps enforce HTTPS-only traffic.
New Kubernetes check core_minimize_hostpath_volume_mounts detects Pods using hostPath volumes.
New Kubernetes check core_readonly_root_filesystem_enabled verifies every container explicitly sets readOnlyRootFilesystem: true.
Prowler product family renamed: Prowler Enterprise is now Prowler Private Cloud, and Prowler App is now Prowler Local Server.
Kubernetes kubeconfig validation now blocks legacy auth-provider.config.cmd-path command authentication.

20 details in Everything

docs update Aug 1, 2026 · issue 032

Prowler adds Huawei Cloud support, cross-provider compliance roll-ups, and Attack Paths active query tracking.

Adds Huawei Cloud as a supported provider, including authentication configuration and a getting-started guide.
Adds cross-provider compliance aggregation to consolidate a single-provider framework across every provider of the same type, with roll-up view and combined PDF report download.
Adds cross-provider type compliance aggregation to unify a universal compliance framework across every compatible provider with a completed scan, with per-provider breakdown and combined PDF report.
Adds Attack Paths active queries view that records query results after each scan and hides confirmed-empty queries from the selector in Prowler Cloud and Prowler Private Cloud.

4 details in Everything

docs update Aug 1, 2026 · issue 032

Prowler adds Huawei Cloud support, extending multi-cloud security assessments to a new provider.

docs update Aug 1, 2026 · issue 032

Prowler adds Huawei Cloud as a supported cloud provider for security assessments.

advisory CVE-2026-73263 Jul 29, 2026 · issue 128

CVE-2026-73263: RCE on Prowler App workers via kubeconfig auth-provider cmd-path (CVSS 9.9, affects < 5.36.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

docs update Jul 24, 2026 · issue 024

Prowler adds Claude Code integration via MCP Server and a Prowler Plugin with guided cloud compliance workflows.

└──▷ TRY IT

Connect the Prowler MCP Server to Claude Code at user scope so it loads across all projects and in the desktop app's Code tab.

$ export PROWLER_API_KEY="pk_your_api_key_here"
claude mcp add --transport http prowler https://mcp.prowler.com/mcp \
  --header "Authorization: Bearer $PROWLER_API_KEY" \
  --scope user

Install the Prowler Plugin inside a Claude Code session to get guided multi-step compliance workflows without manual MCP configuration.

$ /plugin marketplace add prowler-cloud/prowler
/plugin install prowler@prowler-plugins

Trigger the framework compliance triage skill to remediate all CIS 4.0 findings on an AWS account with Claude guiding each fix.

📍Make my AWS production account compliant with CIS 4.0.

New Prowler MCP Server at https://mcp.prowler.com/mcp enables Claude Code to query findings, onboard accounts, and explore checks directly from the CLI.
New Prowler Plugin for Claude Code bundles official skills, including prowler:framework-compliance-triage for end-to-end compliance remediation against frameworks like CIS, PCI-DSS, and Prowler ThreatScore.
Compliance triage skill supports two modes: Claude-assisted (step-by-step approval) and Claude autonomous (single up-front plan with one confirmation), tracking progress in a markdown report under .prowler/.
Plugin manages API key storage securely (macOS keychain or ~/.claude/.credentials.json) and removes the key automatically on uninstall.
MCP Server connection supports --scope user to make Prowler tools available across all projects and inside the Claude desktop app's Code tab.

5 details in Everything

docs update Jul 24, 2026 · docs issue 004

Prowler adds Claude Code integration via MCP Server and a Prowler Plugin with guided cloud compliance workflows.

└──▷ TRY IT

Connect the Prowler MCP Server to Claude Code at user scope so it loads across all projects and in the desktop app's Code tab.

$ export PROWLER_API_KEY="pk_your_api_key_here"
claude mcp add --transport http prowler https://mcp.prowler.com/mcp \
  --header "Authorization: Bearer $PROWLER_API_KEY" \
  --scope user

Install the Prowler Plugin inside a Claude Code session to get guided multi-step compliance workflows without manual MCP configuration.

$ /plugin marketplace add prowler-cloud/prowler
/plugin install prowler@prowler-plugins

Trigger the framework compliance triage skill to remediate all CIS 4.0 findings on an AWS account with Claude guiding each fix.

📍Make my AWS production account compliant with CIS 4.0.

New Prowler MCP Server at https://mcp.prowler.com/mcp enables Claude Code to query findings, onboard accounts, and explore checks directly from the CLI.
New Prowler Plugin for Claude Code bundles official skills, including prowler:framework-compliance-triage for end-to-end compliance remediation against frameworks like CIS, PCI-DSS, and Prowler ThreatScore.
Compliance triage skill supports two modes: Claude-assisted (step-by-step approval) and Claude autonomous (single up-front plan with one confirmation), tracking progress in a markdown report under .prowler/.
Plugin manages API key storage securely (macOS keychain or ~/.claude/.credentials.json) and removes the key automatically on uninstall.
MCP Server connection supports --scope user to make Prowler tools available across all projects and inside the Claude desktop app's Code tab.

5 details in Everything

docs update Jul 24, 2026 · issue 024

Prowler adds an MCP Server for AI agent integration and launches a dedicated MSP/MSSP multi-tenant offering.

New Prowler MCP Server enables AI agents (Claude, Cursor, VS Code/GitHub Copilot, Codex/ChatGPT Desktop) to connect directly to Prowler Cloud for security query workflows.
New Prowler for MSPs and MSSPs tier adds partner organization management, customer tenant onboarding, custom branding, and billing plan controls.

2 details in Everything

docs update Jul 24, 2026 · docs issue 004

Prowler adds an MCP Server for AI agent integration and launches a dedicated MSP/MSSP multi-tenant offering.

New Prowler MCP Server enables AI agents (Claude, Cursor, VS Code/GitHub Copilot, Codex/ChatGPT Desktop) to connect directly to Prowler Cloud for security query workflows.
New Prowler for MSPs and MSSPs tier adds partner organization management, customer tenant onboarding, custom branding, and billing plan controls.

2 details in Everything

5.36.0 Jul 24, 2026 · issue 024

Prowler 5.36.0 adds SageMaker secrets detection, grouped Jira dispatch, cleaner Attack Paths UI, and regionless OCI onboarding.

└──▷ GET THIS VERSION

$ git clone --branch 5.36.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.36.0

New sagemaker_notebook_instance_no_secrets check scans SageMaker notebook instance OnCreate and OnStart lifecycle scripts for hardcoded API keys, passwords, tokens, and connection strings.
Grouped Jira workflows (Prowler Cloud/Private Cloud): send selected findings or Finding Groups to Jira as one grouped issue or separate issues, with deep links and filter context preserved.
Attack Paths query selector now hides confirmed-empty queries for the selected scan, surfacing only paths that returned data; full catalog published on Prowler Hub.
OCI provider setup no longer requires a region — SDK handles region discovery automatically, simplifying onboarding.
New AI agents tutorials and overview banner guide users through connecting AI agents to Prowler Cloud via the API to query and act on security posture programmatically.

+1 more show less

Compliance overview ingest now runs in a single transaction per scan with a configurable DJANGO_COMPLIANCE_COPY_BATCH_SIZE (default 2000), reducing database write pressure at scale.

6 details in Everything

5.35.0 Jul 17, 2026 · issue 018

Prowler 5.35.0 adds Lighthouse AI side chat and actions, one-step AWS Org onboarding, scan exclusions, and a redesigned sidebar.

└──▷ GET THIS VERSION

$ git clone --branch 5.35.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.35.0

Adds Lighthouse AI side panel: open a context-aware AI chat from anywhere in the app without leaving the current page, with tabs to switch between finding details and the chat (Prowler Cloud/Private Cloud).
Enables Lighthouse AI to take actions: connect/remove providers, trigger and schedule scans, update scan settings, and manage mute rules via chat, gated by RBAC (Prowler Cloud/Private Cloud).
Adds one-step AWS Organizations onboarding: a single CloudFormation quick-create link deploys the management account role and a service-managed StackSet to every member account (Prowler Cloud/Private Cloud).
Adds excluded_checks and excluded_services fields to scan configurations, allowing entire checks or services to be skipped per provider for faster, lower-noise scans.
Introduces a redesigned sidebar with grouped sections for security, settings, and help, collapsible configuration entries, route-aware active states, and a responsive mobile overlay.

+2 more show less

Renames core Prowler MCP tools from the prowler_app_* prefix to the shorter prowler_* namespace; legacy prowler_app_* names remain functional.
Enables dynamic providers to be renamed and deleted directly from the Providers table.

7 details in Everything

5.34.0 Jul 15, 2026 · issue 017

Prowler 5.34.0 adds E2E Networks provider, 9 new security checks across AWS/Azure/Kubernetes/STACKIT, and cross-provider compliance rollup.

└──▷ GET THIS VERSION

$ git clone --branch 5.34.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.34.0

└──▷ TRY IT

Scan your E2E Networks environment for misconfigurations across compute, networking, and storage after setting your API credentials.

$ export E2E_NETWORKS_API_KEY="your-api-key"
export E2E_NETWORKS_AUTH_TOKEN="your-auth-token"
export E2E_NETWORKS_PROJECT_ID="your-project-id"
prowler e2enetworks

New provider: Scans E2E Networks with 27 checks covering compute nodes, networking, security groups, load balancers, block/file storage, and managed databases.
New AWS check ec2_ami_account_block_public_access: verifies AMI block public access is enabled at the account level per region.
New AWS check datapipeline_pipeline_no_secrets_in_definition: scans Data Pipeline object fields, parameter objects, and parameter values for hardcoded secrets using Kingfisher.
New AWS check elbv2_listener_pqc_tls_enabled: verifies ELBv2 HTTPS/TLS listeners use post-quantum TLS security policies (TLS 1.2+) to reduce harvest-now-decrypt-later exposure.
New AWS check amplify_app_no_secrets_in_environment: scans Amplify app and branch environment variables and build settings (buildSpec) for hardcoded secrets using Kingfisher.

+6 more show less

New Azure check app_function_ensure_http_is_redirected_to_https: verifies that Function Apps enforce HTTPS-only traffic.
New Kubernetes check core_minimize_hostpath_volume_mounts: detects Pods that use hostPath volumes.
New Kubernetes check core_readonly_root_filesystem_enabled: verifies every container in each Pod explicitly sets readOnlyRootFilesystem: true in its security context.
New STACKIT check iaas_server_public_ip_attached: flags IaaS servers with a public IP address directly attached to a network interface.
New Cross-Provider Compliance view (Prowler Cloud/Private Cloud): rolls up the most recent scan of every compatible provider into a single compliance posture per framework (CIS Controls 8.1, CSA CCM 4.0, DORA 2022/2554) with per-provider breakdown and combined executive PDF export.
UI now lists, filters, and renders dynamically registered (custom) providers with a generic icon, humanized label, and Custom badge when no bespoke assets exist.

11 details in Everything

└──▷ BREAKING ON UPGRADE

!UI integration enable flags renamed: UI_SENTRY_ENABLE → UI_SENTRY_ENABLED, UI_GOOGLE_TAG_MANAGER_ENABLE → UI_GOOGLE_TAG_MANAGER_ENABLED, UI_POSTHOG_ENABLE → UI_POSTHOG_ENABLED; deployments that set the former names must update them.

advisory CVE-2026-73264 Jul 10, 2026 · issue 128

CVE-2026-73264: Server-Side Request Forgery (SSRF) in Lighthouse Provider (CVSS 7.6, affects <=5.33.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

5.33.1 Jul 10, 2026 · release notes

Prowler 5.33.1 adds a new env var to allowlist internal OpenAI-compatible Lighthouse AI hosts.

└──▷ GET THIS VERSION

$ git clone --branch 5.33.1 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.33.1

New LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS environment variable lets operators permit internal hosts as OpenAI-compatible Lighthouse AI base URLs.

1 detail in Everything

5.33.0 Jul 7, 2026 · issue 008

Prowler 5.33.0 adds agentic Lighthouse AI assistant, credential-free compliance PDFs, and scan queueing.

└──▷ GET THIS VERSION

$ git clone --branch 5.33.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.33.0

New Lighthouse AI agentic assistant (Prowler Cloud/Enterprise) queries findings, compliance posture, and risky resources using configurable LLM providers (OpenAI, Amazon Bedrock, or any OpenAI-compatible endpoint).
Persistent chat sessions with real-time streaming, session history, archiving, and a sidebar chat mode accessible from any page in the Prowler Cloud UI.
Compliance PDF reports now generate without active provider credentials, drawing on provider metadata stored in the database.
Overlapping scans for the same provider now queue behind the active scan instead of running concurrently, eliminating duplicate or racing scan workers.
Kubernetes provider rejects kubeconfigs using exec authentication in Prowler Cloud, blocking user-supplied commands from executing on Cloud workers.

5 details in Everything

5.32.0 Jul 2, 2026 · issue 007

Prowler 5.32.0 adds Kingfisher secret scanning, Azure resource-group scoping, Okta throttling, AWS resource caps, Neptune graph sink, and 6 new checks.

└──▷ GET THIS VERSION

$ git clone --branch 5.32.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.32.0

└──▷ TRY IT

Validate discovered secrets against live provider APIs so only working credentials are flagged critical — useful in CI to triage real leaks from noise.

$ prowler aws --scan-secrets-validate

Scope an Azure assessment to specific teams' resource groups to cut scan time and limit result scope during a targeted review.

$ prowler azure --az-cli-auth --azure-resource-group rg-prod1 rg-prod2

Prevent Okta rate-limit errors on large tenants by capping request rate and bounding retries.

$ prowler okta --okta-requests-per-second 2 --okta-retries-max-attempts 10

New secret-scanning engine: replaces detect-secrets with Kingfisher, runs fully offline, suppresses placeholder false positives, and adds --scan-secrets-validate / aws.secrets_validate for live credential verification (confirmed live secrets reported as critical).
Azure scans now support --azure-resource-group / --azure-resource-groups to scope assessments to one or more resource groups instead of the entire subscription.
Okta provider adds configurable API request throttling (--okta-requests-per-second, default 4 req/s) and retry cap (--okta-retries-max-attempts, default 5) to survive rate limits on large tenant scans.
AWS scans can now cap the number of resources analyzed per high-volume service via max_scanned_resources_per_service (global) or per-service limits: max_ebs_snapshots, max_backup_recovery_points, max_cloudwatch_log_groups, max_lambda_functions, max_ecs_task_definitions, max_codeartifact_packages.
Attack Paths gains AWS Neptune as a persistent graph sink alongside Neo4j, selectable via ATTACK_PATHS_SINK_DATABASE=neptune, enabling managed, larger-scale cross-provider graph storage.

+13 more show less

New AWS check stepfunctions_statemachine_encrypted_with_cmk: flags Step Functions state machines not using a customer-managed KMS key.
New AWS check waf_regional_webacl_logging_enabled: flags AWS WAF Classic Regional Web ACLs without Kinesis Data Firehose logging.
New AWS check apigateway_restapi_no_secrets_in_stage_variables: scans API Gateway REST API stage variables for hardcoded passwords, API keys, and tokens.
New AWS check s3_bucket_object_public: spot-checks object ACLs for public grants (AllUsers/AuthenticatedUsers); opt in via s3_bucket_object_public_enabled config option.
awslambda_function_no_secrets_in_code adds secrets_ignore_files audit-config option to skip files by glob pattern (e.g. *.deps.json), suppressing .NET dependency-manifest false positives.
IAM privilege-escalation checks now cover AWS Bedrock AgentCore paths (Runtime, Harness, Code Interpreter, Custom Browser).
New Microsoft 365 Conditional Access checks: entra_conditional_access_policy_explicitly_targets_azure_devops and entra_conditional_access_policy_no_exclusion_gaps, plus Entra Conditional Access group management restriction check.
Compliance frameworks can now declare ConfigRequirements on a requirement, marking it FAIL when mapped checks ran under a configuration too permissive to satisfy it — reflected in CSV, OCSF, and console outputs.
New compliance frameworks added: CIS 7.0 for AWS, CIS 7.0 for M365, CIS 6.0 for Azure, CIS 5.0 for GCP, CIS Controls v8.1 universal framework, CIS 1.2 for GitHub, CIS 2.0.1 for Kubernetes.
GitHub branch-protection checks now evaluate repository rulesets in addition to branch protection rules.
API /api/v1/findings endpoint accepts full ISO 8601 timestamps on filter[inserted_at__gte], filter[inserted_at__lte], filter[updated_at__gte], and filter[updated_at__lte] filters for precise time-window queries.
Prowler Cloud/Enterprise: Scan Configuration management page enables named, reusable YAML scan configs validated against a per-provider schema and attachable to one or more providers.
Prowler Cloud/Enterprise: Provider Group Filter scopes the Overview, Findings, Resources, Scans, and Providers views to a team or environment in a single click.

18 details in Everything

└──▷ BREAKING ON UPGRADE

!The detect_secrets_plugins configuration option has been removed, as it is no longer used by the new secret-scanning engine (Kingfisher).

5.31.0 Jun 23, 2026 · release notes

Prowler 5.31.0 adds Linode provider, post-quantum crypto checks, DORA coverage for Azure/GCP/Cloudflare/Alibaba, and 40+ new checks across AWS, Azure, GCP, K8s, and M365.

└──▷ GET THIS VERSION

$ git clone --branch 5.31.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.31.0

└──▷ TRY IT

Assess your AWS environment against the DORA regulation framework to report on all five resilience pillars.

$ prowler aws --compliance DORA_2022_2554

Scan a Linode account to enumerate administration, compute, and networking findings.

$ prowler linode

New provider: Scans Linode (Akamai Cloud) covering administration, compute, and networking services.
Adds DORA (2022/2554) compliance framework mapping to Azure, GCP, Cloudflare, and Alibaba Cloud providers (use framework name DORA_2022_2554).
New AWS post-quantum cryptography readiness checks: cloudfront_distributions_pqc_tls_enabled, apigateway_domain_name_pqc_tls_enabled, transfer_server_pqc_ssh_kex_enabled, acmpca_certificate_authority_pqc_key_algorithm (new acmpca service), and rolesanywhere_trust_anchor_pqc_pki (new rolesanywhere service).
New AWS organization-wide governance checks: securityhub_delegated_admin_enabled_all_regions and config_delegated_admin_and_org_aggregator_all_regions.
New AWS ML check: sagemaker_clarify_exists verifies at least one SageMaker Clarify processing job exists per region for bias-detection and explainability controls.

+9 more show less

New Azure checks spanning Cosmos DB (automatic failover, continuous backup, TLS 1.2, public access), MySQL/PostgreSQL Flexible Servers (geo-redundant backup, high availability), AKS (auto-upgrade, Container Insights, local accounts disabled, Defender), Databricks (public network access, secure cluster connectivity), Defender CSPM, Networking (NSG on subnets, DDoS protection on VNets), Entra ID (credential expiry, sign-in, strong auth), and Recovery Services vaults.
New GCP checks: cloudsql_instance_high_availability_enabled, cloudfunction_function_inside_vpc, cloudfunction_function_not_publicly_accessible, secretmanager_secret_not_publicly_accessible, and secretmanager_secret_rotation_enabled.
New Kubernetes checks for container resource governance: CPU limits, CPU requests, memory limits, memory requests, fixed image tags, liveness probes, and readiness probes.
New Microsoft 365 checks: entra_directory_sync_object_takeover_blocked and entra_conditional_access_policy_no_deleted_object_references.
New OCI check: identity_storage_service_level_admins_scoped (CIS 3.1 control 1.15) ensures storage admins exclude delete permissions.
Prowler SDK now supports Python 3.13.
Flexible per-provider scan scheduling in Prowler Cloud with daily, 48-hour, weekly, and monthly cadence options via the Providers page and a new Scheduled tab in Scan Jobs.
Guided onboarding experience in Prowler Cloud with contextual empty states and first-provider prompts.
SAML SSO userType attribute is now optional; missing or blank values preserve existing user roles rather than applying a fallback role.

14 details in Everything

5.31.0 Jun 23, 2026 · issue 007

Prowler 5.31.0 adds Linode provider, post-quantum AWS checks, DORA coverage for Azure/GCP/Cloudflare/Alibaba, and 30+ new checks across AWS, Azure, GCP, K8s, and M365.

└──▷ GET THIS VERSION

$ git clone --branch 5.31.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.31.0

└──▷ TRY IT

Scan a Linode account for security misconfigurations across administration, compute, and networking services.

$ prowler linode

Run all post-quantum cryptography readiness checks against your AWS environment to identify gaps before the quantum migration deadline.

$ prowler aws --checks cloudfront_distributions_pqc_tls_enabled apigateway_domain_name_pqc_tls_enabled transfer_server_pqc_ssh_kex_enabled acmpca_certificate_authority_pqc_key_algorithm rolesanywhere_trust_anchor_pqc_pki

Assess your AWS or Azure environment against the DORA regulatory framework to produce an EU Digital Operational Resilience Act compliance report.

$ prowler aws --compliance DORA_2022_2554

New linode provider: scans Linode (Akamai Cloud) administration, compute, and networking services via prowler linode.
New AWS post-quantum cryptography checks: cloudfront_distributions_pqc_tls_enabled, apigateway_domain_name_pqc_tls_enabled, transfer_server_pqc_ssh_kex_enabled, acmpca_certificate_authority_pqc_key_algorithm (new acmpca service), and rolesanywhere_trust_anchor_pqc_pki (new rolesanywhere service).
New AWS org-wide governance checks: securityhub_delegated_admin_enabled_all_regions and config_delegated_admin_and_org_aggregator_all_regions.
New AWS ML check: sagemaker_clarify_exists verifies at least one SageMaker Clarify processing job exists per region.
Extends DORA (EU 2022/2554) compliance framework coverage to Azure, GCP, Cloudflare, and Alibaba Cloud under the DORA_2022_2554 framework identifier.

+9 more show less

New Azure checks across Cosmos DB (automatic failover, continuous backup, TLS 1.2, public access disabled), MySQL/PostgreSQL Flexible Servers (geo-redundant backup, HA), AKS (auto-upgrade, Container Insights, local accounts disabled, Defender), Databricks (public access, secure connectivity), Defender CSPM Standard tier, NSG subnet association, DDoS VNet protection, Entra ID credential expiry and strong auth, and Recovery Services vaults.
New GCP checks: cloudsql_instance_high_availability_enabled, cloudfunction_function_inside_vpc, cloudfunction_function_not_publicly_accessible, secretmanager_secret_not_publicly_accessible, and secretmanager_secret_rotation_enabled.
New Kubernetes checks for CPU/memory limits and requests, fixed image tags, liveness probes, and readiness probes.
New M365 checks: entra_directory_sync_object_takeover_blocked and entra_conditional_access_policy_no_deleted_object_references.
New OCI check: identity_storage_service_level_admins_scoped (CIS 3.1 control 1.15) ensuring storage admins exclude delete permissions.
Prowler SDK now supports Python 3.13.
Optional SAML SSO userType attribute: when absent or blank, Prowler preserves existing user roles instead of applying a fallback role.
Prowler Cloud: flexible per-provider scan scheduling with Daily, Every 48 hours, Weekly, or Monthly cadences configurable from the Providers page.
Prowler Cloud: guided onboarding experience for new accounts with contextual empty states throughout the product.

14 details in Everything

advisory CVE-2026-59151 Jun 22, 2026 · issue 128

CVE-2026-59151: SAML Domain Claiming Enables Cross-Tenant Account Takeover (CVSS 9.6, affects <= 5.30.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

5.30.0 Jun 11, 2026 · release notes

Prowler 5.30.0 adds complete Okta DISA STIG V1R2 coverage, the DORA universal compliance framework, and 10+ new checks across AWS, M365, GCP, and StackIT.

└──▷ GET THIS VERSION

$ git clone --branch 5.30.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.30.0

Adds complete DISA Okta IDaaS STIG V1R2 framework coverage with 18 new checks spanning user inactivity, password policy, MFA hardening, smart card, network zones, API tokens, and system log streaming.
Introduces DORA (Digital Operational Resilience Act) as Prowler's first universal compliance framework, mapping AWS checks across the five DORA pillars with OCSF Compliance Finding export support.
New AWS check sagemaker_models_monitor_enabled verifies each SageMaker monitoring schedule is in the Scheduled state to catch data and model drift.
New AWS check elbv2_alb_drop_invalid_header_fields_enabled verifies Application Load Balancers drop invalid HTTP header fields to mitigate HTTP desync attacks (FSBP ELB.4).
New AWS check bedrock_agent_role_least_privilege verifies Bedrock Agents run with least-privilege IAM roles.

+7 more show less

New M365 check entra_service_principal_privileged_role_no_owners flags privileged service principals that have no assigned owners.
New M365 check exchange_mailbox_primary_smtp_custom_domain verifies mailbox primary SMTP addresses use a custom domain.
GCP kms_key_rotation_enabled is split into two focused checks: one for rotation being enabled and one enforcing a maximum 90-day rotation period.
New StackIT objectstorage service with three checks: Object Lock (WORM protection), retention policy enforcement, and access key expiration.
Adds support for external/custom providers, checks, and compliance frameworks without modifying Prowler core code.
Postgres connections are now labeled with application_name="<component>:<alias>" (set via DJANGO_APP_COMPONENT) for per-component attribution in pg_stat_activity.
UI adds dedicated compliance detail pages and icons for DISA Okta IDaaS STIG V1R2 and DORA frameworks.

12 details in Everything

5.30.0 Jun 11, 2026 · issue 007

Prowler 5.30 adds full Okta DISA STIG coverage, a universal DORA compliance framework, 8 new checks across AWS/M365/GCP/StackIT, and self-healing background task recovery.

└──▷ GET THIS VERSION

$ git clone --branch 5.30.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 5.30.0

└──▷ TRY IT

Run all Okta DISA STIG V1R2 checks against your Okta tenant to assess compliance posture end-to-end.

$ prowler okta --compliance disa_okta_idaas_stig_v1r2_okta

Assess your AWS environment against DORA's five operational resilience pillars and export results in OCSF format for ingestion into a SIEM.

$ prowler aws --compliance dora_aws -M json-ocsf

Run the new ALB and SageMaker checks in isolation to validate specific FSBP and AI workload controls without a full scan.

$ prowler aws --check elbv2_alb_drop_invalid_header_fields_enabled sagemaker_models_monitor_enabled

Adds complete DISA Okta IDaaS STIG V1R2 framework coverage for the Okta provider, spanning six new services: user, authenticator, idp, network, apitoken, and systemlog with 17 new checks covering account inactivity, MFA hardening, password policy, smart card, API token privilege, network zone enforcement, and log streaming.
Introduces DORA (Digital Operational Resilience Act) as Prowler's first universal compliance framework — defined once and mapped across providers — currently covering AWS checks across the five DORA pillars and exportable in OCSF Compliance Finding format for SIEM ingestion.
New AWS check sagemaker_models_monitor_enabled verifies each SageMaker monitoring schedule is in the Scheduled state to detect data and model drift.
New AWS check elbv2_alb_drop_invalid_header_fields_enabled verifies Application Load Balancers drop invalid HTTP header fields to mitigate HTTP desync attacks (AWS FSBP ELB.4).
New AWS check bedrock_agent_role_least_privilege verifies Bedrock Agents run with a least-privilege IAM role.

+8 more show less

New M365 check entra_service_principal_privileged_role_no_owners flags privileged service principals with no assigned owners.
New M365 check exchange_mailbox_primary_smtp_custom_domain verifies mailbox primary SMTP addresses use a custom domain.
Splits GCP kms_key_rotation_enabled into two focused checks: one for rotation being enabled and one enforcing a maximum 90-day rotation period.
New StackIT objectstorage service adds three checks: objectstorage_bucket_object_lock_enabled (WORM protection), objectstorage_bucket_retention_policy (default retention enforcement), and objectstorage_access_key_expiration (credential expiry).
Adds support for external/custom providers, checks, and compliance frameworks without modifying core Prowler code, including discovery of external universal compliance frameworks via entry points.
Enables opt-in self-healing background task recovery via DJANGO_TASK_RECOVERY_ENABLED; safe-to-retry tasks (report summaries, cleanups) auto-resume after worker crashes while scan tasks are never blindly re-run.
Adds reconcile_orphan_tasks Django management command for on-demand recovery of orphaned background tasks.
Labels Postgres connections with application_name="<component>:<alias>" (configurable via DJANGO_APP_COMPONENT) for per-component attributability in pg_stat_activity.

13 details in Everything

5.29.2 Jun 3, 2026 · release notes

Prowler 5.29.2 adds provider icons to account/provider-type selector triggers in the UI.

└──▷ GET THIS VERSION

$ git clone --branch 5.29.2 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.29.2

5.29.0 Jun 1, 2026 · release notes

Prowler 5.29.0 adds StackIT provider, 26 new Google Workspace & Okta checks, AWS AI Security Framework compliance, and a redesigned Scan Jobs UI.

└──▷ GET THIS VERSION

$ git clone --branch 5.29.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.29.0

└──▷ TRY IT

Scan a StackIT environment in CI/CD by passing the service account key as inline JSON from a secret manager.

$ prowler stackit --stackit-service-account-key '{"type":"serviceAccountKey","key":"..."}'

Adds StackIT (German sovereign cloud) as a new provider, authenticating via service account key file (--stackit-service-account-key-path) or inline JSON (--stackit-service-account-key) for CI/CD pipelines.
Adds 20 new Google Workspace checks (8 Rules service, 12 Security service) via the Cloud Identity Policy API, completing automated coverage of the CIS Google Workspace Benchmark 1.3.
Adds new application service for the Okta provider with 6 checks covering admin console and dashboard hardening (MFA, phishing-resistant auth, session idle timeout, network zone enforcement).
Adds storage_account_public_network_access_disabled check for Azure that flags storage accounts allowing public network access.
Adds AWS AI Security Framework compliance mapping, linking Prowler checks to AWS AI/ML security guidance.

+4 more show less

Speeds up GET /api/v1/finding-groups/latest aggregation on tenants where one recent scan holds most findings.
Redesigns the Scan Jobs UI view with dedicated In Progress, Completed, and Scheduled tabs and a new scan-launch modal for picking accounts and adding scan notes.
Reworks dark mode with a pure-black canvas, pure-white primary text, and brighter border/input tokens for improved legibility.
Supports Azure authentication against sovereign clouds (AzureChinaCloud, AzureUSGovernment).

9 details in Everything

5.28.0 May 22, 2026 · release notes

Prowler 5.28.0 adds Okta App scanning, 4 DISA STIG Okta checks, Google Workspace services/groups checks, new AWS/GCP/M365 checks, and a Claude Code plugin.

└──▷ GET THIS VERSION

$ git clone --branch 5.28.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.28.0

└──▷ TRY IT

Install the Prowler Claude Code plugin to let Claude drive compliance assessments against your Prowler Cloud-connected account.

$ /plugin marketplace add prowler-cloud/prowler
/plugin install prowler@prowler-plugins

Adds Okta provider support in Prowler App with OAuth 2.0 private-key JWT credentials, enabling read-only scanning of Okta tenants from the UI.
Adds four new medium-severity Okta DISA STIG V1R2 checks: signon_global_session_lifetime_18h, signon_global_session_cookies_not_persistent, signon_global_session_policy_network_zone_enforced, and signon_dod_warning_banner_configured.
Adds four new Google Workspace services with six new checks — Sites (sites_service_disabled), Additional Services (additionalservices_external_groups_disabled), Marketplace (marketplace_apps_access_restricted), and Groups (groups_creation_restricted, groups_external_access_restricted, groups_view_conversations_restricted) — via the Cloud Identity Policy API.
Adds new AWS check ses_identity_dkim_enabled to verify DKIM signing is enabled on every SES identity.
Adds new AWS check sagemaker_models_registry_in_use to verify ML governance through the SageMaker Model Registry.

+4 more show less

Adds new M365 check entra_app_registration_client_secret_unused to flag dormant Entra ID app registration client secrets.
Adds new GCP check cloudsql_instance_cmek_encryption_enabled to verify Cloud SQL instances use customer-managed encryption keys.
New Resource Metadata / Evidence tab in the Prowler App finding detail drawer surfaces raw resource attributes captured at scan time, backed by the new resource.metadata attribute on /api/v1/findings?include=resources.
Ships a Claude Code plugin and marketplace entry (prowler-cloud/prowler) enabling Claude to drive end-to-end cloud security and compliance assessments via the Prowler MCP server.

9 details in Everything

└──▷ BREAKING ON UPGRADE

!okta.brands.read is now part of DEFAULT_SCOPES for the Okta provider; existing Okta service apps must grant this scope before upgrading or the signon_dod_warning_banner_configured check will fail.

5.27.0 May 19, 2026 · release notes

Prowler 5.27.0 adds Okta and Scaleway providers, 10 new checks across AWS/M365/GWS, a redesigned Attack Paths graph, and Lighthouse AI Finding Groups support.

└──▷ GET THIS VERSION

$ git clone --branch 5.27.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.27.0

└──▷ TRY IT

Audit an Okta tenant for DISA STIG session policy compliance in minutes using OAuth read-only credentials.

$ export OKTA_ORG_DOMAIN="your-tenant.okta.com"
export OKTA_CLIENT_ID="0oa1234567890abcdef"
export OKTA_PRIVATE_KEY_FILE="/path/to/prowler-okta.pem"
prowler okta

Audit Scaleway IAM to detect root-owned API keys that bypass all IAM policies.

$ prowler scaleway

Include unattached customer-managed IAM policies in your AWS scan (previously the default behaviour) alongside other unused-service surfaces.

$ prowler aws --scan-unused-services

New Okta provider (CLI-only): authenticate via OAuth read-only credentials and audit your Okta tenant; ships with signon_global_session_idle_timeout_15min mapped to DISA STIG V-273186.
New Scaleway provider (unofficial, CLI-only): audit Scaleway IAM with iam_api_keys_no_root_owned to flag root-owned API keys.
Google Workspace gains a Chat service with 6 CIS-mapped checks covering app installation, external file sharing, external messaging, external spaces, incoming webhooks, and internal file sharing.
New AWS check cloudtrail_bedrock_logging_enabled verifies at least one CloudTrail trail records Amazon Bedrock API activity.
New AWS check iam_user_access_not_stale_to_sagemaker flags IAM users with SageMaker access exceeding 90 days (tunable via max_unused_sagemaker_access_days) or who have never accessed SageMaker.

+9 more show less

New AWS check sagemaker_domain_sso_configured verifies SageMaker Domains use IAM Identity Center (SSO) instead of IAM users.
New M365 check entra_service_principal_no_secrets_for_permanent_tier0_roles flags service principals holding credentials for permanent Tier-0 role assignments.
AWS IAM customer-managed policy checks now scan only attached policies by default; opt in to auditing unattached policies with --scan-unused-services.
Attack Paths graph in the Prowler App rewritten on React Flow with improved layout, pan/zoom, image export, and a minimap.
AWS findings and resource details in the Prowler App now include a one-click View in AWS Console link via the /go/view ARN resolver.
Lighthouse AI can now list, filter, and inspect Finding Groups via new Finding Groups MCP tools.
PDF Compliance Reports now include only failed findings and cap per-check detail tables at 100 failed findings with a banner pointing to CSV/JSON exports.
Health endpoint added at GET /api/health for Docker Compose liveness checks.
Prowler API and SDK migrated from poetry to uv for faster, deterministic dependency installs.

14 details in Everything

5.26.0 May 11, 2026 · release notes

Prowler 5.26.0 adds Gmail spoofing/attachment checks, AWS Bedrock hardening, ASD Essential Eight compliance, and a rebuilt finding triage drawer.

└──▷ GET THIS VERSION

$ git clone --branch 5.26.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.26.0

└──▷ TRY IT

Audit your AWS Bedrock deployment for missing Guardrails, unversioned prompts, and unencrypted prompt storage in one pass.

$ prowler aws --checks bedrock_guardrails_configured bedrock_prompt_management_exists bedrock_prompt_encrypted_with_cmk

Adds eight new Google Workspace Gmail checks covering attachment safety (gmail_anomalous_attachment_protection_enabled, gmail_encrypted_attachment_protection_enabled, gmail_script_attachment_protection_enabled) and spoofing protection (gmail_domain_spoofing_protection_enabled, gmail_employee_name_spoofing_protection_enabled, gmail_groups_spoofing_protection_enabled, gmail_inbound_domain_spoofing_protection_enabled, gmail_unauthenticated_email_protection_enabled) via the Cloud Identity Policy API.
Adds three new AWS Bedrock checks: bedrock_guardrails_configured (flags deployments without Guardrails), bedrock_prompt_management_exists (verifies Prompt Management is in use), and bedrock_prompt_encrypted_with_cmk (verifies CMK encryption per prompt).
Adds ASD Essential Eight Maturity Model (Maturity Level One, Nov 2023) as a first-class compliance framework for AWS, with full detail view, top-failed-sections breakdown, and export support.
Adds Prowler Cloud Alerts: auto-provisioned daily digest of critical findings for organization owners, plus custom alert rules scoped by provider, account, severity, or status, with a Create Alert shortcut that converts active Findings page filters into a watching alert rule.
Adds Manage Alerts RBAC permission to gate alert configuration to authorized organization admins.

+5 more show less

Rebuilt finding detail drawer for triage: color-coded status banner at top, dedicated Remediation tab, one-click link to resource page, and immediate status render during carousel navigation.
Adds clickable ThreatScore pillars on /compliance that jump to the detail page with the selected accordion pre-expanded and scrolled into view.
Adds scan-reset-ephemeral-resources post-scan API task that zeroes failed_findings_count for resources absent from the latest full-scope scan, preventing ephemeral resources from polluting the Resources page sort.
Container image CVE findings and IaC findings now link remediation references directly to CVE.org, Prowler Hub, and GitHub Security Advisories; Trivy-sourced findings also link correctly into Prowler Hub.
Adds OCSF support for universal compliance output in the SDK.

10 details in Everything

5.25.0 Apr 28, 2026 · release notes

Prowler 5.25 adds a GitHub Action, zizmor-powered CI/CD workflow scanning, IaC SARIF output, Gmail checks, and more.

└──▷ GET THIS VERSION

$ git clone --branch 5.25.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.25.0

└──▷ USE IT

Drop Prowler into a GitHub Actions workflow to scan IaC, upload findings as SARIF annotations to Code Scanning, and push results to Prowler Cloud.

yaml

- uses: prowler-cloud/prowler@5.25
  with:
    provider: iac
    output-formats: sarif json-ocsf
    upload-sarif: true
    flags: --severity critical high

Produce a SARIF report from an IaC scan for direct import into GitHub Code Scanning or any SARIF-compatible tool.

$ prowler iac --output-formats sarif

New official GitHub Action prowler-cloud/prowler@5.25 runs Prowler scans in CI, with optional SARIF upload to GitHub Code Scanning and push to Prowler Cloud.
New GitHub Actions service uses zizmor v1.24.1 to statically scan .github/workflows/*.yml for OWASP Top 10 CI/CD risks including script injection, overly permissive GITHUB_TOKEN, untrusted checkouts, and dangerous triggers.
IaC provider now emits SARIF via --output-formats sarif, enabling IaC misconfigurations to appear as annotations in GitHub Security → Code Scanning on PRs.
New --repo-list-file CLI flag for the GitHub provider loads repositories from a file instead of enumerating them inline.
New Google Workspace Gmail service with 9 CIS-aligned checks covering mail delegation, link scanning, POP/IMAP access, auto-forwarding, and more.

+9 more show less

New AWS check secretsmanager_has_restrictive_resource_policy evaluates resource-based policies on Secrets Manager secrets.
New GitHub check repository_default_branch_dismisses_stale_reviews flags repos whose default branch protection does not dismiss stale PR approvals on new commits (CIS 1.1.4).
CIS Benchmark PDF reports are now downloadable via GET /scans/{id}/cis/{name}/ for the latest CIS variant per provider.
Tenant owners can now expel users from their organizations via the UI or DELETE /tenants/{tenant_pk}/memberships/{id}, immediately blacklisting outstanding refresh tokens.
Redesigned compliance page with client-side framework search, compact scan selector, and enhanced compliance cards.
Resources page gains batch-applied filters, syntax-highlighted metadata JSON, and a View Resource button from finding detail drawers.
Mutelist table adds name and reason search plus visual count badges on finding targets.
Imported OCSF scans in Prowler Cloud now generate the same downloadable report artifacts as CLI scans.
Overview endpoints (/overviews/resource-groups, /overviews/categories, /overviews/attack-surfaces) now reflect newly muted findings immediately without waiting for the next scan.

14 details in Everything

5.24.4 Apr 24, 2026 · release notes

Prowler 5.24.4 adds Sentry performance tracing for the API and makes the Neo4j connection acquisition timeout configurable.

└──▷ GET THIS VERSION

$ git clone --branch 5.24.4 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.24.4

└──▷ TRY IT

Enable Sentry performance tracing for the API at a higher sample rate to capture more transaction traces in production.

$ DJANGO_SENTRY_TRACES_SAMPLE_RATE=0.1 <your API start command>

Raise the Neo4j connection acquisition timeout if your Attack Paths graph queries are timing out after the new 15 s default.

$ NEO4J_CONN_ACQUISITION_TIMEOUT=60 <your API start command>

New DJANGO_SENTRY_TRACES_SAMPLE_RATE env var enables Sentry performance tracing for the Prowler API (default 0.02).
Neo4j connection_acquisition_timeout for Attack Paths is now configurable via the NEO4J_CONN_ACQUISITION_TIMEOUT env var.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The Neo4j connection_acquisition_timeout default is lowered from 120 s to 15 s; environments relying on slow Neo4j connections may see acquisition timeouts that previously succeeded.

5.24.3 Apr 22, 2026 · release notes

Prowler 5.24.3: muted findings now instantly reflected in overview endpoints without waiting for the next scan.

└──▷ GET THIS VERSION

$ git clone --branch 5.24.3 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.24.3

5.24.0 Apr 15, 2026 · release notes

Prowler 5.24.0 adds 13 new AWS/M365 checks, region exclusion filtering, and a redesigned resource detail drawer.

└──▷ GET THIS VERSION

$ git clone --branch 5.24.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.24.0

└──▷ TRY IT

Scope an AWS scan to only your active regions by excluding regions you don't use, keeping results focused and scan time down.

$ prowler aws --excluded-region us-west-1 --excluded-region ap-northeast-3

Exclude multiple regions globally via environment variable in CI pipelines without modifying command-line invocations.

$ export PROWLER_AWS_DISALLOWED_REGIONS="eu-south-1,ap-east-1"
prowler aws

New bedrock_full_access_policy_attached check flags IAM principals with AmazonBedrockFullAccess or wildcard Bedrock permissions.
New iam_role_access_not_stale_to_bedrock and iam_user_access_not_stale_to_bedrock checks detect dormant GenAI access that hasn't been used recently.
New bedrock_vpc_endpoints_configured check verifies Bedrock traffic stays on private VPC endpoints instead of the public internet.
New iam_policy_no_wildcard_marketplace_subscribe and iam_inline_policy_no_wildcard_marketplace_subscribe checks catch wildcard aws-marketplace:Subscribe grants that could turn an IAM misconfiguration into a billing incident.
New entra_conditional_access_policy_all_apps_all_users check ensures at least one Conditional Access policy targets every app and every user.

+10 more show less

New entra_conditional_access_policy_mfa_enforced_for_guest_users check verifies MFA is enforced for guest and external users.
New entra_conditional_access_policy_block_unknown_device_platforms check flags CA policies that allow access from unknown device platforms.
New entra_conditional_access_policy_corporate_device_sign_in_frequency_enforced check ensures sign-in frequency is enforced for non-corporate devices.
New entra_conditional_access_policy_directory_sync_account_excluded check validates that the directory sync account is excluded from restrictive CA policies.
New intune_device_compliance_policy_unassigned_devices_not_compliant_by_default check flags tenants where unassigned devices are marked compliant by default.
New exchange_organization_delicensing_resiliency_enabled check verifies mailbox data remains accessible for 30 days after license removal.
Adds --excluded-region CLI flag, PROWLER_AWS_DISALLOWED_REGIONS environment variable, and aws.disallowed_regions config key to exclude specific AWS regions from scans.
Redesigned resource detail side drawer consolidates metadata, findings, and event timeline in a single panel for in-context investigation.
Syntax highlighting for remediation code blocks in the finding groups drawer with provider-aware auto-detection of Shell, HCL, YAML, and Bicep.
Attack Paths View Finding now opens the finding drawer inline over the graph, preserving graph zoom, selection, and filter state.

15 details in Everything

5.23.0 Apr 13, 2026 · release notes

Prowler 5.23.0 adds Vercel provider (26 checks), grouped findings view, MCP resource events timeline, 25+ new checks across AWS/GCP/M365/Google Workspace, and new CLI resource-group flags.

└──▷ GET THIS VERSION

$ git clone --branch 5.23.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.23.0

└──▷ TRY IT

Filter an OCI scan to specific regions (including regions outside the tenancy home region) using the new multi-region support.

$ prowler oci --region us-ashburn-1 eu-frankfurt-1 --service filestorage kms compute

List all resource groups available across providers, then scope a scan to a specific resource group to reduce noise.

$ prowler aws --list-resource-groups
prowler aws --resource-group <resource_group_name>

New Vercel provider: connect via API token to audit deployments, domains, projects, and team settings with 26 built-in security checks.
Findings Grouped View in the UI collapses repeated misconfigurations into one row per check with an X-of-Y impacted resources counter, inline resource expansion, bulk-mute, and an Other Findings For This Resource tab in the detail drawer.
MCP Server gains a resource events tool that returns a who/what/when CloudTrail timeline (actor, event name, source IP, user agent, request/response payloads) for any AWS resource, queryable from any MCP client.
New --resource-group and --list-resource-groups CLI flags to filter checks by resource group across all providers.
Attack Paths custom query editor now includes syntax highlighting and line numbering for openCypher queries.

+15 more show less

New Google Workspace compliance frameworks: CISA SCuBA Baselines and CIS Foundations Benchmark v1.3.0.
OCI multi-region filtering via --region now covers filestorage, blockstorage, kms, compute, and identity services including regions outside the tenancy home region.
OCI Mutelist support now passes tenancy_id to is_finding_muted.
New AWS check glue_etl_jobs_no_secrets_in_arguments detects plaintext secrets in Glue ETL job arguments.
New AWS checks awslambda_function_no_dead_letter_queue, awslambda_function_using_cross_account_layers, and awslambda_function_env_vars_not_encrypted_with_cmk.
New AWS check stepfunctions_statemachine_no_secrets_in_definition detects secrets in Step Functions state machine definitions.
New AWS check ec2_securitygroup_allow_ingress_from_internet_to_any_port_from_ip using ipaddress.is_global for accurate public IP detection.
Updated AWS check cloudfront_distributions_logging_enabled now detects Standard Logging v2 via CloudWatch Log Delivery.
Two new GCP checks for Gemini API coverage: apikeys_api_restricted_with_gemini_api and gemini_api_disabled.
15 new Google Workspace checks spanning directory, calendar, drive, and docs services.
Four new Microsoft 365 Conditional Access Policy checks for Entra ID aligned with Microsoft security baselines.
--list-checks and --list-checks-json now include the threat-detection category.
Sensitive CLI flag values (tokens, keys, passwords) are now redacted in HTML output Parameters used field.
Harden-Runner enabled across GitHub Actions workflows to monitor and restrict outbound network traffic during CI runs.
New VALKEY_SCHEME, VALKEY_USERNAME, and VALKEY_PASSWORD environment variables to configure Celery broker TLS/auth for Valkey/ElastiCache.

20 details in Everything

└──▷ BREAKING ON UPGRADE

!Minimum Python version is now 3.10; installations running Python 3.9 will no longer work.

5.22.0 Mar 24, 2026 · release notes

Prowler 5.22.0 adds Attack Paths custom openCypher queries, batch filter apply in Findings, and check_title substring filtering in the API.

└──▷ GET THIS VERSION

$ git clone --branch 5.22.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.22.0

└──▷ HOW TO FIND IT

Explore lateral movement paths or custom threat scenarios in your cloud graph without being limited to predefined queries.

📍In the Prowler Cloud UI, go to Attack Paths, open the query panel, select Custom Query, enter your openCypher query (optionally use Lighthouse AI to generate it), and click Run.

Adds custom openCypher query support in Attack Paths, with Cartography schema guidance and Lighthouse AI assistance for query generation.
New batch-apply filter pattern on the Findings page — configure multiple filters before executing, eliminating per-selection API calls and layout shifts.
Finding groups API now supports check_title substring filtering.

3 details in Everything

5.21.0 Mar 19, 2026 · release notes

Prowler 5.21.0 adds Google Workspace and Container Image UI support, AWS CloudTrail timeline, Lighthouse AI query skills, and new M365/GitHub checks.

└──▷ GET THIS VERSION

$ git clone --branch 5.21.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.21.0

Adds Google Workspace provider full support in the Prowler App UI — connect and scan Google Workspace environments directly from the interface.
Adds Container Image (container registry) provider support in the Prowler App UI, including badge icon, credentials form, and provider-type filtering.
Adds AWS Resource Timeline: a new Events tab in Findings and Resource detail cards shows the last 90 days of AWS CloudTrail events with expandable event rows, actor details, request/response JSON payloads, error info, and a read-event toggle.
Adds Lighthouse AI skill system with a new Attack Path Custom Query skill that supplies the LLM with openCypher syntax guidance and Cartography schema knowledge for writing graph queries.
Adds a new MCP tool to retrieve the Cartography Neo4j DB scan schema for use in Attack Path queries.

+10 more show less

Adds entra_conditional_access_policy_device_code_flow_blocked check for M365/Entra: detects whether Conditional Access policy blocks device code flow to prevent phishing attacks.
Adds entra_conditional_access_policy_require_mfa_for_admin_portals check for M365/Entra: detects whether Conditional Access policy requires MFA for Microsoft Admin Portals.
Adds organization_repository_deletion_limited check for GitHub: verifies that organization repository deletion and transfer is restricted to owners.
Adds SecNumCloud 3.2 compliance framework coverage for AWS, Azure, GCP, Alibaba Cloud, and Oracle Cloud.
Adds Reserve Bank of India (RBI) compliance framework for the Azure provider.
Adds misconfig scanner as the default scanner for Image provider scans.
Enables CORS_ALLOWED_ORIGINS to be configured via environment variable in the API.
Adds tenant and provider-related labels to Attack Path graph nodes to enable easier filtering in custom queries.
Adds AWS Organizations UI management improvements: edit organization names and credentials, run connection tests scoped to all accounts or a specific organizational unit, and delete individual organizational units or full organizations.
Adds OCI region support for US DoD regions.

15 details in Everything

└──▷ BREAKING ON UPGRADE

!Attack Paths completes migration to private graph labels and properties, removing deprecated dual-write support — existing integrations relying on the deprecated graph labels or properties will break.

5.20.0 Mar 12, 2026 · release notes

Prowler 5.20.0 adds Google Workspace API support, OpenStack object storage checks, new AWS/M365 detections, and a community Helm chart.

└──▷ GET THIS VERSION

$ git clone --branch 5.20.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.20.0

└──▷ TRY IT

Verify GuardDuty delegated admin is configured in every region as part of a multi-account security baseline audit.

$ prowler aws --check guardduty_delegated_admin_enabled_all_regions

Adds Google Workspace scanning via the Prowler API (previously CLI-only since v5.19.0), enabling programmatic provider connection and scan triggering.
Adds 7 new OpenStack Object Storage security checks covering container access control, versioning, encryption, metadata hygiene, and lifecycle management.
New AWS check guardduty_delegated_admin_enabled_all_regions verifies a delegated administrator is configured for GuardDuty across all regions.
New trusted_ips configuration option for opensearch_service_domains_not_publicly_accessible eliminates false positives when an OpenSearch domain restricts access to known IPs via resource policy.
New M365 check entra_conditional_access_policy_approved_client_app_required_for_mobile enforces approved client apps on mobile devices.

+5 more show less

New M365 check entra_conditional_access_policy_compliant_device_hybrid_joined_device_mfa_required enforces compliant/hybrid-joined device or MFA.
AWS Organizations findings now include Organizational Unit ID and name across ASFF, OCSF, and CSV output formats.
Attack Paths network exposure queries migrated from APOC to standard openCypher, enabling compatibility with Neo4j and Neptune.
Official community-maintained Helm chart published as an OCI artifact to oci://ghcr.io/prowler-cloud/charts/prowler for self-hosted Kubernetes deployments.
POST /api/v1/providers now returns 409 Conflict when a provider already exists.

10 details in Everything

5.19.0 Mar 4, 2026 · release notes

Prowler 5.19.0 adds container image scanning, Google Workspace & OpenStack multi-region support, 40+ new checks, and Attack Paths upgrades.

└──▷ GET THIS VERSION

$ git clone --branch 5.19.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.19.0

└──▷ TRY IT

Push findings from an existing CLI scan to Prowler Cloud for centralized correlation and reporting.

$ prowler aws --push-to-cloud

New --push-to-cloud CLI flag uploads findings in OCSF format directly to Prowler Cloud for centralized visibility.
New POST /api/v1/ingestions API endpoint enables CI/CD pipelines to import scan findings into Prowler Cloud.
New Image provider (powered by Trivy) enables container image vulnerability scanning by tag, digest, or full registry enumeration across OCI registries, Docker Hub, and Amazon ECR.
New Google Workspace provider brings organizational security visibility starting with the Directory service.
OpenStack provider now supports multiple regions from a single provider configuration.

+15 more show less

Adds 26 new OpenStack security checks across Compute, Networking, Block Storage, and Image services.
Adds 12 new Microsoft 365 security checks covering Entra ID, Defender for Identity, Defender XDR, and email protection.
Adds enhanced AWS IAM privilege escalation detection checks using patterns from the pathfinding.cloud library.
Adds organization_verified_badge check for the GitHub provider.
Cloudflare provider now has full Prowler App (UI) support with 29 security checks covering TLS/SSL, DNS, email security, WAF, bot protection, and zone configuration.
AWS Organizations onboarding in Prowler Cloud allows connecting multiple AWS accounts from an Organization hierarchy in a single flow.
Attack Paths feature gains the full query library from pathfinding.cloud, covering privilege escalation and lateral movement detection.
Attack Paths queries now include detailed descriptions and source links to pathfinding.cloud.
Prowler MCP Server now includes Attack Paths tools, enabling AI agents to query privilege escalation and lateral movement paths.
Adds CSA CCM 4.0 compliance framework across AWS, Azure, GCP, Oracle Cloud, and Alibaba Cloud.
Adds CIS Amazon Web Services Foundations Benchmark v6.0 compliance framework.
Adds ANSSI SecNumCloud compliance framework for AWS.
Unified provider connection wizard redesigned as a modal with a consistent experience across all provider types.
OpenStack providers can now be managed from the Prowler App UI.
Respects AWS_ENDPOINT_URL environment variable for STS session creation.

20 details in Everything

5.18.0 Feb 5, 2026 · release notes

Prowler 5.18.0 adds OpenStack provider support, CodeBreach detection, HIPAA for Azure, and new checks across AWS, M365, and GCP.

└──▷ GET THIS VERSION

$ git clone --branch 5.18.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.18.0

└──▷ TRY IT

Scope a Cloudflare scan to a specific account using the new account-id filter.

$ prowler cloudflare --account-id <your-cloudflare-account-id>

Adds OpenStack as a new cloud provider (CLI only) with initial Compute service coverage and first security check, enabling private cloud assessments.
New check codebuild_project_webhook_filters_use_anchored_patterns detects the CodeBreach vulnerability in AWS CodeBuild projects by verifying webhook filter anchor patterns.
New AWS check rds_instance_extended_support detects RDS instances using extended support.
New M365 checks: defender_zap_for_teams_enabled and exchange_shared_mailbox_sign_in_disabled.
New GCP check compute_instance_suspended_without_persistent_disks for suspended instances lacking persistent disks.

+12 more show less

Adds HIPAA compliance framework for the Azure provider.
New --account-id filter argument for Cloudflare CLI scans.
Cloudflare provider credentials now accepted as constructor parameters (api_token, api_key, api_email) for SDK usage.
AWS cross-account checks are now configurable via the trusted_account_ids config parameter.
New attack path privilege escalation queries covering Bedrock Code Interpreter and AttachRolePolicy patterns.
Cartography upgraded to 0.126.1, expanding AWS attack path scans to include SageMaker, CloudFront, and Bedrock.
Neo4j database per-tenant architecture for Attack Paths improves isolation and performance.
New GET /api/v1/resources/{id}/events API endpoint retrieves AWS resource modification history from CloudTrail.
New provider_id and provider_id__in filters added to GET /resources and GET /resources/metadata/latest API endpoints.
Redesigned Resources view with an improved resource detail drawer in the UI.
Launch Scan page now displays all providers without pagination limits.
Azure Key Vault vaults and vault contents retrieval now runs in parallel for faster scans.

17 details in Everything

5.17.0 Jan 22, 2026 · release notes

Prowler 5.17.0 adds Attack Paths visualization, Cloudflare provider, AWS EUSC support, 10 new GCP checks, and three new CIS compliance frameworks.

└──▷ GET THIS VERSION

$ git clone --branch 5.17.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.17.0

└──▷ TRY IT

Filter findings by resource group (e.g., only Compute resources) to triage the highest-risk category after upgrading.

$ curl -s 'https://<your-prowler-api>/api/v1/findings?group=Compute' -H 'Authorization: Bearer <token>'

Retrieve the resource groups security overview to identify which categories have the most critical findings.

$ curl -s 'https://<your-prowler-api>/api/v1/overviews/resource-groups' -H 'Authorization: Bearer <token>'

New Attack Paths feature powered by Cartography and Neo4j lets security teams execute graph-based queries, visualize attack vectors, and identify privilege escalation and lateral movement paths across AWS environments.
New Cloudflare provider (CLI) enables scanning of Cloudflare infrastructure for misconfigurations across zones, DNS, email security (SPF, DKIM, DMARC), WAF, bot protection, and TLS/SSL configuration.
Full Alibaba Cloud provider support in the Prowler App and API, including UI-based provider management, security scanning, findings views, and ThreatScore calculation.
Adds support for AWS European Sovereign Cloud regions, enabling data-residency-constrained organizations to run Prowler security scans.
New Resource Groups Overview aggregates cloud resources by security-relevant categories (Compute, Storage, Network, Identity) with finding severity breakdowns via new /api/v1/overviews/resource-groups endpoint.

+10 more show less

New Compliance Watchlist component on the Overview page and /api/v1/overviews/compliance-watchlist API endpoint for monitoring critical compliance frameworks at a glance.
ThreatScore pillar breakdown added to the Compliance Summary page, showing per-pillar (Identity, Data Protection, Network Security, etc.) contribution to overall risk score.
Adds /api/v1/attack-paths-scans API endpoint for AWS providers backed by Neo4j to programmatically trigger and query Attack Paths scans.
New group filter on GET /findings and GET /findings/metadata/latest endpoints for resource-group-based finding queries.
Adds CIS Azure Foundations Benchmark v5.0, CIS Microsoft 365 Benchmark v6.0, and CIS Kubernetes Benchmark v1.12 compliance frameworks.
Adds 10 new GCP Compute checks: compute_instance_group_multiple_zones, compute_instance_group_autohealing_enabled, compute_instance_group_load_balancer_attached, compute_instance_disk_auto_delete_disabled, compute_configuration_changes, compute_instance_single_network_interface, compute_image_not_publicly_shared, compute_snapshot_not_outdated, compute_project_os_login_2fa_enabled, and compute_instance_on_host_maintenance_migrate.
AI Skills Pack added for Claude Code, OpenCode, and Codex following the agentskills.io standard to help AI coding assistants understand and contribute to Prowler's codebase.
Redesigned findings table with improved multi-select filtering UX, enhanced table interactions, and resource group filter integration.
Provider and resource group label filters added to the Resources page in the UI.
Search bar added when adding a new provider in the UI.

15 details in Everything

└──▷ BREAKING ON UPGRADE

!Azure service principals used to scan Azure must now be granted the AuditLog.Read.All Microsoft Graph permission due to an additional API call required for the Azure Entra performance enhancement.
!Resource group data will only populate from scans executed after upgrading to v5.17.0; previous scan data will not include resource group information.
!The resource_group filter parameter is renamed to group in the Resources page and Overview cards API.

5.16.0 Dec 18, 2025 · release notes

Prowler 5.16.0 adds MCP Server-powered Lighthouse AI, Simple Mutelist, category filtering on findings endpoints, and two new AWS check categories.

└──▷ GET THIS VERSION

$ git clone --branch 5.16.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.16.0

└──▷ TRY IT

Filter findings by category via the API to feed a downstream dashboard focused on a specific security domain.

$ curl -s -H "Authorization: Bearer <token>" "https://<api-host>/api/v1/findings/latest?category=privilege-escalation"

Integrates Prowler's official MCP Server with Lighthouse AI for standardized, faster AI-driven security interactions.
Adds new MCP tools for Compliance Framework Management, enabling AI assistants to query compliance status and drill down to requirement-level details.
Introduces Simple Mutelist: mute findings directly from the findings table and manage mute rules via a new /mutelist page with Simple and Advanced (YAML) tabs.
New category overview endpoint provides severity breakdowns by security domain across your environment.
Adds category filter support to GET /findings and GET /findings/latest endpoints for scoped security domain analysis.

+6 more show less

PDF reports now include Account ID, Alias, and Provider Name directly in the reporting table.
Adds two new AWS check categories: privilege-escalation and ec2-imdsv1, improving visibility into high-risk misconfigurations.
Adds Risk Radar component with category-based severity breakdown to the Overview page in the UI.
Adds SSO and API Key link cards to the Integrations page for better discoverability.
Exposes richer resource details (partition, details, and metadata) in Findings detail and Resources detail views.
Adds IaC supported formats and scanner documentation for the IaC provider.

11 details in Everything

└──▷ BREAKING ON UPGRADE

!The GET /overviews/attack-surfaces endpoint no longer returns related check IDs in its response; consumers that depend on that field will receive an incomplete payload.

5.15.0 Dec 11, 2025 · release notes

Prowler 5.15.0 adds Alibaba Cloud support, a redesigned MCP Server, 5 new checks, and a richer Overview dashboard with Attack Surface, Threat Map, and Risk Pipeline panels.

└──▷ GET THIS VERSION

$ git clone --branch 5.15.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.15.0

└──▷ TRY IT

Query daily aggregated findings by severity over time via the new API endpoint to track posture trends in a SIEM or dashboard.

$ curl -s -H "Authorization: Bearer <token>" 'https://<prowler-api>/api/v1/overviews/findings_severity/timeseries'

Adds Alibaba Cloud as a new CLI provider with 63 available checks and CIS 2.0 benchmark support.
Adds MongoDB Atlas provider support in the Prowler App for assessing managed database cluster security posture.
Redesigns the MCP Server with comprehensive tools for Findings, Provider Management, Resource Management, Muting Management, and Scan Management — enabling AI-driven security workflows.
New Overview dashboard panels: Attack Surface (internet-facing resources, leaked secrets, privilege-escalation paths), Service Watchlist, Findings Severity Over Time, Risk Pipeline (Sankey chart), Threat Map (region-based pass/fail ratios), and Risk Plot (severity-weighted Threat Score visualization).
New API endpoint GET /api/v1/overviews/findings_severity/timeseries for daily aggregated findings by severity level.

+11 more show less

New API endpoint to retrieve an overview of attack surfaces.
Lighthouse AI now supports Amazon Bedrock API key authentication as an alternative to IAM access keys.
New GCP check cloudstorage_uses_vpc_service_controls detects Cloud Storage buckets not protected by VPC Service Controls.
New GCP check compute_instance_preemptible_vm_disabled detects compute instances configured as preemptible VMs.
New GCP check compute_instance_automatic_restart_enabled verifies automatic restart is enabled on compute instances.
New GCP check compute_instance_deletion_protection_enabled verifies deletion protection is enabled on compute instances.
New GitHub check repository_immutable_releases_enabled detects repositories without immutable releases enforced.
Adds Processing Integrity requirements to the SOC 2 compliance framework for AWS, Azure, and GCP providers.
Adds RBI Cyber Security Framework compliance support for the Azure provider.
Adds CIS Alibaba Cloud Foundation Benchmark v2.0.0 compliance framework.
Introduces a navigation loading bar in the UI for visual feedback during page transitions.

16 details in Everything

5.14.0 Nov 25, 2025 · release notes

Prowler 5.14 adds OCI and IaC providers, multi-LLM Lighthouse AI, MongoDB Atlas, 8 new checks, and ARM Docker images.

└──▷ GET THIS VERSION

$ git clone --branch 5.14.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.14.0

Adds Oracle Cloud Infrastructure (OCI) as a cloud provider with 51 checks and CIS OCI Foundations Benchmark v3.0.0 support.
Adds a new Infrastructure-as-Code (IaC) provider powered by Trivy for scanning Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts, Azure ARM templates, and secrets before deployment.
Adds MongoDB Atlas as a new provider (API only) with 10 available checks.
Expands Lighthouse AI with multi-LLM support: OpenAI, Amazon Bedrock (Claude, Llama, Titan), and OpenAI-compatible APIs such as OpenRouter.
Adds new compliance frameworks: C5 for Azure and GCP, HIPAA for GCP, NIST CSF 2.0 for AWS, CIS 3.0 for OCI, and FedRAMP 20x KSI Low for AWS, Azure, and GCP.

+18 more show less

Adds PDF reporting for ENS, NIS2, and Prowler ThreatScore compliance frameworks.
Adds ThreatScore for the Kubernetes provider.
Adds metadata, details, and partition attributes to the /resources endpoint, and details and partition to the /findings endpoint for raw cloud provider API transparency.
Adds new endpoint GET /api/v1/overview/regions to retrieve aggregated findings data by region.
Adds muting of findings based on simple rules with a custom reason via the API.
Adds new AWS check codepipeline_project_repo_private.
Adds five new GCP Cloud Storage checks: cloudstorage_bucket_versioning_enabled, cloudstorage_bucket_soft_delete_enabled, cloudstorage_bucket_logging_enabled, cloudstorage_audit_logs_enabled, and cloudstorage_bucket_sufficient_retention_period.
Adds new Azure PostgreSQL Flexible Server check postgresql_flexible_server_entra_id_authentication_enabled.
Adds new GitHub check organization_default_repository_permission_strict.
Publishes multi-architecture Docker images (linux/amd64 and linux/arm64) to Docker Hub.
Adds RSS feed for real-time release announcements and incident notifications in the Latest Updates panel.
Adds redesigned Overview dashboard featuring Prowler ThreatScore, severity distribution visualization, and faster access to latest failed findings.
Adds provider-type filters and optional pagination disable to GET /api/v1/providers.
Adds new endpoint to retrieve the number of providers grouped by provider type.
Extends GET /api/v1/overviews/services to make date filters optional, returning latest scan data by default.
Delivers major scan performance improvements: batch inserts replacing per-finding transactions, aggregated compliance lookup table reducing average response times from ~0.9s to ~20ms.
Adds external resource links to IaC findings for direct navigation to source code in Git repositories.
Uses branch name as the region identifier for IaC findings.

23 details in Everything

5.13.0 Oct 24, 2025 · release notes

Prowler 5.13.0 adds OCI and LLM providers, MCP Server, API key auth, PDF ThreatScore reports, and new AWS/GCP checks.

└──▷ GET THIS VERSION

$ git clone --branch 5.13.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.13.0

└──▷ TRY IT

Scan Oracle Cloud Infrastructure against the CIS 3.0 benchmark after authenticating a local OCI session.

$ oci session authenticate && prowler oci

Run a comprehensive LLM red team evaluation (OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF) against an AI/LLM target.

$ npm install -g promptfoo && prowler llm

New prowler oci provider with full Oracle Cloud Infrastructure support and CIS 3.0 benchmark coverage (CLI).
New prowler llm provider for AI/LLM red team security testing via promptfoo, covering OWASP LLM Top 10, MITRE ATLAS, and NIST AI RMF with 5000+ test cases (CLI).
Launches the Prowler MCP Server, exposing Prowler Cloud, Hub, and documentation to MCP-compatible AI assistants (Claude Desktop, Cursor) over STDIO or HTTP.
Adds native API key authentication for programmatic access to the Prowler API, suitable for CI/CD and third-party integrations.
Enables PDF export of Prowler ThreatScore reports for stakeholder presentations and compliance audits.

+9 more show less

Findings and Findings Severity Overview API endpoints now support provider_id and provider_id__in filter parameters for multi-cloud reporting.
Adds database read replica support for horizontal scalability, configurable via environment variables.
Adds new check ec2_instance_with_outdated_ami for AWS.
Adds new check cloudstorage_bucket_lifecycle_management_enabled for GCP.
Adds C5 compliance framework support for AWS (German cloud requirements).
Adds Common Cloud Controls compliance framework across AWS, Azure, and GCP.
Adds certificate-based authentication for M365/Microsoft Entra, replacing deprecated username/password auth.
Standardizes metadata format across 15+ AWS services, including inline NativeIaC and Terraform remediation code.
Adds Prowler Hub menu item and Markdown/AdditionalURLs support in the findings detail UI.

14 details in Everything

└──▷ BREAKING ON UPGRADE

!The MANAGE_ACCOUNT permission is now required to modify or read user permissions instead of MANAGE_USERS.
!M365 username/password authentication is deprecated and no longer supported; certificate-based authentication is required.
!At least one user with MANAGE_ACCOUNT permission is now required in each tenant.

5.12.0 Sep 9, 2025 · release notes

Prowler 5.12.0 adds MongoDB Atlas provider (10 checks), JIRA integration, API status filtering, and token throttling.

└──▷ GET THIS VERSION

$ git clone --branch 5.12.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.12.0

└──▷ TRY IT

List all available MongoDB Atlas security checks to understand what Prowler can assess before running a scan.

$ prowler mongodb-atlas --list-checks

New MongoDB Atlas provider (Beta) with 10 security checks covering clusters, projects, and organizations — including TLS, encryption-at-rest, MFA, auditing, and internet-exposure checks.
Sends Prowler findings directly to JIRA projects as Task issues, with labels, finding URLs, tenant info, and color-coded severity for MANUAL findings.
New --excluded-checks-file CLI flag lets you supply a file of checks to exclude from a scan.
The GET /overviews/findings_severity endpoint now supports filter[status] and filter[status__in] query parameters to aggregate findings by FAIL or PASS status.
Token endpoint (/api/v1/tokens) now supports rate throttling via the DJANGO_THROTTLE_TOKEN_OBTAIN environment variable to prevent abuse.

+3 more show less

UI: Overview chart Findings by Severity now defaults to showing only FAIL findings and links to the Findings page pre-filtered by severity.
UI: Markdown rendering added to the finding details page.
Adds AdditionalURLs field to CheckMetadata for surfacing additional reference URLs on checks.

8 details in Everything

└──▷ BREAKING ON UPGRADE

!FTP and MongoDB EC2 security group checks are renamed to follow the pattern ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_* — any scripts, suppressions, or dashboards referencing the old check names will break.

5.11.0 Aug 28, 2025 · release notes

Prowler 5.11.0 adds AWS Security Hub integration, GPT-5 support in Lighthouse AI, 4 new checks, and expanded privilege escalation coverage.

└──▷ GET THIS VERSION

$ git clone --branch 5.11.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.11.0

└──▷ TRY IT

Skip GCP API availability pre-checks to speed up scans in environments where APIs are known to be enabled.

$ prowler gcp --skip-api-check

Run only the new EKS deletion protection check to quickly audit clusters for missing safeguards.

$ prowler aws --checks eks_cluster_deletion_protection_enabled

Adds AWS Security Hub integration to automatically forward Prowler findings to Security Hub, with support for session, profile, role, and static credential authentication.
Adds Lighthouse AI support for OpenAI GPT-5, enabling enhanced AI-driven analysis in automated workflows.
Adds new eks_cluster_deletion_protection_enabled check to detect EKS clusters without deletion protection.
Adds new apim_threat_detection_llm_jacking check for Azure API Management, monitoring 25+ LLM API endpoints across major AI providers.
Adds new vm_sufficient_daily_backup_retention_period check to ensure Azure VMs meet a configured minimum daily backup retention period.

+10 more show less

Adds new vm_jit_access_enabled check to ensure Azure VMs are configured with Just-in-Time access, reducing management port attack surface.
Expands AWS IAM privilege escalation coverage with Bedrock AgentCore combinations, ECS StartTask/RunTask patterns, and updated standalone iam:PassRole detection.
Adds Resource Explorer v2 API actions to the cloudtrail_threat_detection_enumeration check for broader enumeration detection.
Adds certificate authentication support for the M365 provider.
Adds new --skip-api-check command-line flag for GCP provider scans.
Adds a resource agent to Lighthouse AI for querying resource information.
Adds a Cloud Provider type filter to the providers page in the UI.
Adds a Mutelist shortcut under the UI Configuration section menu.
Adds direct links to the configured S3 bucket and folder within each integration in the UI.
Generates ASFF output for AWS providers when Security Hub integration is enabled.

15 details in Everything

5.10.0 Aug 7, 2025 · release notes

Prowler 5.10.0 adds GitHub provider, S3 report integration, 5 new security checks, and CIS Azure Benchmark v4.0 support.

└──▷ GET THIS VERSION

$ git clone --branch 5.10.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.10.0

└──▷ TRY IT

Scan only specific repositories in a GitHub org to quickly audit a subset of your codebase.

$ prowler github --repository acme/app acme/lib

Limit a GitHub scan to one or more organizations to reduce noise in large multi-org environments.

$ prowler github --organization acme-org other-org

Combine repository and organization scoping for a tightly targeted GitHub security assessment.

$ prowler github --organization acme-org --repository acme/app acme/lib

Adds GitHub as a supported cloud provider, enabling security posture assessment of GitHub organizations and repositories via Personal Access Tokens, OAuth App Tokens, or GitHub Apps.
Adds --repository and --organization CLI flags for scoped GitHub scanning, letting you target specific repos or orgs instead of scanning everything.
Adds Amazon S3 integration to automatically deliver scan reports to one or more S3 buckets across any provider combination.
Adds new AWS check bedrock_api_key_no_administrative_privileges to detect Bedrock API keys with excessive permissions.
Adds new AWS check bedrock_api_key_no_long_term_credentials to detect long-lived credentials in Bedrock API keys.

+8 more show less

Adds new AWS check s3_bucket_shadow_resource_vulnerability to flag shadow resources in S3 buckets.
Adds new Azure check vm_desired_sku_size to validate VMs are configured with the desired SKU size.
Adds new Azure check vm_scaleset_not_empty to ensure VM Scale Sets are not empty.
Adds support for CIS Microsoft Azure Foundations Benchmark v4.0 compliance checks.
Adds GCP provider retry configuration support.
Adds Lighthouse banner to the Overview dashboard for enhanced visibility.
Adds XML validation for SAML metadata in the UI.
Adds default Mutelist placeholder in the UI.

13 details in Everything

└──▷ BREAKING ON UPGRADE

!Memberships is renamed to Organization in the sidebar.
!Browse all resources is removed from the sidebar; the sidebar now shows a single Resources entry.
!Misconfigurations is removed from the Top Failed Findings section in the sidebar.

5.9.0 Jul 17, 2025 · release notes

Prowler 5.9.0 adds SAML SSO, mutelist support, a Resource View, remote Git IaC scanning, and 8 new cloud security checks.

└──▷ GET THIS VERSION

$ git clone --branch 5.9.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.9.0

└──▷ TRY IT

Scan IaC files in a remote private Git repo from a CI/CD pipeline without cloning it locally first.

$ prowler iac --scan-repository-url https://github.com/user/repo.git

Fetch the latest scan results for all resources to build an up-to-date asset inventory.

$ curl -X GET https://<prowler-api>/resources/latest \
  -H 'Authorization: Bearer <token>'

Adds Mutelist support: mute findings via the UI or API, with mute reasons visible in finding details and listing views, and instant toggle of muted-finding visibility across all views.
Introduces SAML-based Single Sign-On via a new Sign in with SSO login option, supporting Okta and any SAML-compatible identity provider.
New Resource View provides a unified, browsable inventory of all cloud assets with tags, metadata, provider info, and directly linked findings sorted by FAIL count.
IaC provider now supports scanning remote Git repositories (public and private) via --scan-repository-url, enabling direct CI/CD pipeline integration.
Adds 8 new security checks: entra_intune_enrollment_sign_in_frequency_every_time for M365, and 7 Azure checks covering SMB encryption, SMB protocol version, VM backup, SSH authentication enforcement, approved VM images, VM scaleset load balancer association, and Defender attack path notifications.

+8 more show less

New API endpoints GET /resources/metadata, GET /resources/metadata/latest, and GET /resources/latest expose resource metadata and latest scan results.
New /processors API endpoint enables post-processing of findings; currently supports the Mutelist processor for muting findings programmatically.
Enforces stronger password requirements for new sign-ups: minimum 12 characters with uppercase, lowercase, numbers, and special characters, with a real-time strength indicator.
Adds a navigation link in the Scans view to access the Compliance Overview directly.
Adds a Status column to the findings table in the Compliance Detail view.
Adds route access restriction based on user permissions in the UI.
Adds test_connection method to the GitHub provider.
POST /schedules/daily now returns 409 CONFLICT if a daily schedule already exists.

13 details in Everything

5.8.1 Jul 10, 2025 · release notes

Prowler 5.8.1 adds GET /findings/latest endpoint and custom provider connection exceptions in the API.

└──▷ GET THIS VERSION

$ git clone --branch 5.8.1 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.8.1

Adds GET /findings/latest endpoint to retrieve the latest new failed findings
Introduces a custom exception type for provider connection errors during scans in the SDK/API layer

2 details in Everything

5.8.0 Jul 3, 2025 · release notes

Prowler 5.8.0 adds AI-powered Lighthouse assistant, IaC scanning via Checkov, M365 app-only auth, 21 new checks, and NIS 2 / CIS 4.0 / CIS 1.11 / ISO 27001 compliance frameworks.

└──▷ GET THIS VERSION

$ git clone --branch 5.8.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.8.0

└──▷ TRY IT

Scan local IaC files (Terraform, CloudFormation, Kubernetes YAML, etc.) for misconfigurations before deploying — shift-left security in CI/CD or local workflows.

$ prowler iac

Configure Prowler Lighthouse with your preferred LLM and API key to enable natural-language security posture Q&A in the UI.

📍In the console, go to the Lighthouse tab › Lighthouse Configuration Panel, select your LLM (e.g., GPT-4o Mini), enter your API Key, and optionally add business-specific context, then save.

Introduces Prowler Lighthouse, an AI-powered cloud security assistant that answers natural-language questions about compliance status, prioritizes failed checks, and suggests remediations — configurable with your own LLM (e.g., GPT-4o Mini) and API key.
Adds IaC scanning powered by Checkov via prowler iac, supporting Terraform, CloudFormation, ARM, Kubernetes YAML, and more to catch misconfigurations pre-deployment.
Supports Microsoft 365 app-only (service principal) authentication via OAuth 2.0 client-credentials, enabling fully unattended scans against Exchange Online, SharePoint, Teams, etc.
Adds GCP Service Account Key JSON authentication, allowing GCP onboarding by pasting a key without CLI setup.
Adds 21 new security checks: 1 for AWS, 11 for Azure, 3 for Microsoft 365, and 6 for GitHub.

+11 more show less

Adds baseline NIS 2 (EU 2022/2555) compliance support for AWS, Azure, and GCP.
Adds three new compliance frameworks: CIS 4.0 for GCP, CIS 1.11 for Kubernetes, and ISO 27001 for Microsoft 365.
Adds detailed compliance views for all supported frameworks (ENS-RD2022, CIS, ISO, NIST, MITRE ATT&CK, KISA, AWS Well-Architected, etc.) with interactive pie charts, top-failed-sections breakdown, failure heatmaps, and per-category drilldowns.
Adds a Resource name column to the findings table for faster identification of affected resources during triage.
Adds GET /compliance-overviews API endpoints to retrieve compliance metadata and per-requirement status metrics.
Adds Lighthouse configuration API support for setting LLM provider, API key, and business context.
Supports HTTPS_PROXY and K8S_SKIP_TLS_VERIFY environment variables for Kubernetes provider.
Adds new Azure checks: storage_geo_redundant_enabled and storage_cross_tenant_replication_disabled.
Adds new M365 checks: entra_users_mfa_capable, admincenter_organization_customer_lockbox_enabled, and admincenter_external_calendar_sharing_disabled.
Adds new GitHub check: repository_has_codeowners_file.
Revamped User Profile page showing Organization ID, join date, email, active roles, and organization membership with a one-click Organization ID copy action.

16 details in Everything

└──▷ BREAKING ON UPGRADE

!Compliance detailed views are only available for new scans from v5.8.0 onwards; all compliance overviews from previous scans are not available in the new detailed view.

5.7.3 Jun 6, 2025 · release notes

Prowler 5.7.3 adds database backend for closed API connections

└──▷ GET THIS VERSION

$ git clone --branch 5.7.3 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.7.3

└──▷ BREAKING ON UPGRADE

!The encrypted_password field is renamed to password for the M365 provider.

5.7.0 May 20, 2025 · release notes

Prowler 5.7.0 adds GitHub provider with 11 CIS checks, ThreatScore for M365, CIS AWS v5.0 & M365 v4.0 frameworks, and high-performance findings endpoints.

└──▷ GET THIS VERSION

$ git clone --branch 5.7.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.7.0

└──▷ TRY IT

Audit your GitHub organization's security posture against the CIS GitHub Benchmark v1.0.0 — useful for teams that want to enforce branch protection and MFA policies at scale.

$ prowler github --list-checks

Score your Microsoft 365 tenant's security posture with Prowler ThreatScore to quickly prioritize the highest-risk misconfigurations.

$ prowler m365 --compliance prowler_threatscore_m365

Assess your AWS environment against the latest CIS AWS Foundations Benchmark v5.0.0 to identify gaps against updated best practices.

$ prowler aws --compliance cis_5.0_aws

Adds GitHub as a new cloud provider (CLI only) with 11 security checks aligned to CIS GitHub Benchmark v1.0.0.
Adds Prowler ThreatScore support for Microsoft 365, assigning contextual risk scores based on detected misconfigurations.
Adds CIS M365 Benchmark v4.0.0 compliance framework for M365 assessments.
Adds CIS AWS Foundations Benchmark v5.0.0 compliance framework for AWS assessments.
Adds new high-performance API endpoints to retrieve the latest findings and metadata quickly.

+7 more show less

Optimizes /findings/metadata and resource-related filters for significantly faster querying; optimization applies to scans from this release onward, including service, region, and resource_type filters.
Enhances /overviews endpoints for better response times and scalability in large environments.
Adds a new background queue for backfill tasks in the API.
Supports setting cluster name in in-cluster mode for Kubernetes provider.
Adds new passed/failed findings split chart to the UI.
Enhances Provider UID filter in the App with cloud provider icons (AWS, GCP) and alias display for faster multi-cloud analysis.
Adds AWS CloudFormation Quick Link in the IAM Role credentials step for one-click IAM Role stack setup.

12 details in Everything

5.6.0 May 9, 2025 · release notes

Prowler 5.6.0 adds Microsoft 365 support with 33 new checks, Prowler ThreatScore framework, SOC2 for Azure, and a new GCP unused service accounts check.

└──▷ GET THIS VERSION

$ git clone --branch 5.6.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.6.0

└──▷ TRY IT

Enumerate all new M365 checks across Teams, Defender, Purview, and Exchange before running a full assessment.

$ prowler m365 --services teams defender purview exchange --list-checks

Detect unused GCP service accounts to identify dormant identities and reduce attack surface.

$ prowler gcp --check iam_service_account_unused

Adds Microsoft 365 (M365) provider support with 33 new checks spanning Teams, Defender, Purview, and Exchange for identity governance and risk reduction.
New Prowler ThreatScore compliance framework available for AWS, Azure, and GCP, covering IAM, Attack Surface, Forensic Readiness, and Encryption.
Adds SOC2 compliance framework assessment for Azure (prowler azure --compliance soc2_azure), matching existing AWS and GCP SOC2 support.
New GCP check iam_service_account_unused detects dormant service accounts to reduce attack surface.
New M365 Teams checks include teams_external_domains_restricted, teams_email_sending_to_channel_disabled, teams_meeting_anonymous_user_join_disabled, teams_unmanaged_communication_disabled, teams_external_users_cannot_start_conversations, teams_meeting_anonymous_user_start_disabled, teams_meeting_external_lobby_bypass_disabled, teams_meeting_dial_in_lobby_bypass_disabled, teams_meeting_external_control_disabled, teams_meeting_external_chat_disabled, teams_meeting_recording_disabled, teams_meeting_presenters_restricted, teams_security_reporting_enabled, and teams_meeting_chat_anonymous_users_disabled.

+12 more show less

New M365 Defender checks cover Common Attachments filter, Outbound Antispam Policy, Antiphishing Policy, Internal user notifications, Bypass Disable for mailboxes, Transport Rules whitelist, Inbound Antispam allowed domains, Connection Filter Policy allowlist/safelist, and DKIM enablement.
New M365 Exchange checks cover Organizations Mailbox Auditing enabled, External Mails Tagged, and Modern Authentication enabled for Exchange Online.
New M365 SharePoint check sharepoint_onedrive_sync_restricted_unmanaged_devices restricts OneDrive sync on unmanaged devices.
New defender_chat_report_policy_configured check for M365 Defender.
Supports CLOUDSDK_AUTH_ACCESS_TOKEN environment variable for GCP authentication.
Prowler Hub launched as a public, searchable library of versioned checks, cloud service artifacts, and compliance frameworks with a documented public API.
Launches Prowler Studio with modular sub-packages (prowler-studio-core, prowler-studio-cli, prowler-studio-api, prowler-studio-mcp-server) and MCP Server integration for AI code assistants.
Compliance Exports in the Prowler App now allow downloading individual compliance frameworks from the Compliance page, and scan reports bundle all supported frameworks.
Delta indicator (•) added to findings in the Prowler App to highlight new or changed findings since the previous scan.
Finding URLs in the UI now include the finding ID, enabling direct sharing within an organization.
Adds option to customize the number of items displayed per table page in the Prowler App.
New API endpoint to fetch and download any specific compliance file by name, plus ZIP-export functionality for all compliance reports.

17 details in Everything

5.5.0 Apr 14, 2025 · release notes

Prowler 5.5.0 adds Google/GitHub social login, 17 new M365 Entra checks, NHN Cloud support, and 4 new compliance frameworks.

└──▷ GET THIS VERSION

$ git clone --branch 5.5.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.5.0

Adds social login via Google and GitHub for Prowler App authentication.
Introduces muted findings support in the Prowler App and API, automatically muting findings based on the SDK provider's default mutelist.
Adds 17 new Microsoft 365 Entra checks covering MFA, legacy auth, guest access, identity protection, and managed device policies.
Adds initial (unofficial) support for NHN Cloud with 6 security checks across compute and networking services.
Adds option to skip scheduling the daily scan when onboarding a new provider, enabling one-time or manually triggered scans.

+7 more show less

Adds SOC 2 compliance framework for GCP and ISO 27001:2022 for Azure, GCP, and Kubernetes.
Adds one-time scan execution support in the UI.
Adds download column in the scans table to download reports for completed scans.
Adds new API endpoint to retrieve compliance overviews metadata.
Adds basic authentication support to the SDK Jira integration.
Adds HTTP Security Headers to the API.
Adds static service status icon with link to the status page in the UI.

12 details in Everything

5.4.0 Mar 6, 2025 · release notes

Prowler 5.4.0 adds SharePoint checks, 6 new compliance frameworks, API scan reports, and Google/GitHub social login.

└──▷ GET THIS VERSION

$ git clone --branch 5.4.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.4.0

└──▷ TRY IT

Run all new SharePoint external sharing and authentication checks against a Microsoft 365 tenant.

$ prowler microsoft365 --service sharepoint

Check whether default users in Entra are blocked from creating new tenants.

$ prowler microsoft365 --check entra_policy_ensure_default_user_cannot_create_tenants

Adds 4 new Microsoft 365 SharePoint checks: sharepoint_external_sharing_managed, sharepoint_external_sharing_restricted, sharepoint_guest_sharing_restricted, and sharepoint_modern_authentication_required.
Adds new Entra check entra_policy_ensure_default_user_cannot_create_tenants for Microsoft 365.
Adds 6 new compliance frameworks: AWS ISO 27001 2022, Azure PCI DSS 4.0, Kubernetes PCI DSS 4.0, GCP PCI DSS 4.0, AWS PCI DSS 4.0, and AWS CIS 4.0.
API scan report system now generates compressed reports in OCSF, CSV, and HTML formats for all API-launched scans.
Adds social login integration with Google and GitHub to the API.

+3 more show less

Adds configurable Sentry integration to the API.
New sidebar and layout in the UI, with real-time scan progress animation and Prowler version display.
Status extended field added to finding details in the UI.

8 details in Everything

5.3.0 Feb 11, 2025 · release notes

Prowler 5.3.0 adds Microsoft365 provider with 5 new checks, CIS M365 benchmark, new AWS KMS check, and real-time scan visibility.

└──▷ GET THIS VERSION

$ git clone --branch 5.3.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.3.0

└──▷ TRY IT

Audit a Microsoft365 tenant using a registered Entra app (service principal) — useful for automated pipelines where interactive login is unavailable.

$ prowler microsoft365 --sp-env-auth

List all available Microsoft365 checks before running a full assessment to understand coverage.

$ prowler microsoft365 --list-checks

Adds Microsoft365 as a new cloud provider with three authentication methods: service principal, Azure CLI, and interactive browser.
New Microsoft365 security checks: admincenter_groups_not_public_visibility, admincenter_settings_password_never_expire, admincenter_users_admins_reduced_license_footprint, admincenter_users_between_two_and_four_global_admins, and entra_thirdparty_integrated_apps_not_allowed.
Adds CIS Microsoft 365 Foundations Benchmark v4.0.0 as a new compliance framework.
New AWS KMS check kms_cmk_not_multi_region to detect Customer Managed Keys configured as multi-region.
Scans now appear immediately in the UI after launch, eliminating the previous delay for real-time visibility.

+3 more show less

Scheduled scan instances are created in advance with SCHEDULED state, making upcoming scans visible before they run.
Increased allowed provider UID length for Kubernetes providers to support AWS EKS, Azure AKS, and GCP GKE.
Findings API endpoints now require at least one date filter when retrieving all findings.

8 details in Everything

└──▷ BREAKING ON UPGRADE

!Findings API endpoints now require at least one date filter to retrieve all findings — queries that previously omitted a date filter will no longer return results.

5.2.0 Jan 23, 2025 · release notes

Prowler 5.2.0 adds CIS Kubernetes/Azure frameworks, OCSF resource metadata, configurable secrets plugins, and finding first-seen tracking.

└──▷ GET THIS VERSION

$ git clone --branch 5.2.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.2.0

└──▷ TRY IT

Inspect full resource metadata (ARN, region, config details) for every finding in OCSF format.

$ prowler --output-format json-ocsf

Adds CIS 1.10 Kubernetes compliance framework.
Adds CIS 3.0 Azure compliance framework.
OCSF output now includes a metadata JSON object under resource with full resource-level metadata for each finding.
Findings now carry a first_seen_at field to track when Prowler first observed each finding.
Secrets checks using detect-secrets can now be configured with a custom list of plugins via the Prowler config file.

+5 more show less

AWS IAM Role External ID is now a mandatory field when configuring IAM Role authentication.
UI: Finding details layout redesigned to include first_seen timestamp.
UI: CloudFormation and Terraform templates available to deploy the ProwlerScan IAM Role.
UI: IAM Role setup now allows skipping static credentials when running inside AWS (EC2, ECS, EKS), using default SDK credentials automatically.
API DB Manager upgraded to psycopg3 with connection pooling for improved reliability.

10 details in Everything

└──▷ BREAKING ON UPGRADE

!The IAM Role External ID is now a mandatory field when configuring IAM Role authentication — existing setups that omit this field will fail.

5.1.3 Jan 17, 2025 · release notes

Prowler 5.1.3 adds a /findings/metadata endpoint and resource_tag filtering to the findings API.

└──▷ GET THIS VERSION

$ git clone --branch 5.1.3 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.1.3

New /findings/metadata API endpoint retrieves dynamic filter information for findings.
Adds resource_tag filter support to the findings API endpoint.

2 details in Everything

5.1.0 Jan 14, 2025 · release notes

Prowler 5.1.0 adds RBAC, 4 new checks, 30 AWS auto-fixers, CIS 3.0 for GCP, and a new gen-ai check category.

└──▷ GET THIS VERSION

$ git clone --branch 5.1.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.1.0

└──▷ TRY IT

Auto-remediate publicly exposed EC2 SSH ports across your AWS account in one pass.

$ prowler aws --check ec2_instance_port_ssh_exposed_to_internet --fixer

List every available auto-fixer before running remediation to audit what will be changed.

$ prowler aws --list-fixers

Adds Role-Based Access Control (RBAC): assign roles and privileges to users and create cloud provider groups to scope visibility.
Adds 4 new security checks: ec2_launch_template_imdsv2_required, stepfunctions_statemachine_logging_enabled, cloudformation_stack_cdktoolkit_bootstrap_version, and sqlserver_recommended_minimal_tls_version.
Adds 30 new AWS auto-fixers for Lambda, SQS, ECR, Glacier, OpenSearch, S3, EC2, CloudTrail, and CodeArtifact — run with --fixer to automatically remediate public-exposure misconfigurations.
Adds CIS Benchmark 3.0 compliance framework support for GCP.
Adds new gen-ai check category to group and run checks for Generative AI, ML, and LLM services.

+3 more show less

Adds GET /overviews/services API endpoint for service-level overviews.
Adds compliance report generation for GCP scans via the API.
Adds configurable broker visibility timeout setting for the Celery task queue.

8 details in Everything

5.0.2 Dec 18, 2024 · release notes

Prowler 5.0.2 adds configurable Celery broker visibility timeout and RLS security config.

└──▷ GET THIS VERSION

$ git clone --branch 5.0.2 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.0.2

Enforces stricter security for Row Level Security (RLS) configuration

1 detail in Everything

5.0.0 Dec 3, 2024 · release notes

Prowler 5.0 adds a full UI, APIs, SDKs, persistent storage, continuous monitoring, 1,000+ controls, and AI-driven check generation.

└──▷ GET THIS VERSION

$ git clone --branch 5.0.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 5.0.0

└──▷ TRY IT

Stand up the full Prowler platform locally — UI, API, and persistent storage — without any cloud dependency.

$ docker compose up -d

Run the CLI-only scanner as before using pipx, unchanged from prior versions.

$ pipx install prowler

New web UI component unifies scan results and enables drill-down into findings across AWS, Azure, GCP, and Kubernetes.
New REST APIs expose scan and findings data for programmatic use cases.
New SDKs enable seamless integration and automation of Prowler workflows.
Persistent storage for scan reports ensures findings are retained and always accessible.
Supports continuous monitoring mode alongside traditional one-time ad-hoc assessments.

+3 more show less

Expands detection and remediation library to over 1,000 security controls across AWS, Azure, Google Cloud, and Kubernetes.
AI-driven control creation automatically generates new detection checks and remediations.
Full platform now deployable on-premises via docker compose up -d, serving the UI at https://localhost:3000.

8 details in Everything

4.6.0 Nov 25, 2024 · release notes

Prowler 4.6.0 adds 13 new AWS checks, 6 auto-remediation fixers, Jira integration, Azure AI Search coverage, and ENS RD2022 compliance for Azure and GCP.

└──▷ GET THIS VERSION

$ git clone --branch 4.6.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 4.6.0

└──▷ TRY IT

Verify that AWS Organizations centralized root credentials management is enabled across your account.

$ prowler aws -c iam_root_credentials_management_enabled

Adds iam_root_credentials_management_enabled check to verify AWS Organizations centralized root credentials management is enabled.
Adds 13 new AWS checks across AppSync, DMS, Firehose, Glue, Kinesis, MemoryDB, MQ, Neptune, RDS, Service Catalog, and Storage Gateway services.
Adds 6 new auto-remediation fixers for DocumentDB, EC2, KMS, Neptune, and RDS misconfigurations (run with --fixer flag).
Adds Jira integration for finding notifications and ticketing.
Adds Azure AI Search check aisearch_service_not_publicly_accessible to detect publicly exposed AI Search services.

+3 more show less

Adds ENS RD2022 compliance framework support for both Azure and GCP.
Introduces standardized Unknown ARN and ID patterns (arn:<partition>:<service>:<region>:<account-id>:resource-type/unknown) for non-existent resources instead of mocked values.
Adds ProwlerChecKreator first version, a tool to assist in creating new Prowler checks.

8 details in Everything

4.5.0 Nov 5, 2024 · release notes

Prowler 4.5.0 adds 104 new AWS checks, LLMJacking detection, GCP org scoping, Azure Container Registry checks, and OCSF v1.3.0 output.

└──▷ GET THIS VERSION

$ git clone --branch 4.5.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 4.5.0

└──▷ TRY IT

Scope a GCP scan to only projects within a specific organization to avoid scanning unrelated projects.

$ prowler gcp --organization-id <organization-id>

Scan all Azure Container Registry resources for public exposure and missing private link configurations.

$ prowler azure --service containerregistry

Adds 5 new AWS Bedrock checks to detect LLMJacking threats: bedrock_model_invocation_logging_enabled, cloudtrail_threat_detection_llm_jacking, bedrock_agent_guardrail_enabled, bedrock_guardrail_prompt_attack_filter_enabled, and bedrock_guardrail_sensitive_information_filter_enabled.
Adds 4 new checks to close IAM Access Analyzer public-exposure gaps: cloudwatch_log_group_not_publicly_accessible, ses_identities_not_publicly_accessible, glue_data_catalogs_not_publicly_accessible, and secretsmanager_not_publicly_accessible.
Adds 104 new AWS checks across 42 services including Bedrock, DMS, FSx, GuardDuty, SES, WAF, AutoScaling, DirectConnect, CodeBuild, Network Firewall, and more.
Adds CloudTrail-based threat detection checks for enumeration and privilege escalation: cloudtrail_threat_detection_enumeration and cloudtrail_threat_detection_privilege_escalation.
Adds new --organization-id flag for GCP scans to limit scope to projects within a specific Google Cloud organization.

+5 more show less

Adds 2 new Azure Container Registry checks: containerregistry_uses_private_link and containerregistry_not_publicly_accessible.
Updates OCSF output format to v1.3.0, adding finding_info.created_time_dt, finding_info.name, finding_info.types, time_dt, metadata.product.uid, and metadata.profiles fields.
Adds support for AWS static credentials authentication.
Adds new transfer AWS service support with transfer_server_in_transit_encryption_enabled check.
Adds cloudwatch_log_group_no_critical_pii_in_logs check to detect PII leakage in CloudWatch log groups.

10 details in Everything

└──▷ BREAKING ON UPGRADE

!The OCSF output field event_time is renamed to time and its format changes from a timestamp to a unix timestamp.
!The OCSF output field finding_info.created_time changes format from a timestamp to a unix timestamp.
!The OCSF output container object is removed.

4.4.0 Sep 30, 2024 · release notes

Prowler 4.4.0 adds 74 new AWS checks across 25 services, KISA ISMS-P compliance, and Azure Container Registry support.

└──▷ GET THIS VERSION

$ git clone --branch 4.4.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 4.4.0

└──▷ TRY IT

List all 74 new checks available in this release to plan your expanded AWS security coverage.

$ prowler aws --list-checks

Audit Azure Container Registries to confirm the admin user account is disabled across your subscription.

$ prowler azure -c containerregistry_admin_user_disabled

Adds 74 new AWS checks spanning ACM, CloudFront, CodeBuild, DMS, DocumentDB, DynamoDB, EC2, ECS, EKS, ElastiCache, ELB, ELBv2, GuardDuty, IAM, KMS, Lambda, Neptune, Network Firewall, Organizations, RDS, S3, SageMaker, and VPC.
New organizations_opt_out_ai_services_policy check detects whether your AWS Organization has opted out of AWS AI services using your data for model training.
New IAM checks detect policies using non-existent actions/resources in NotAction/NotResource statements that inadvertently grant broad permissions.
New containerregistry_admin_user_disabled check for Azure Container Registries verifies the admin user is disabled.
Adds KISA ISMS-P (Korea Internet & Security Agency Personal Information & Information Security Management System) as a supported AWS compliance framework.

+12 more show less

New GuardDuty checks guardduty_rds_protection_enabled and guardduty_s3_protection_enabled verify threat detection coverage for RDS and S3.
New CloudFront checks cover custom SSL certificates, default root objects, SNI-based HTTPS, origin failover, traffic encryption to custom origins, S3 origin access control, and non-existent S3 origin buckets.
New Lambda checks awslambda_function_inside_vpc and awslambda_function_vpc_multi_az verify VPC placement and multi-AZ resilience.
New RDS cluster and instance checks cover multi-AZ, deletion protection, encryption at rest, IAM authentication, minor version upgrades, tag copying, CloudWatch log integration, non-default ports, backup plan protection, and critical event subscriptions.
New ECS checks cover public IP assignment, read-only container filesystem access, host namespace sharing, host networking mode users, logging, and privileged container usage.
New codebuild_project_no_secrets_in_variables and codebuild_project_source_repo_url_no_sensitive_credentials checks detect secrets exposed in CodeBuild configurations.
New eks_cluster_uses_a_supported_version check flags EKS clusters running unsupported Kubernetes versions.
New kms_cmk_not_deleted_unintentionally check detects KMS customer-managed keys scheduled for unintentional deletion.
New s3_access_point_public_access_block check verifies public access block configuration on S3 access points.
New ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports check flags security groups exposing high-risk TCP ports to the internet.
New ec2_launch_template_no_public_ip check ensures launch templates do not assign public IPs by default.
New ecr_repositories_tag_immutability check verifies ECR image tag immutability is enabled.

17 details in Everything

4.3.0 Jul 29, 2024 · release notes

Prowler 4.3.0 adds 32 new AWS/Azure checks, GCP service account impersonation, and configurable EKS logging.

└──▷ GET THIS VERSION

$ git clone --branch 4.3.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 4.3.0

└──▷ TRY IT

Authenticate to GCP using service account impersonation instead of a credentials file — useful for enforcing least-privilege scanning without storing key files.

$ prowler gcp --impersonate-service-account auditor@my-project.iam.gserviceaccount.com

Audit only the new Azure App Functions security checks to assess function app posture quickly.

$ prowler azure --list-checks --service app

Adds 24 new AWS checks across DMS, DocumentDB, Elasticache, IAM, Neptune, NetworkFirewall, and RDS services.
Adds 8 new Azure App Functions checks covering access keys, App Insights, managed identity, public access, runtime version, VNet integration, and FTPS.
Supports GCP Service Account impersonation via --impersonate-service-account <service-account-email>, removing the need for a credentials file.
Makes eks_control_plane_logging_all_types_enabled check configurable via Prowler config.

4 details in Everything

3.16.11 Jul 4, 2024 · release notes

Prowler 3.16.11 adds ignore-unused-services configuration option

└──▷ GET THIS VERSION

$ git clone --branch 3.16.11 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.16.11

ignore_unused_services boolean flag (default true) added to .prowler/config to exclude cloud provider service APIs that are not currently in use from scanning.

1 detail in Everything

4.2.0 May 28, 2024 · release notes

Prowler 4.2.0 brings back HTML output support and introduces a custom checks metadata override flag.

└──▷ GET THIS VERSION

$ git clone --branch 4.2.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 4.2.0

└──▷ USE IT

Generate an HTML report for AWS findings.

shell

prowler aws -M html

Override metadata for custom checks using a YAML file.

shell

prowler aws --custom-checks-metadata-file custom_checks_metadata.yaml

Adds --output-formats html (or -M html) to restore HTML report generation.
Adds --custom-checks-metadata-file <path> to allow overriding check metadata via YAML.
Adds 55 new AWS checks covering Kafka, Lightsail, Storage Gateway, DynamoDB, Cognito, EC2, EventBridge, SNS, and RDS.

3 details in Everything

4.1.0 Apr 19, 2024 · release notes

Prowler 4.1.0 adds GCP project ID wildcards to CLI and new OCSF detection finding fields.

└──▷ GET THIS VERSION

$ git clone --branch 4.1.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 4.1.0

└──▷ USE IT

List all GCP projects accessible to the current credentials to verify scope before a full scan.

shell

prowler gcp --list-project-ids

Scan only specific GCP projects using wildcard patterns for efficient filtering.

shell

prowler gcp --project-ids 'prod-*' --excluded-project-ids '*-dev'

The --project-ids flag for the GCP provider now accepts * as a prefix or suffix to filter project IDs.
Adds the --list-project-ids flag to retrieve accessible projects for the provided credentials.
Adds the --excluded-project-ids flag to exclude specific projects from scanning, also supporting * wildcards.
The .ocsf.json output now includes check_id, compliance, and full check metadata in OCSF Detection Findings.

4 details in Everything

4.0.0 Apr 4, 2024 · release notes

Prowler 4.0 adds prowler dashboard, Kubernetes provider, --fix remediation, OCSF JSON output, and Mutelist support.

└──▷ GET THIS VERSION

$ git clone --branch 4.0.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 4.0.0

└──▷ TRY IT

Launch the local UI to review findings from a previous scan.

$ prowler dashboard

Scan a Kubernetes cluster using a specific kubeconfig for CIS 1.8 compliance.

$ prowler kubernetes --kubeconfig-file <kube.yaml>

Remediate failed findings automatically for AWS resources.

$ prowler aws --fix

prowler dashboard command for local visualization of gathered data
Kubernetes provider with --kubeconfig-file flag and default CIS Benchmark 1.8 execution
JSON output now follows the OCSF Schema v1.1.0 format
--scan-unused-services flag to include unused AWS services in execution
Threat detection checks accessible via --category threat-detection for enumeration and privilege escalation

+2 more show less

CIS Benchmark 2.0 and 2.1 support for Azure with location data included in findings
All compliance frameworks execute by default and are stored in output/compliance

7 details in Everything

└──▷ BREAKING ON UPGRADE

!The --quiet option is deprecated; use the --status flag to select findings status (PASS, FAIL, or MANUAL)
!The AWS flag --sts-endpoint-region is deprecated
!Sending only FAILs to AWS Security Hub now requires --send-sh-only-fails or --security-hub --status FAIL
!All findings with status INFO are now reported as MANUAL
!The HTML output format is deprecated and replaced by the prowler dashboard command
!The native JSON output format is deprecated and replaced by the OCSF Schema v1.1.0

3.16.0 Apr 4, 2024 · release notes

Prowler v3.16 adds coverage for Azure CIS v2.0/2.1 compliance frameworks.

└──▷ GET THIS VERSION

$ git clone --branch 3.16.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.16.0

└──▷ USE IT

Run Azure security checks against the latest CIS Benchmark v2.1 standard

shell

prowler azure --compliance cis_2.1_azure

Audit Azure subscriptions against the CIS Benchmark v2.0 standard

shell

prowler azure --compliance cis_2.0_azure

Adds --compliance cis_2.1_azure flag to run the new Azure CIS v2.1 framework
Adds support for cis_2.0_azure as a valid compliance framework identifier

2 details in Everything

3.15.0 Mar 14, 2024 · release notes

Prowler 3.15 adds Shodan integration for Azure/GCP, AWS FTR compliance, and Kubernetes coverage for managed services.

└──▷ GET THIS VERSION

$ git clone --branch 3.15.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.15.0

└──▷ TRY IT

Scan GCP compute resources and cross-reference them with Shodan to find publicly exposed addresses.

$ prowler gcp -c compute_public_address_shodan --shodan <API_KEY>

Run the new AWS Foundational Technical Review compliance framework against your AWS account.

$ prowler aws --compliance foundational_technical_review_aws

Adds --shodan <API_KEY> CLI flag to check if public IPs in Azure or GCP are exposed on Shodan
Adds support for setting the Shodan API key via the config.yaml file instead of a CLI flag
Adds foundational_technical_review_aws compliance framework with the --compliance flag
Adds Kubernetes checks for managed services EKS, AKS, and GKE/GCR using the --services flag

4 details in Everything

3.14.0 Feb 20, 2024 · release notes

Prowler 3.14 adds 25 new Azure security checks covering Network, PostgreSQL, App Insights, MySQL, CosmosDB and VMs.

└──▷ GET THIS VERSION

$ git clone --branch 3.14.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.14.0

└──▷ TRY IT

List all currently supported Azure checks to identify which new CIS v2.0.0 validations are available.

$ prowler azure -l

Adds 25 new Azure CIS Benchmark v2.0.0 checks for Network, PostgreSQL, Application Insights, MySQL, CosmosDB and Virtual Machines
Enables viewing the full list of available checks via the -l flag: prowler azure -l

2 details in Everything

3.13.0 Feb 8, 2024 · release notes

Prowler 3.13 adds new Azure checks, CIS AWS v3 compliance framework, Python 3.12 support, and quick inventory output file.

└──▷ GET THIS VERSION

$ git clone --branch 3.13.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.13.0

└──▷ USE IT

Scan AWS accounts using the latest CIS v3.0 compliance framework to check alignment.

shell

prowler aws --compliance cis_3.0_aws

Generate a quick inventory of AWS resources and save it to a specific CSV file for further analysis.

shell

prowler aws -i -F custom-output-file.csv

Run the new onboarding compliance checks to ensure new AWS accounts meet security standards before joining the organization.

shell

prowler aws --compliance aws_account_security_onboarding_aws

Adds --compliance cis_3.0_aws flag to run the new CIS AWS Foundations Benchmark v3.0.0
Adds --compliance aws_account_security_onboarding_aws flag for the new AWS Account Security Onboarding compliance framework
Adds -F flag support with -i (quick inventory) on AWS to write output to a custom file
Supports running Prowler with Python 3.12

4 details in Everything

3.12.0 Jan 8, 2024 · release notes

Prowler 3.12.0 adds custom check metadata overrides, AWS role session names, and Amazon Cognito service coverage

└──▷ GET THIS VERSION

$ git clone --branch 3.12.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.12.0

└──▷ TRY IT

Override severity for specific checks using an external metadata file instead of modifying source code.

$ prowler aws --custom-checks-metadata-file custom_checks_metadata.yaml

Set a descriptive name for the assumed IAM role to aid in CloudTrail auditing and logging.

$ prowler aws --role-session-name my-audit-session

Adds --custom-checks-metadata-file CLI flag to override check severity via an external YAML file
Adds --role-session-name <role_session_name> CLI argument to customize the AWS Role Session name during assumption
Adds Amazon Cognito service coverage with new checks for Cognito resources
Improves AWS scanning performance by only targeting regions explicitly enabled in the AWS account

4 details in Everything

3.11.0 Oct 31, 2023 · release notes

Prowler 3.11 adds --ignore-unused-services flag, check aliases, VPC names in findings, and report interface hooks

└──▷ GET THIS VERSION

$ git clone --branch 3.11.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.11.0

└──▷ TRY IT

Scan AWS and skip findings for services like S3 or Lambda that aren't actually deployed to reduce noise.

$ prowler aws --ignore-unused-services

--ignore-unused-services flag skips findings for services not detected in the environment
Check Aliases via CheckAliases metadata key enable executing checks by alias using -c/--checks
AWS allowlist file includes AWS Control Tower resources for landing zone coverage
New account check account_maintain_different_contact_details_to_security_billing_and_operations
New CloudTrail check cloudtrail_multi_region_enabled_logging_management_events

+7 more show less

New EC2 DataLifecycle Manager service and check dlm_ebs_snapshot_lifecycle_policy_exists
New EC2 EBS check ec2_ebs_volume_snapshots_exists
New DocumentDB service and check documentdb_instance_storage_encrypted
New Support check trustedadvisor_premium_support_plan_subscribed
New Neptune service and check neptune_cluster_uses_public_subnet
New Elasticache service and check elasticache_cluster_uses_public_subnet
New IAM check iam_user_with_temporary_credentials

12 details in Everything

3.10.0 Oct 11, 2023 · release notes

Prowler 3.10.0 adds AWS checks iam_role_administratoraccess_policy and wafv2_webacl_logging_enabled, includes resource tags in json-asff/Security Hub outputs, supports Unix timestamps, and introduces max_unused_access_keys_days config

└──▷ GET THIS VERSION

$ git clone --branch 3.10.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.10.0

└──▷ USE IT

Run the new IAM check that verifies if an IAM role has administrator access policy attached

shell

prowler aws --checks iam_role_administratoraccess_policy

Enable Unix timestamps in all outputs for easier log parsing and time-series correlation

shell

prowler aws --unix-timestamp -o output.json

Configure a custom threshold of 30 days for unused access keys using the configuration file

yaml

max_unused_access_keys_days: 30

prowler aws can now run the new AWS IAM check iam_role_administratoraccess_policy.
Prowler outputs now support Unix timestamps via the --unix-timestamp flag.
The max_unused_access_keys_days configuration value allows customizing unused access key age thresholds for IAM checks.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!IAM credentials checks iam_disable_90_days_credentials, iam_disable_45_days_credentials, and iam_disable_30_days_credentials are replaced by iam_user_accesskey_unused and iam_user_console_access_unused.
!Unused credential detection now defaults to 45 days instead of the previous fixed intervals.

3.9.0 Aug 25, 2023 · release notes

Prowler 3.9 adds AWS Athena checks, S3 KMS check, --list-checks-json flag, and configurable ECR vulnerability severity

└──▷ GET THIS VERSION

$ git clone --branch 3.9.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.9.0

└──▷ USE IT

Export all available Prowler checks to a JSON file for inspection or scripting with --checks-file

shell

prowler aws --list-checks-json > checks.json

Configure ECR vulnerability scanning to only fail when severities meet a specific threshold

config

ecr_repository_vulnerability_minimum_severity: 'HIGH'

prowler aws now runs new Athena service checks athena_workgroup_encryption and athena_workgroup_enforce_configuration
New AWS S3 check s3_bucket_kms_encryption detects bucket encryption via KMS
New AWS EC2 check ec2_instance_detailed_monitoring_enabled detects detailed monitoring status
IAM service now retrieves inline policies for Users, Roles, and Groups to support the new iam_inline_policy_no_administrative_privileges check
prowler aws --list-checks-json lists all available checks in JSON format for use with --checks-file

+1 more show less

ECR check ecr_repositories_scan_vulnerabilities_in_latest_image respects the configuration value ecr_repository_vulnerability_minimum_severity

6 details in Everything

3.8.0 Aug 3, 2023 · release notes

Prowler 3.8.0 adds Azure SQL Server scanning, new AWS S3 ACL checks, and faster GCP scans.

└──▷ GET THIS VERSION

$ git clone --branch 3.8.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.8.0

└──▷ TRY IT

Scan Azure for SQL Server security posture including auditing, Azure AD admin status, and inbound access rules.

$ prowler azure --service sqlserver

Scan AWS S3 specifically for public read/write ACL misconfigurations.

$ prowler aws --service s3

Run a CIS 2.0 compliant GCP scan, benefiting from the new 10x performance improvement.

$ prowler gcp --compliance cis_2.0_gcp

Adds sqlserver service support for Azure with three new checks: sqlserver_auditing_enabled, sqlserver_azuread_administrator_enabled, and sqlserver_unrestricted_inbound_access
Adds two new AWS S3 checks: s3_bucket_public_list_acl and s3_bucket_public_write_acl to detect buckets publicly listable or writable via ACL
Improves GCP scan performance by approximately 10x through optimized region, location, and zone scanning logic

3 details in Everything

3.7.0 Jul 6, 2023 · release notes

Prowler 3.7.0 adds MITRE ATT&CK, ISO27001, AWS Well-Architected, and GCP CIS v2 compliance frameworks plus Allowlist exceptions

└──▷ GET THIS VERSION

$ git clone --branch 3.7.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.7.0

└──▷ TRY IT

Run an AWS scan against the new MITRE ATT&CK framework to map findings to adversary tactics.

$ prowler aws --compliance mitre_attack_aws

Adds --compliance flag values mitre_attack_aws, iso27001_2013_aws, and aws_well_architected_framework_reliability_pillar_aws for AWS scans.
Adds GCP CIS v2.0.0 benchmark support via the --compliance cis_2.0_gcp flag.
Adds Exceptions sub-key to Allowlist YAML config for granular account, region, resource, and tag exclusion.

3 details in Everything

3.6.0 Jun 13, 2023 · release notes

Prowler 3.6.0 adds --project-ids, OCSF JSON output, AWS WAF security pillar, and MFA support for AWS.

└──▷ GET THIS VERSION

$ git clone --branch 3.6.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.6.0

└──▷ USE IT

Scan only specific GCP projects to reduce scope and time.

shell

prowler gcp --project-ids my-project-1 my-project-2

Run an AWS scan enforcing MFA for the current IAM identity.

shell

prowler aws --mfa

Adds the --project-ids flag to prowler gcp so you can restrict scans to specific Google Cloud projects instead of scanning all permitted ones
Adds OCSF JSON as a default output format for AWS, Azure, and GCP scanners to integrate with platforms like Amazon Security Lake
Adds support for the aws_well_architected_framework_security_pillar compliance framework in AWS scans via --compliance
Adds the --mfa flag to prowler aws to prompt for MFA ARN and code, enabling session assumption when the IAM entity enforces MFA

4 details in Everything

3.5.0 May 11, 2023 · release notes

Prowler 3.5 adds Slack integration, regex allowlisting for tags, and new AWS checks

└──▷ GET THIS VERSION

$ git clone --branch 3.5.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.5.0

└──▷ USE IT

List all new checks added in this release to verify coverage.

shell

prowler aws --list-checks

Slack integration added to send execution summaries to a channel
Allowlist service filtering and regex matching in Tags field now supported
New checks for FMS, NetworkFirewall, IAM, Route53, AutoScaling, Organizations, RDS, S3, SSM Incidents, and Workspaces

3 details in Everything

3.4.0 Apr 20, 2023 · release notes

Prowler 3.4.0 adds Google Cloud provider support, custom checks via -x/--checks-folder, and HTML reports for Azure/GCP.

└──▷ GET THIS VERSION

$ git clone --branch 3.4.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.4.0

└──▷ TRY IT

Run Prowler against a custom directory of user-defined security checks

$ prowler aws -x /path/to/custom/checks

Scan Google Cloud resources using the new GCP provider

$ prowler gcp --list-checks

-x/--checks-folder flag enables running custom checks from user-defined directories
Google Cloud (GCP) provider added with 43 new security checks across IAM, BigQuery, CloudSQL, CloudStorage, Compute, KMS, and Logging
HTML report output now generated for Azure and Google Cloud providers

3 details in Everything

3.3.0 Mar 16, 2023 · release notes

Prowler 3.3.0 adds resource tags and compliance data to all outputs, new Security Hub integration, and region support in Quick Inventory.

└──▷ GET THIS VERSION

$ git clone --branch 3.3.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.3.0

Adds s3_bucket_level_public_access_block, rds_instance_transport_encrypted, and cloudwatch_log_group_no_secrets_in_logs checks
Includes resource tags in HTML, CSV, and JSON findings outputs for AWS provider
Includes security framework compliance details in HTML, CSV, and JSON findings outputs
Adds region information to Security Hub findings sent by Prowler
Adds regions to the output of prowler -i (Quick Inventory)

5 details in Everything

3.2.1 Feb 21, 2023 · release notes

Prowler 3.2.1 adds --skip-sh-update flag to Security Hub output and extended status messages.

└──▷ GET THIS VERSION

$ git clone --branch 3.2.1 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 3.2.1

└──▷ TRY IT

Execute a Prowler scan against AWS without pushing results to or updating AWS Security Hub, useful for environments where SH is disabled or restricted.

$ prowler aws --skip-sh-update

Adds --skip-sh-update CLI argument to skip the AWS Security Hub update step during scan execution

1 detail in Everything

3.2.0 Feb 13, 2023 · release notes

Prowler 3.2.0 adds tag-based scans (--resource-tags), resource-ARN scans (--resource-arn), and an exit code option (-z).

└──▷ GET THIS VERSION

$ git clone --branch 3.2.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.2.0

└──▷ USE IT

Scan only resources tagged with Environment=dev and Project=prowler to isolate testing or cost center checks.

shell

prowler aws --resource-tags Environment=dev Project=prowler

Run checks for specific IAM users and VPCs using their ARNs, useful for pipeline steps targeting specific assets.

shell

prowler aws --resource-arn arn:aws:iam::012345678910:user/test arn:aws:ec2:us-east-1:123456789012:vpc/vpc-12345678

Set a custom exit code (e.g., 3) when Prowler detects failed findings to integrate with CI/CD status checks.

shell

prowler aws -z 3

Adds --resource-tags flag to limit scanning to resources matching specific tags, e.g., Environment=dev Project=prowler.
Adds --resource-arn flag to scan only specific AWS resources by their ARN, supporting multiple ARNs in one command.
Adds -z flag to define the exit code returned when Prowler finds failed checks.
Adds 17 new AWS security compliance frameworks including CISA Cyber Essentials, FedRAMP Low/Mod, FFIEC, GDPR, HIPAA, NIST CSF/800-171/800-53, PCI v3.2.1, and SOC 2.
Adds accessanalyzer_enabled check to verify if IAM Access Analyzer is enabled in addition to finding active findings.

5 details in Everything

3.1.0 Jan 17, 2023 · release notes

Prowler 3.1.0 adds iam_role_cross_service_confused_deputy_prevention check and --only-logs flag

└──▷ GET THIS VERSION

$ git clone --branch 3.1.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.1.0

└──▷ USE IT

Run Prowler and suppress console output, writing only structured execution logs for log aggregation pipelines.

shell

prowler aws --only-logs

Explicitly run the confused deputy prevention check to ensure IAM roles use aws:SourceArn and aws:SourceAccount condition keys.

shell

prowler aws -c iam_role_cross_service_confused_deputy_prevention

Adds --only-logs CLI flag to filter output so only execution logs are shown.
Adds new AWS check iam_role_cross_service_confused_deputy_prevention to validate IAM Service Roles against confused deputy attacks.

2 details in Everything

3.0.0 Dec 21, 2022 · release notes

Prowler 3.0 introduces Azure cloud support, a rewritten Python engine with significant speed improvements, and dynamic compliance grouping.

└──▷ GET THIS VERSION

$ git clone --branch 3.0.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 3.0.0

└──▷ TRY IT

Use pip to install the new Python-based version of the tool for faster scanning.

$ pip install prowler

Adds Azure as a supported second cloud provider alongside AWS
Rewrites the core engine in Python, replacing previous bash scripts
Enables scanning an entire AWS account across all regions up to 37x faster
Introduces dynamic generation of compliance groups based on check metadata (services, categories, severity)
Adds full support for CIS 1.4 and CIS 1.5 compliance frameworks

+4 more show less

Adds new Spanish ENS compliance framework support
Generates consolidated CSV and JSON reports with over 40 values per finding
Enables HTML, CSV, and JSON output files automatically on every run
Improves Quick Inventory to retrieve AWS resource lists in seconds

9 details in Everything

2.12.0 Oct 27, 2022 · release notes

Prowler v2.12.0 adds checks for CodeArtifact internal packages and OpenSearch auth, plus a CIS v8 framework group.

└──▷ GET THIS VERSION

$ git clone --branch 2.12.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 2.12.0

Adds check7195 to detect when CodeArtifact internal packages allow external public source publishing
Adds check extra780 to verify Cognito or SAML authentication on OpenSearch resources
Adds cisig2 group for CIS Critical Security Controls v8 compliance scanning
CloudTrail checks 21, 22, 23, 24, 26, and 27 now include shadow trails in results for multi-region and AWS organizations

4 details in Everything

2.11.0 Jul 21, 2022 · release notes

Prowler 2.11.0 adds quick inventory (-i), PostgreSQL output, and 14 new checks

└──▷ GET THIS VERSION

$ git clone --branch 2.11.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 2.11.0

Adds ./prowler -i subcommand for a beta quick inventory of IAM resources
Adds PostgreSQL as an output destination for findings via the new connector
Adds support for environment variables in the PostgreSQL database connector configuration

3 details in Everything

2.10.0 May 25, 2022 · release notes

Prowler 2.10 adds DynamoDB allowlist, custom checks via extraXXXX, and AWS CodeBuild/EMR/Lambda detections.

└──▷ GET THIS VERSION

$ git clone --branch 2.10.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 2.10.0

extra9999 custom check support enables on-the-fly check authoring
DynamoDB support for allowlist management with dynamodb_allowlist feature
New detections for CodeBuild (last invoked > 90 days, user-controlled buildspec)
New detections for EMR (public IP, public access block) and Lambda function URLs/CORS

4 details in Everything

2.9.0 Apr 13, 2022 · release notes

Prowler 2.9 adds S3 URI support for custom checks and allowlists via the -w flag.

└──▷ GET THIS VERSION

$ git clone --branch 2.9.0 https://github.com/prowler-cloud/prowler.git
# already have the repo? check out this version:
$ git checkout 2.9.0

└──▷ TRY IT

Run Prowler with custom checks and allowlists stored in an S3 bucket.

$ prowler -w s3://bucket/prefix/allowlist_sample.txt

Support S3 URIs for custom checks paths using the -w option
Support S3 URIs for allowlist file using the -w option

2 details in Everything

2.8.0 Mar 16, 2022 · release notes

Prowler 2.8.0 adds AWS Organization metadata to outputs and comma-separated region filtering

└──▷ GET THIS VERSION

$ git clone --branch 2.8.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 2.8.0

└──▷ TRY IT

Scan two specific AWS regions (eu-west-1 and us-east-2) in a single invocation instead of running twice.

$ prowler --profile my-profile --filter-region eu-west-1,us-east-2

Adds --filter-region support for comma-separated regions to scan multiple specific regions in one run
Includes AWS account metadata (Account Name, Email, ARN, Organization ID, Tags) in CSV and JSON output formats when scanning with assume role across Organizations

2 details in Everything

2.7.0 Jan 24, 2022 · release notes

Prowler 2.7 adds -D flag for initial-cred S3 copy, 11 new checks, and improved error handling.

└──▷ GET THIS VERSION

$ git clone --branch 2.7.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 2.7.0

-D CLI option copies scan results to S3 using the initial AWS credentials instead of assumed roles
Adds extra7160 check for Redshift automatic upgrades
Adds extra7161 check for EFS encryption at rest
Adds extra7162 check for CloudWatch Log Groups retention policy of 365 days
Adds extra7163 check for Secrets Manager key rotation

+3 more show less

Adds extra7164 check for CloudWatch Log Groups KMS protection
Adds extra7165 check for DynamoDB DAX Clusters encryption at rest
Adds extra7166 through extra7171 checks for AWS Shield Advanced protection on Elastic IP, CloudFront, Route53, Global Accelerators, ALBs, and CLBs

8 details in Everything

2.6.0 Nov 12, 2021 · release notes

Prowler 2.6.0 adds -Z flag for exit code 3, -C for check file input, EFS backup check (extra7148), and R53 Transfer Lock

└──▷ GET THIS VERSION

$ git clone --branch 2.6.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 2.6.0

-Z flag controls if Prowler returns exit code 3 on a failed check.
-C <file> allows providing a file of checks to be ran.
Added extra7148 check for EFS backup.
Added extra7149 check for Redshift automated snapshots.
Added extra7150 check for ELB deletion protection.

+9 more show less

Added extra7151 check for DynamoDB PITR.
Added extra7152 check for Route53 Privacy Protection.
Added extra7153 check for Route53 Transfer Lock.
Added extra7154 check for CloudFormation termination protection.
Added extra7155 check for ALB desync mitigation mode.
Added extra7156 check for API Gateway V2 Access Logging.
Added extra7157 check for API Gateway V2 authorizers.
Added extra7158 check for ELBV2 listeners underneath.
Added extra7159 check for ELB listeners underneath.

14 details in Everything

2.5.0 Aug 13, 2021 · release notes

Prowler 2.5.0 adds background report saving via -M, custom output paths, S3 bucket targets, and 14 new security checks.

└──▷ GET THIS VERSION

$ git clone --branch 2.5.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 2.5.0

Adds PROWLER_START_TIME header to CSV output
Saves reports in the background while displaying standard output when using -M option
Adds 14 new security checks: extra7134, extra7135, extra7136, extra7137, extra7138, extra7139, extra7140, extra7141, extra7142, extra7143, extra7144, extra7145, extra7146, extra7147

3 details in Everything

2.4.0 Apr 9, 2021 · release notes

Prowler 2.4.0 adds Security Hub integration, Shodan API support, and new output fields

└──▷ GET THIS VERSION

$ git clone --branch 2.4.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 2.4.0

└──▷ TRY IT

Send Prowler findings to AWS Security Hub for centralized compliance tracking.

$ prowler -M ashf

Check for exposed Elastic IPs using Shodan's API to enrich risk assessment.

$ prowler -N your_shodan_api_key extra7102

Whitelist findings using a file that supports regex patterns for flexible matching.

$ prowler -w my_whitelist.yml

Adds -M ashf to enable official Security Hub integration for exporting findings
Adds -N <shodan_api_key> CLI argument to run extra7102 (Elastic IP Shodan check)
Adds new CSV/HTML output fields: CHECK_RISK, CHECK_REMEDIATION, CHECK_DOC, CHECK_CAF_EPIC
Adds -w whitelist_file support for whitelisting with regex and fuzzy matching improvements
Adds new checks for SageMaker, ENS (Esquema Nacional de Seguridad), FFIEC, SOC2, and additional HIPAA/GDPR controls

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The NOTES field header in CSV output is renamed to CHECK_RESULT_EXTENDED

2.2.0 Feb 21, 2020 · release notes

Prowler 2.2.0 adds -E for check exclusion, native AssumeRole support, quiet mode, and group exclusion via config.

└──▷ GET THIS VERSION

$ git clone --branch 2.2.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 2.2.0

└──▷ TRY IT

Run Prowler but skip specific checks to reduce noise or execution time.

$ prowler -E check_extra764,check_extra731

Suppress all passing checks and only display failures for faster CI feedback.

$ prowler -q

-E flag now supports exclusion of one or multiple checks
Native AWS AssumeRole support allows using custom profiles with role assumptions
Quiet mode (-q) suppresses pass/info output to show only failures
megaprowler code for multi-account scanning (sample implementation)

4 details in Everything

2.0 Nov 27, 2018 · release notes

Prowler v2.0 introduces custom groups via -g, JSON output via -M json, Fargate support, and 18 new checks

└──▷ GET THIS VERSION

$ git clone --branch 2.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 2.0

└──▷ USE IT

Run a compliance scan and output results to JSON for CI/CD pipeline integration

shell

prowler -M json

Execute only the checks defined in your custom compliance group

shell

prowler -g compliance

Adds -M json flag to output results in JSON format
Adds -g <group_id> option to run a specific group of checks
Adds -b flag to hide the startup banner
Adds -V flag to display the current version
Adds support for running Prowler on AWS Fargate using metadata for credentials

+20 more show less

Adds check extra723 for public RDS snapshots (single and cluster)
Adds check extra724 for Certificate Transparency
Adds check extra725 for S3 object-level logging
Adds check extra726 for Trusted Advisor errors and warnings
Adds check extra727 for SQS queues with public policies
Adds check extra728 for SQS queues without encryption
Adds check extra729 for unencrypted EBS volumes
Adds check extra730 for ACM certificates expiring in 7 days or less
Adds check extra731 for SNS topics with public policies
Adds check extra732 for CloudFront distributions without geo restrictions
Adds check extra733 for SAML Providers allowing STS usage
Adds check extra734 for S3 buckets without default encryption (SSE)
Adds check extra735 for RDS instances with unencrypted storage
Adds check extra736 for exposed KMS keys
Adds check extra737 for KMS keys with key rotation disabled
Adds check extra738 for CloudFront distributions not set to HTTPS
Adds check extra739 for ELBs without logging enabled
Adds check extra740 for unencrypted EBS snapshots
Changes output messages from OK/'WARNING' to PASS/'FAIL'
Adds groups for GDPR and HIPAA compliance checks

25 details in Everything

└──▷ BREAKING ON UPGRADE

!Output messages now display PASS and FAIL instead of the previous OK and WARNING values

1.6 Feb 21, 2018 · release notes

Adds -c forensics-ready group and -e exclusion flag for Prowler

└──▷ GET THIS VERSION

$ git clone --branch 1.6 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 1.6

└──▷ USE IT

Run only the new forensics-ready checks against your AWS environment.

shell

prowler -c forensics-ready

Run standard checks but skip the slower extra checks using the new -e flag.

shell

prowler -e

Adds -e flag to exclude all extra checks and reduce execution time
Adds new extra checks (extra78-extra722) for RDS, ELB, EC2, Redshift, Macie, GuardDuty, CloudFront, Elasticsearch, S3, Route53, Lambda, API Gateway logging/access configurations

2 details in Everything

1.5 Jan 9, 2018 · release notes

Adds -l flag to list all checks, Dockerfile for custom images, and extra checks for public resources.

└──▷ GET THIS VERSION

$ git clone --branch 1.5 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 1.5

└──▷ TRY IT

List all available security checks without running them.

$ prowler -l

Build a custom Prowler Docker image using the provided Dockerfile.

$ docker build -t my-prowler .

Adds -l flag to list all available checks
Adds new Dockerfile to build custom Prowler images
Adds more extra checks to find public AMIs, ECR repos and EC2 snapshots

3 details in Everything

1.4 Sep 13, 2017 · release notes

Adds -n flag to display numeric check codes and --max-items option for extra72 output filtering

└──▷ GET THIS VERSION

$ git clone --branch 1.4 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 1.4

└──▷ HOW TO FIND IT

Limit extra72 output to the top 5 critical items to reduce CI noise.

📍prowler s3 --extra-72 --max-items 5

Use numeric IDs for programmatic filtering of specific checks.

📍prowler s3 -n | grep 1.02

Adds -n CLI argument to show numeric check numbers (e.g., 1.02) in output for easier sorting
Adds --max-items option to the extra72 subcommand to limit the number of items displayed

2 details in Everything

1.3 Jul 18, 2017 · release notes

Prowler 1.3 adds CIS profiles (profile1, profile2) and extra checks for admin MFA, EBS, S3 exposure

└──▷ GET THIS VERSION

$ git clone --branch 1.3 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:
$ git checkout 1.3

Adds profile1 and profile2 CIS compliance profiles to match their documentation
Adds new checks: extra71, extra72, extra73 for admins without MFA, publicly shared EBS snapshots, and internet-open S3 buckets

2 details in Everything

Prowler

Summary

How Prowler helps

Languages

Features

What Prowler offers you

release 9 total

example

release

release

release 7 total

example

release

release

example

release

release

example

release

release 8 total

docs

example

release

release

release

release

release

example

release

release

example

release

example

release

example

release

release 19 total

docs

example

release 69 total

docs

example 10 total

release 65 total

example

release 48 total

docs

example

release 27 total

example

release 23 total

docs

example

release 14 total

command line

example 10 total

release 18 total

example

release 19 total

example

release 17 total

example

release 18 total

example

release 16 total

example

release 9 total

example 8 total

release 14 total

example

release 12 total

example

release 11 total

example

release 10 total

example

release 11 total

example

release 10 total

example

release 10 total