An open-source cloud security platform that automates security and compliance assessments across AWS, Azure, GCP, and other cloud providers.
Prowler is an open-source cloud security platform that automates security and compliance assessments across multiple cloud providers like AWS, Azure, and GCP. It solves the problem of manual, complex security auditing by providing hundreds of pre-built checks, AI-driven scanning, and support for numerous compliance frameworks. The platform helps organizations identify misconfigurations, monitor compliance, and prioritize risks in their cloud infrastructure.
Cloud security engineers, DevOps teams, compliance officers, and organizations managing multi-cloud environments who need automated security auditing and compliance reporting.
Developers choose Prowler for its comprehensive multi-cloud coverage, extensive library of security checks, and support for major compliance frameworks out of the box. Its open-source nature, self-hosting capability, and flexible interfaces (CLI, UI, API) make it a cost-effective alternative to proprietary cloud security tools.
Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports AWS, Azure, GCP, Kubernetes, and 10+ other providers with hundreds of checks, as detailed in the provider table, enabling unified security across diverse environments.
Includes built-in controls for 40+ standards like CIS, NIST, PCI-DSS, and GDPR, simplifying audits and regulatory reporting without custom scripting.
Prowler ThreatScore delivers customizable, AI-powered scans that weight findings by criticality, helping teams focus remediation efforts efficiently.
Offers CLI for automation, a web UI (Prowler App) for visualization, and REST API for integration, catering to diverse operational workflows.
Self-hosting requires Docker Compose, multiple services (Postgres, Valkey, Neo4j), and environment variable configuration, which the README warns can be insecure if misconfigured.
AWS has 572 checks, while others like GCP have only 100, making coverage less comprehensive for non-AWS clouds despite multi-cloud claims.
Features like Attack Path Analysis depend on a Neo4j instance, adding infrastructure overhead and potential points of failure for advanced functionality.