ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-01-25 02:08:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: include ExternalId on CFN template (#9697)

Browse Source
This commit is contained in:
César Arroba
2025-12-29 15:19:40 +01:00
committed by GitHub
parent 144d59de45
commit 0c3c6aea0e
2 changed files with 28 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docs/user-guide/providers/aws/role-assumption.mdx
View File

@@ -69,7 +69,19 @@ If your IAM Role is configured with Multi-Factor Authentication (MFA), use `--mf
## Creating a Role for One or Multiple Accounts
To create an IAM role that can be assumed in one or multiple AWS accounts, use either a CloudFormation Stack or StackSet and adapt the provided [template](https://github.com/prowler-cloud/prowler/blob/master/permissions/create_role_to_assume_cfn.yaml).
To create an IAM role that can be assumed in one or multiple AWS accounts, use either a CloudFormation Stack or StackSet with the provided [template](https://github.com/prowler-cloud/prowler/blob/master/permissions/create_role_to_assume_cfn.yaml).
The template requires the following parameters:
- **AuthorisedARN:** The ARN of the user or role authorized to assume the created role (e.g., `arn:aws:iam::123456789012:root`)
- **ExternalId:** A unique identifier to prevent the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html)
- **ProwlerRoleName:** *(Optional)* Name of the IAM role (default: `ProwlerScanRole`)
When running Prowler, include the External ID using the `-I/--external-id` flag:
```sh
prowler aws -R arn:aws:iam::<account_id>:role/<role_name> -I <external_id>
```
<Note>
**Session Duration Considerations**: Depending on the number of checks performed and the size of your infrastructure, Prowler may require more than 1 hour to complete. Use the `-T <seconds>` option to allow up to 12 hours (43,200 seconds). If you need more than 1 hour, modify the _“Maximum CLI/API session duration”_ setting for the role. Learn more [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session).