+
+
+???+ note "User creation and default tenant behavior"
+
+ When creating a new user, the behavior depends on whether an invitation is provided:
+
+ - **Without an invitation**:
+
+ - A new tenant is automatically created.
+ - The new user is assigned to this tenant.
+ - A set of **RBAC admin permissions** is generated and assigned to the user for the newly-created tenant.
+
+ - **With an invitation**: The user is added to the specified tenant with the permissions defined in the invitation.
+
+ This mechanism ensures that the first user in a newly created tenant has administrative permissions within that tenant.
+
+## Log In
+
+Access Prowler App by logging in with **email and password**.
+
+
+
+## Add Cloud Provider
+
+Configure a cloud provider for scanning:
+
+1. Navigate to `Settings > Cloud Providers` and click `Add Account`.
+2. Select the cloud provider.
+3. Enter the provider's identifier (Optional: Add an alias):
+ - **AWS**: Account ID
+ - **GCP**: Project ID
+ - **Azure**: Subscription ID
+ - **Kubernetes**: Cluster ID
+ - **M365**: Domain ID
+4. Follow the guided instructions to add and authenticate your credentials.
+
+## Start a Scan
+
+Once credentials are successfully added and validated, Prowler initiates a scan of your cloud environment.
+
+Click `Go to Scans` to monitor progress.
+
+## View Results
+
+Review findings during scan execution in the following sections:
+
+- **Overview** – Provides a high-level summary of your scans.
+ 
+
+- **Compliance** – Displays compliance insights based on security frameworks.
+ 
+
+> For detailed usage instructions, refer to the [Prowler App Guide](../tutorials/prowler-app.md).
+
+???+ note
+ Prowler will automatically scan all configured providers every **24 hours**, ensuring your cloud environment stays continuously monitored.
diff --git a/docs/basic-usage/prowler-cli.md b/docs/basic-usage/prowler-cli.md
new file mode 100644
index 0000000000..0c093968b4
--- /dev/null
+++ b/docs/basic-usage/prowler-cli.md
@@ -0,0 +1,257 @@
+## Running Prowler
+
+Running Prowler requires specifying the provider (e.g `aws`, `gcp`, `azure`, `m365`, `github` or `kubernetes`):
+
+???+ note
+ If no provider is specified, AWS is used by default for backward compatibility with Prowler v2.
+
+```console
+prowler 
-
-
-???+ note "User creation and default tenant behavior"
-
- When creating a new user, the behavior depends on whether an invitation is provided:
-
- - **Without an invitation**:
-
- - A new tenant is automatically created.
- - The new user is assigned to this tenant.
- - A set of **RBAC admin permissions** is generated and assigned to the user for the newly-created tenant.
-
- - **With an invitation**: The user is added to the specified tenant with the permissions defined in the invitation.
-
- This mechanism ensures that the first user in a newly created tenant has administrative permissions within that tenant.
-
-#### Log In
-
-Log in using your **email and password** to access the Prowler App.
-
-
-
-#### Add a Cloud Provider
-
-To configure a cloud provider for scanning:
-
-1. Navigate to `Settings > Cloud Providers` and click `Add Account`.
-2. Select the cloud provider you wish to scan (**AWS, GCP, Azure, Kubernetes**).
-3. Enter the provider's identifier (Optional: Add an alias):
- - **AWS**: Account ID
- - **GCP**: Project ID
- - **Azure**: Subscription ID
- - **Kubernetes**: Cluster ID
- - **M36**: Domain ID
-4. Follow the guided instructions to add and authenticate your credentials.
-
-#### Start a Scan
-
-Once credentials are successfully added and validated, Prowler initiates a scan of your cloud environment.
-
-Click `Go to Scans` to monitor progress.
-
-#### View Results
-
-While the scan is running, you can review findings in the following sections:
-
-- **Overview** – Provides a high-level summary of your scans.
- 
-
-- **Compliance** – Displays compliance insights based on security frameworks.
- 
-
-> For detailed usage instructions, refer to the [Prowler App Guide](tutorials/prowler-app.md).
-
-???+ note
- Prowler will automatically scan all configured providers every **24 hours**, ensuring your cloud environment stays continuously monitored.
-
-### Prowler CLI
-
-#### Running Prowler
-
-To run Prowler, you will need to specify the provider (e.g `aws`, `gcp`, `azure`, `m365`, `github` or `kubernetes`):
-
-???+ note
- If no provider is specified, AWS is used by default for backward compatibility with Prowler v2.
-
-```console
-prowler 
diff --git a/mkdocs.yml b/mkdocs.yml
index d40600452d..68aa34bcc6 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -46,8 +46,19 @@ repo_name: prowler-cloud/prowler
nav:
- Getting Started:
- - Overview: index.md
- - Requirements: getting-started/requirements.md
+ - Overview:
+ - What is Prowler?: index.md
+ - Products:
+ - Prowler App: products/prowler-app.md
+ - Prowler CLI: products/prowler-cli.md
+ - Prowler Cloud 🔗: https://cloud.prowler.com
+ - Prowler Hub 🔗: https://hub.prowler.com
+ - Installation:
+ - Prowler App: installation/prowler-app.md
+ - Prowler CLI: installation/prowler-cli.md
+ - Basic Usage:
+ - Prowler App: basic-usage/prowler-app.md
+ - Prowler CLI: basic-usage/prowler-cli.md
- Tutorials:
- Prowler App:
- Getting Started: tutorials/prowler-app.md
@@ -57,6 +68,7 @@ nav:
- Mute findings: tutorials/prowler-app-mute-findings.md
- Amazon S3 Integration: tutorials/prowler-app-s3-integration.md
- Lighthouse: tutorials/prowler-app-lighthouse.md
+ - Bulk Provider Provisioning: tutorials/bulk-provider-provisioning.md
- CLI:
- Miscellaneous: tutorials/misc.md
- Reporting: tutorials/reporting.md
@@ -111,12 +123,13 @@ nav:
- Authentication: tutorials/microsoft365/authentication.md
- Use of PowerShell: tutorials/microsoft365/use-of-powershell.md
- GitHub:
- - Authentication: tutorials/github/authentication.md
- Getting Started: tutorials/github/getting-started-github.md
+ - Authentication: tutorials/github/authentication.md
- IaC:
- Getting Started: tutorials/iac/getting-started-iac.md
+ - Authentication: tutorials/iac/authentication.md
- Developer Guide:
- - General Concepts:
+ - Concepts:
- Introduction: developer-guide/introduction.md
- Providers: developer-guide/provider.md
- Services: developer-guide/services.md
@@ -125,7 +138,7 @@ nav:
- Integrations: developer-guide/integrations.md
- Compliance: developer-guide/security-compliance-framework.md
- Lighthouse: developer-guide/lighthouse.md
- - Provider Specific Details:
+ - Providers:
- AWS: developer-guide/aws-details.md
- Azure: developer-guide/azure-details.md
- Google Cloud: developer-guide/gcp-details.md
@@ -142,8 +155,8 @@ nav:
- Security: security.md
- Contact Us: contact.md
- Troubleshooting: troubleshooting.md
- - About: about.md
- - Prowler Cloud: https://prowler.com
+ - About 🔗: https://prowler.com/about#team
+ - Release Notes 🔗: https://github.com/prowler-cloud/prowler/releases
# Customization
extra:
diff --git a/poetry.lock b/poetry.lock
index 55f31ad3da..ab1e7d5e4c 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -2060,14 +2060,14 @@ files = [
[[package]]
name = "h2"
-version = "4.2.0"
+version = "4.3.0"
description = "Pure-Python HTTP/2 protocol implementation"
optional = false
python-versions = ">=3.9"
groups = ["main"]
files = [
- {file = "h2-4.2.0-py3-none-any.whl", hash = "sha256:479a53ad425bb29af087f3458a61d30780bc818e4ebcf01f0b536ba916462ed0"},
- {file = "h2-4.2.0.tar.gz", hash = "sha256:c8a52129695e88b1a0578d8d2cc6842bbd79128ac685463b887ee278126ad01f"},
+ {file = "h2-4.3.0-py3-none-any.whl", hash = "sha256:c438f029a25f7945c69e0ccf0fb951dc3f73a5f6412981daee861431b70e2bdd"},
+ {file = "h2-4.3.0.tar.gz", hash = "sha256:6c59efe4323fa18b47a632221a1888bd7fde6249819beda254aeca909f221bf1"},
]
[package.dependencies]
@@ -2352,6 +2352,8 @@ python-versions = "*"
groups = ["dev"]
files = [
{file = "jsonpath-ng-1.7.0.tar.gz", hash = "sha256:f6f5f7fd4e5ff79c785f1573b394043b39849fb2bb47bcead935d12b00beab3c"},
+ {file = "jsonpath_ng-1.7.0-py2-none-any.whl", hash = "sha256:898c93fc173f0c336784a3fa63d7434297544b7198124a68f9a3ef9597b0ae6e"},
+ {file = "jsonpath_ng-1.7.0-py3-none-any.whl", hash = "sha256:f3d7f9e848cba1b6da28c55b1c26ff915dc9e0b1ba7e752a53d6da8d5cbd00b6"},
]
[package.dependencies]
@@ -5839,4 +5841,4 @@ type = ["pytest-mypy"]
[metadata]
lock-version = "2.1"
python-versions = ">3.9.1,<3.13"
-content-hash = "a0635a7bb99427a5169b126b429d603079fc24c39ce6759a648fdffe74e50d6c"
+content-hash = "fdd2cbdb6913d0dd8d05030ee41c0d36d3954e473783d43b730ec163e697ec15"
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index a93d5a0e8a..94cb8ccc05 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -9,14 +9,21 @@ All notable changes to the **Prowler SDK** are documented in this file.
- `vm_sufficient_daily_backup_retention_period` check for Azure provider [(#8200)](https://github.com/prowler-cloud/prowler/pull/8200)
- `vm_jit_access_enabled` check for Azure provider [(#8202)](https://github.com/prowler-cloud/prowler/pull/8202)
- Bedrock AgentCore privilege escalation combination for AWS provider [(#8526)](https://github.com/prowler-cloud/prowler/pull/8526)
+- Add User Email and APP name/installations information in GitHub provider [(#8501)](https://github.com/prowler-cloud/prowler/pull/8501)
- Remove standalone iam:PassRole from privesc detection and add missing patterns [(#8530)](https://github.com/prowler-cloud/prowler/pull/8530)
+- Support session/profile/role/static credentials in Security Hub integration [(#8539)](https://github.com/prowler-cloud/prowler/pull/8539)
- `eks_cluster_deletion_protection_enabled` check for AWS provider [(#8536)](https://github.com/prowler-cloud/prowler/pull/8536)
+- ECS privilege escalation patterns (StartTask and RunTask) for AWS provider [(#8541)](https://github.com/prowler-cloud/prowler/pull/8541)
+- Resource Explorer enumeration v2 API actions in `cloudtrail_threat_detection_enumeration` check [(#8557)](https://github.com/prowler-cloud/prowler/pull/8557)
+
### Changed
- Refine kisa isms-p compliance mapping [(#8479)](https://github.com/prowler-cloud/prowler/pull/8479)
- Update AWS Neptune service metadata to new format [(#8494)](https://github.com/prowler-cloud/prowler/pull/8494)
+- Improve AWS Security Hub region check using multiple threads [(#8365)](https://github.com/prowler-cloud/prowler/pull/8365)
### Fixed
+- Resource metadata error in `s3_bucket_shadow_resource_vulnerability` check [(#8572)](https://github.com/prowler-cloud/prowler/pull/8572)
---
@@ -25,6 +32,9 @@ All notable changes to the **Prowler SDK** are documented in this file.
### Fixed
- AWS resource-arn filtering [(#8533)](https://github.com/prowler-cloud/prowler/pull/8533)
- GitHub App authentication for GitHub provider [(#8529)](https://github.com/prowler-cloud/prowler/pull/8529)
+- List all accessible organizations in GitHub provider [(#8535)](https://github.com/prowler-cloud/prowler/pull/8535)
+- Only evaluate enabled accounts in `entra_users_mfa_capable` check [(#8544)](https://github.com/prowler-cloud/prowler/pull/8544)
+- GitHub Personal Access Token authentication fails without `user:email` scope [(#8580)](https://github.com/prowler-cloud/prowler/pull/8580)
---
@@ -61,6 +71,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
- GitHub repository and organization scoping support with `--repository/respositories` and `--organization/organizations` flags [(#8329)](https://github.com/prowler-cloud/prowler/pull/8329)
- GCP provider retry configuration [(#8412)](https://github.com/prowler-cloud/prowler/pull/8412)
- `s3_bucket_shadow_resource_vulnerability` check for AWS provider [(#8398)](https://github.com/prowler-cloud/prowler/pull/8398)
+- Use `trivy` as engine for IaC provider [(#8466)](https://github.com/prowler-cloud/prowler/pull/8466)
### Changed
- Handle some AWS errors as warnings instead of errors [(#8347)](https://github.com/prowler-cloud/prowler/pull/8347)
diff --git a/prowler/lib/check/checks_loader.py b/prowler/lib/check/checks_loader.py
index 3c7e065fc0..c03034b0e4 100644
--- a/prowler/lib/check/checks_loader.py
+++ b/prowler/lib/check/checks_loader.py
@@ -20,7 +20,7 @@ def load_checks_to_execute(
) -> set:
"""Generate the list of checks to execute based on the cloud provider and the input arguments given"""
try:
- # Bypass check loading for IAC provider since it uses Checkov directly
+ # Bypass check loading for IAC provider since it uses Trivy directly
if provider == "iac":
return set()
diff --git a/prowler/lib/check/models.py b/prowler/lib/check/models.py
index 1c2dd44533..de38162cbc 100644
--- a/prowler/lib/check/models.py
+++ b/prowler/lib/check/models.py
@@ -166,11 +166,11 @@ class CheckMetadata(BaseModel):
return service_name
@validator("CheckID", pre=True, always=True)
- def valid_check_id(cls, check_id):
+ def valid_check_id(cls, check_id, values):
if not check_id:
raise ValueError("CheckID must be a non-empty string")
- if check_id:
+ if check_id and values.get("Provider") != "iac":
if "-" in check_id:
raise ValueError(
f"CheckID {check_id} contains a hyphen, which is not allowed"
@@ -648,25 +648,34 @@ class CheckReportM365(Check_Report):
@dataclass
class CheckReportIAC(Check_Report):
- """Contains the IAC Check's finding information using Checkov."""
+ """Contains the IAC Check's finding information using Trivy."""
resource_name: str
- resource_path: str
resource_line_range: str
- def __init__(self, metadata: dict = {}, finding: dict = {}) -> None:
+ def __init__(
+ self, metadata: dict = {}, finding: dict = {}, file_path: str = ""
+ ) -> None:
"""
- Initialize the IAC Check's finding information from a Checkov failed_check dict.
+ Initialize the IAC Check's finding information from a Trivy misconfiguration dict.
Args:
metadata (Dict): Optional check metadata (can be None).
- failed_check (dict): A single failed_check result from Checkov's JSON output.
+ finding (dict): A single misconfiguration result from Trivy's JSON output.
"""
super().__init__(metadata, finding)
- self.resource_name = getattr(finding, "resource", "")
- self.resource_path = getattr(finding, "file_path", "")
- self.resource_line_range = getattr(finding, "file_line_range", "")
+ self.resource = finding
+ self.resource_name = file_path
+ self.resource_line_range = (
+ (
+ str(finding.get("CauseMetadata", {}).get("StartLine", ""))
+ + ":"
+ + str(finding.get("CauseMetadata", {}).get("EndLine", ""))
+ )
+ if finding.get("CauseMetadata", {}).get("StartLine", "")
+ else ""
+ )
@dataclass
diff --git a/prowler/lib/check/utils.py b/prowler/lib/check/utils.py
index bf8854600d..cab19486d5 100644
--- a/prowler/lib/check/utils.py
+++ b/prowler/lib/check/utils.py
@@ -14,7 +14,7 @@ def recover_checks_from_provider(
Returns a list of tuples with the following format (check_name, check_path)
"""
try:
- # Bypass check loading for IAC provider since it uses Checkov directly
+ # Bypass check loading for IAC provider since it uses Trivy directly
if provider == "iac":
return []
@@ -63,7 +63,7 @@ def recover_checks_from_service(service_list: list, provider: str) -> set:
Returns a set of checks from the given services
"""
try:
- # Bypass check loading for IAC provider since it uses Checkov directly
+ # Bypass check loading for IAC provider since it uses Trivy directly
if provider == "iac":
return set()
diff --git a/prowler/lib/outputs/finding.py b/prowler/lib/outputs/finding.py
index a3ba6271dd..f686554a88 100644
--- a/prowler/lib/outputs/finding.py
+++ b/prowler/lib/outputs/finding.py
@@ -19,6 +19,7 @@ from prowler.lib.outputs.compliance.compliance import get_check_compliance
from prowler.lib.outputs.utils import unroll_tags
from prowler.lib.utils.utils import dict_to_lowercase, get_nested_attribute
from prowler.providers.common.provider import Provider
+from prowler.providers.github.models import GithubAppIdentityInfo, GithubIdentityInfo
class Finding(BaseModel):
@@ -250,15 +251,16 @@ class Finding(BaseModel):
output_data["resource_name"] = check_output.resource_name
output_data["resource_uid"] = check_output.resource_id
- if hasattr(provider.identity, "account_name"):
+ if isinstance(provider.identity, GithubIdentityInfo):
# GithubIdentityInfo (Personal Access Token, OAuth)
output_data["account_name"] = provider.identity.account_name
output_data["account_uid"] = provider.identity.account_id
- elif hasattr(provider.identity, "app_id"):
+ output_data["account_email"] = provider.identity.account_email
+ elif isinstance(provider.identity, GithubAppIdentityInfo):
# GithubAppIdentityInfo (GitHub App)
- # TODO: Get Github App name
- output_data["account_name"] = f"app-{provider.identity.app_id}"
+ output_data["account_name"] = provider.identity.app_name
output_data["account_uid"] = provider.identity.app_id
+ output_data["installations"] = provider.identity.installations
output_data["region"] = check_output.owner
@@ -295,9 +297,9 @@ class Finding(BaseModel):
output_data["auth_method"] = provider.auth_method
output_data["account_uid"] = "iac"
output_data["account_name"] = "iac"
- output_data["resource_name"] = check_output.resource["resource"]
- output_data["resource_uid"] = check_output.resource["resource"]
- output_data["region"] = check_output.resource_path
+ output_data["resource_name"] = check_output.resource_name
+ output_data["resource_uid"] = check_output.resource_name
+ output_data["region"] = check_output.resource_line_range
output_data["resource_line_range"] = check_output.resource_line_range
output_data["framework"] = check_output.check_metadata.ServiceName
diff --git a/prowler/lib/outputs/html/html.py b/prowler/lib/outputs/html/html.py
index 7b4fb87601..4e05fe0e8a 100644
--- a/prowler/lib/outputs/html/html.py
+++ b/prowler/lib/outputs/html/html.py
@@ -41,7 +41,7 @@ class HTML(Output):
@@ -569,11 +624,8 @@ class HTML(Output):
@@ -582,11 +634,8 @@ class HTML(Output):
GitHub Assessment Summary
- -
-
- - GitHub account: {account_display} - +
-
+ {account_info_items}
GitHub Credentials
- -
-
- - GitHub authentication method: {provider.auth_method} - +
- GitHub account: account-name +
- GitHub authentication method: Personal Access Token @@ -259,10 +261,12 @@ github_app_html_assessment_summary = """
- - GitHub account: app-app-id + GitHub App Name: test-app + +
- + Installations: test-org
- GitHub authentication method: GitHub App Token +
- + GitHub App ID: app-id +
- + + Automated findings export + +
- + + Multi-region support + +
- + + Send failed findings only + +
- + + Archive previous findings + +
-
+ {credentials_items}
GitHub Assessment Summary
- -
+
-
+
GitHub Credentials
- -
+
-
+
GitHub Assessment Summary
- -
+
GitHub Credentials
- -
+
+
+
+
+
+ + Configure AWS Security Hub integration to automatically send your + security findings for centralized monitoring and compliance. +
+ +
+
+ + Features: +
+-
+
{/* Amazon S3 Integration */}
diff --git a/ui/app/(prowler)/lighthouse/config/page.tsx b/ui/app/(prowler)/lighthouse/config/page.tsx
index e8e223783a..0d5632ac76 100644
--- a/ui/app/(prowler)/lighthouse/config/page.tsx
+++ b/ui/app/(prowler)/lighthouse/config/page.tsx
@@ -5,12 +5,12 @@ import { ContentLayout } from "@/components/ui";
export const dynamic = "force-dynamic";
export default async function ChatbotConfigPage() {
- const response = await getLighthouseConfig();
- const initialValues = response?.attributes
+ const lighthouseConfig = await getLighthouseConfig();
+ const initialValues = lighthouseConfig
? {
- model: response.attributes.model,
- apiKey: response.attributes.api_key || "",
- businessContext: response.attributes.business_context || "",
+ model: lighthouseConfig.model,
+ apiKey: lighthouseConfig.api_key || "",
+ businessContext: lighthouseConfig.business_context || "",
}
: {
model: "gpt-4o",
@@ -18,7 +18,7 @@ export default async function ChatbotConfigPage() {
businessContext: "",
};
- const configExists = !!response;
+ const configExists = !!lighthouseConfig;
return (
- 10}
/>
diff --git a/ui/components/integrations/s3/s3-integrations-manager.tsx b/ui/components/integrations/s3/s3-integrations-manager.tsx
index 3b4f417414..1b3061dbc3 100644
--- a/ui/components/integrations/s3/s3-integrations-manager.tsx
+++ b/ui/components/integrations/s3/s3-integrations-manager.tsx
@@ -1,14 +1,8 @@
"use client";
-import { Card, CardBody, CardHeader, Chip } from "@nextui-org/react";
+import { Card, CardBody, CardHeader } from "@nextui-org/react";
import { format } from "date-fns";
-import {
- PlusIcon,
- Power,
- SettingsIcon,
- TestTube,
- Trash2Icon,
-} from "lucide-react";
+import { PlusIcon, Trash2Icon } from "lucide-react";
import { useState } from "react";
import {
@@ -17,15 +11,20 @@ import {
updateIntegration,
} from "@/actions/integrations";
import { AmazonS3Icon } from "@/components/icons/services/IconServices";
+import {
+ IntegrationActionButtons,
+ IntegrationCardHeader,
+ IntegrationSkeleton,
+} from "@/components/integrations/shared";
import { useToast } from "@/components/ui";
import { CustomAlertModal, CustomButton } from "@/components/ui/custom";
import { DataTablePagination } from "@/components/ui/table/data-table-pagination";
+import { triggerTestConnectionWithDelay } from "@/lib/integrations/test-connection-helper";
import { MetaDataProps } from "@/types";
import { IntegrationProps } from "@/types/integrations";
import { ProviderProps } from "@/types/providers";
import { S3IntegrationForm } from "./s3-integration-form";
-import { S3IntegrationCardSkeleton } from "./skeleton-s3-integration-card";
interface S3IntegrationsManagerProps {
integrations: IntegrationProps[];
@@ -78,7 +77,7 @@ export const S3IntegrationsManager = ({
const handleDeleteIntegration = async (id: string) => {
setIsDeleting(id);
try {
- const result = await deleteIntegration(id);
+ const result = await deleteIntegration(id, "amazon_s3");
if (result.success) {
toast({
@@ -173,11 +172,34 @@ export const S3IntegrationsManager = ({
setEditMode(null);
};
- const handleFormSuccess = () => {
+ const handleFormSuccess = async (
+ integrationId?: string,
+ shouldTestConnection?: boolean,
+ ) => {
+ // Close the modal immediately
setIsModalOpen(false);
setEditingIntegration(null);
setEditMode(null);
setIsOperationLoading(true);
+
+ // Set testing state for server-triggered test connections
+ if (integrationId && shouldTestConnection) {
+ setIsTesting(integrationId);
+ }
+
+ // Trigger test connection if needed
+ triggerTestConnectionWithDelay(
+ integrationId,
+ shouldTestConnection,
+ "s3",
+ toast,
+ 200,
+ () => {
+ // Clear testing state when server-triggered test completes
+ setIsTesting(null);
+ },
+ );
+
// Reset loading state after a short delay to show the skeleton briefly
setTimeout(() => {
setIsOperationLoading(false);
@@ -274,44 +296,33 @@ export const S3IntegrationsManager = ({
{/* Integrations List */}
{isOperationLoading ? (
-
{integrations.map((integration) => (
-
diff --git a/ui/components/integrations/s3/skeleton-s3-integration-card.tsx b/ui/components/integrations/s3/skeleton-s3-integration-card.tsx
deleted file mode 100644
index 645b47db78..0000000000
--- a/ui/components/integrations/s3/skeleton-s3-integration-card.tsx
+++ /dev/null
@@ -1,95 +0,0 @@
-"use client";
-
-import { Card, CardBody, CardHeader, Skeleton } from "@nextui-org/react";
-
-import { AmazonS3Icon } from "@/components/icons/services/IconServices";
-
-interface S3IntegrationCardSkeletonProps {
- variant?: "main" | "manager";
- count?: number;
-}
-
-export const S3IntegrationCardSkeleton = ({
- variant = "main",
- count = 1,
-}: S3IntegrationCardSkeletonProps) => {
- if (variant === "main") {
- return (
-
-
- {integration.attributes.connected
- ? "Connected"
- : "Disconnected"}
-
-
+
-
-
-
- - {integration.attributes.configuration.bucket_name || - "Unknown Bucket"} -
-- Output directory:{" "} - {integration.attributes.configuration - .output_directory || - integration.attributes.configuration.path || - "/"} -
-
@@ -328,68 +339,15 @@ export const S3IntegrationsManager = ({
)}
-
-
+
-
-
-
-
-
- Amazon S3
-
-
- - Export security findings to Amazon S3 buckets. -
-
-
-
-
-
- {Array.from({ length: count }).map((_, index) => (
-
-
-
- ))}
-
-
-
- {Array.from({ length: count }).map((_, index) => (
-
-
-
-
-
-
- ))}
-
- );
-};
diff --git a/ui/components/integrations/security-hub/security-hub-integration-card.tsx b/ui/components/integrations/security-hub/security-hub-integration-card.tsx
new file mode 100644
index 0000000000..79da80b13a
--- /dev/null
+++ b/ui/components/integrations/security-hub/security-hub-integration-card.tsx
@@ -0,0 +1,58 @@
+"use client";
+
+import { Card, CardBody, CardHeader } from "@nextui-org/react";
+import { SettingsIcon } from "lucide-react";
+
+import { AWSSecurityHubIcon } from "@/components/icons/services/IconServices";
+import { CustomButton } from "@/components/ui/custom";
+import { CustomLink } from "@/components/ui/custom/custom-link";
+
+export const SecurityHubIntegrationCard = () => {
+ return (
+
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+ + AWS Security Hub +
+
+
+ Learn more
+
+
+ + Send security findings to AWS Security Hub. +
+
+
+
+
+ + Configure and manage your AWS Security Hub integrations to + automatically send security findings for centralized monitoring. +
+
+ {
+ form.setValue("use_custom_credentials", value === "custom", {
+ shouldValidate: true,
+ shouldDirty: true,
+ });
+ }}
+ >
+
+ Use provider credentials
+
+
+ Use custom credentials
+
+
+
+ {useCustomCredentials && (
+ <>
+ }
+ setValue={form.setValue as any}
+ externalId={
+ form.getValues("external_id") || session?.tenantId || ""
+ }
+ templateLinks={getAWSCredentialsTemplateLinks(
+ form.getValues("external_id") || session?.tenantId || "",
+ undefined,
+ "aws_security_hub",
+ )}
+ type="integrations"
+ />
+
+ )}
+
+ );
+ }
+
+ if (currentStep === 1 && useCustomCredentials) {
+ const externalId =
+ form.getValues("external_id") || session?.tenantId || "";
+ const templateLinks = getAWSCredentialsTemplateLinks(
+ externalId,
+ undefined,
+ "aws_security_hub",
+ );
+
+ return (
+
+
+
+ (
+
+
+ Send only Failed Findings
+
+
+ )}
+ />
+
+ (
+
+
+ Archive previous findings
+
+
+ )}
+ />
+
+ {isCreating && (
+ (
+
+
+ Use custom credentials
+
+
+ )}
+ />
+ )}
+
+
+ );
+ }
+
+ return null;
+ };
+
+ const renderStepButtons = () => {
+ if (isEditingConfig || isEditingCredentials) {
+ const updateText = isEditingConfig
+ ? "Update Configuration"
+ : "Update Credentials";
+ const loadingText = isEditingConfig
+ ? "Updating Configuration..."
+ : "Updating Credentials...";
+
+ return (
+
+ {
+ setIsDeleteOpen(false);
+ setIntegrationToDelete(null);
+ }}
+ isDisabled={isDeleting !== null}
+ >
+ Cancel
+
+
+
+
+
+
+ );
+};
diff --git a/ui/components/integrations/shared/index.ts b/ui/components/integrations/shared/index.ts
new file mode 100644
index 0000000000..499b38677a
--- /dev/null
+++ b/ui/components/integrations/shared/index.ts
@@ -0,0 +1,3 @@
+export { IntegrationActionButtons } from "./integration-action-buttons";
+export { IntegrationCardHeader } from "./integration-card-header";
+export { IntegrationSkeleton } from "./integration-skeleton";
diff --git a/ui/components/integrations/shared/integration-action-buttons.tsx b/ui/components/integrations/shared/integration-action-buttons.tsx
new file mode 100644
index 0000000000..0a56480dc5
--- /dev/null
+++ b/ui/components/integrations/shared/integration-action-buttons.tsx
@@ -0,0 +1,100 @@
+"use client";
+
+import {
+ LockIcon,
+ Power,
+ SettingsIcon,
+ TestTube,
+ Trash2Icon,
+} from "lucide-react";
+
+import { CustomButton } from "@/components/ui/custom";
+import { IntegrationProps } from "@/types/integrations";
+
+interface IntegrationActionButtonsProps {
+ integration: IntegrationProps;
+ onTestConnection: (id: string) => void;
+ onEditConfiguration: (integration: IntegrationProps) => void;
+ onEditCredentials: (integration: IntegrationProps) => void;
+ onToggleEnabled: (integration: IntegrationProps) => void;
+ onDelete: (integration: IntegrationProps) => void;
+ isTesting?: boolean;
+ showCredentialsButton?: boolean;
+}
+
+export const IntegrationActionButtons = ({
+ integration,
+ onTestConnection,
+ onEditConfiguration,
+ onEditCredentials,
+ onToggleEnabled,
+ onDelete,
+ isTesting = false,
+ showCredentialsButton = true,
+}: IntegrationActionButtonsProps) => {
+ return (
+
+
+
+ {isOperationLoading ? (
+
+
+ + Configured Security Hub Integrations +
++ {integrations.length === 0 + ? "Not configured yet" + : `${integrations.length} integration${integrations.length !== 1 ? "s" : ""} configured`} +
+
+ {integrations.map((integration) => {
+ const enabledRegions = getEnabledRegions(integration);
+ const providerDetails = getProviderDetails(integration);
+
+ return (
+
+
+
+
+
+
+ );
+ })}
+
+ ) : null}
+
+ {metadata && integrations.length > 0 && (
+
+ {enabledRegions.length > 0 && (
+
+
+ {enabledRegions.map((region) => (
+
+ {region}
+
+ ))}
+
+ )}
+
+
+
+
+ {integration.attributes.updated_at && (
+
+ + Last updated:{" "} + {format( + new Date(integration.attributes.updated_at), + "yyyy/MM/dd", + )} +
+ )} +
+
+ )}
+
+
+ );
+};
diff --git a/ui/components/integrations/shared/integration-card-header.tsx b/ui/components/integrations/shared/integration-card-header.tsx
new file mode 100644
index 0000000000..a56473f410
--- /dev/null
+++ b/ui/components/integrations/shared/integration-card-header.tsx
@@ -0,0 +1,74 @@
+"use client";
+
+import { Chip } from "@nextui-org/react";
+import { ReactNode } from "react";
+
+interface IntegrationCardHeaderProps {
+ icon: ReactNode;
+ title: string;
+ subtitle?: string;
+ chips?: Array<{
+ label: string;
+ color?:
+ | "default"
+ | "primary"
+ | "secondary"
+ | "success"
+ | "warning"
+ | "danger";
+ variant?: "solid" | "bordered" | "light" | "flat" | "faded" | "shadow";
+ }>;
+ connectionStatus?: {
+ connected: boolean;
+ label?: string;
+ };
+}
+
+export const IntegrationCardHeader = ({
+ icon,
+ title,
+ subtitle,
+ chips = [],
+ connectionStatus,
+}: IntegrationCardHeaderProps) => {
+ return (
+
+
+ );
+};
diff --git a/ui/components/integrations/shared/integration-skeleton.tsx b/ui/components/integrations/shared/integration-skeleton.tsx
new file mode 100644
index 0000000000..73ad4e5017
--- /dev/null
+++ b/ui/components/integrations/shared/integration-skeleton.tsx
@@ -0,0 +1,96 @@
+"use client";
+
+import { Card, CardBody, CardHeader, Skeleton } from "@nextui-org/react";
+import { ReactNode } from "react";
+
+interface IntegrationSkeletonProps {
+ variant?: "main" | "manager";
+ count?: number;
+ icon: ReactNode;
+ title?: string;
+ subtitle?: string;
+}
+
+export const IntegrationSkeleton = ({
+ variant = "main",
+ count = 1,
+ icon,
+ title = "Integration",
+ subtitle = "Loading integration details...",
+}: IntegrationSkeletonProps) => {
+ if (variant === "main") {
+ return (
+
+ {icon}
+
+ {(chips.length > 0 || connectionStatus) && (
+
+
+ {title}
+ {subtitle && ( ++ {subtitle} +
+ )} +
+ {chips.map((chip, index) => (
+
+ {chip.label}
+
+ ))}
+ {connectionStatus && (
+
+ {connectionStatus.label ||
+ (connectionStatus.connected ? "Connected" : "Disconnected")}
+
+ )}
+
+ )}
+
+
+
+ {icon}
+
+
+
+ {title}
+
+
+ {subtitle}
+
+
+
+
+
+ {Array.from({ length: count }).map((_, index) => (
+
+
+
+
+
+
+ ))}
+
+ );
+};
diff --git a/ui/components/providers/enhanced-provider-selector.tsx b/ui/components/providers/enhanced-provider-selector.tsx
new file mode 100644
index 0000000000..39779382be
--- /dev/null
+++ b/ui/components/providers/enhanced-provider-selector.tsx
@@ -0,0 +1,294 @@
+"use client";
+
+import { Button, Input, Select, SelectItem } from "@nextui-org/react";
+import { CheckSquare, Search, Square } from "lucide-react";
+import { useMemo, useState } from "react";
+import { Control } from "react-hook-form";
+
+import { FormControl, FormField, FormMessage } from "@/components/ui/form";
+import { ProviderProps, ProviderType } from "@/types/providers";
+
+const providerTypeLabels: Record
+
+
+ {icon}
+
+
+
+
+
+
+ {/* Region chips skeleton */}
+
+
+
+
+
+
+
+
+ {isMultiple && filteredProviders.length > 1 && (
+
+
+
+ {label}
+
+
+ ) : (
+
+ )}
+
+
-
-
-
- {label}
-
- {sortedProviders.length > 1 && (
-
- ) : (
-
-
- A read-only IAM role must be manually created - {type === "s3-integration" ? " or updated" : ""}. + {type === "integrations" ? " or updated" : ""}.
@@ -57,7 +75,7 @@ export const AWSRoleCredentialsForm = ({
name={ProviderCredentialFields.CREDENTIALS_TYPE}
label="Authentication Method"
placeholder="Select credentials type"
- defaultSelectedKeys={[defaultCredentialsType]}
+ selectedKeys={[credentialsType || defaultCredentialsType]}
className="mb-4"
variant="bordered"
onSelectionChange={(keys) =>
@@ -182,7 +200,7 @@ export const AWSRoleCredentialsForm = ({
labelPlacement="inside"
placeholder="Enter the Role ARN"
variant="bordered"
- isRequired={type === "providers"}
+ isRequired={showRoleSection}
isInvalid={
!!control._formState.errors[ProviderCredentialFields.ROLE_ARN]
}
diff --git a/ui/hooks/use-credentials-form.ts b/ui/hooks/use-credentials-form.ts
index 0180c06431..5067a8c6c0 100644
--- a/ui/hooks/use-credentials-form.ts
+++ b/ui/hooks/use-credentials-form.ts
@@ -64,9 +64,13 @@ export const useCredentialsForm = ({
// AWS Role credentials
if (providerType === "aws" && via === "role") {
+ const isCloudEnv = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
+ const defaultCredentialsType = isCloudEnv
+ ? "aws-sdk-default"
+ : "access-secret-key";
return {
...baseDefaults,
- [ProviderCredentialFields.CREDENTIALS_TYPE]: "access-secret-key",
+ [ProviderCredentialFields.CREDENTIALS_TYPE]: defaultCredentialsType,
[ProviderCredentialFields.ROLE_ARN]: "",
[ProviderCredentialFields.EXTERNAL_ID]: session?.tenantId || "",
[ProviderCredentialFields.AWS_ACCESS_KEY_ID]: "",
diff --git a/ui/lib/external-urls.ts b/ui/lib/external-urls.ts
index c38f1a3574..125a227b87 100644
--- a/ui/lib/external-urls.ts
+++ b/ui/lib/external-urls.ts
@@ -1,3 +1,5 @@
+import { IntegrationType } from "../types/integrations";
+
export const getProviderHelpText = (provider: string) => {
switch (provider) {
case "aws":
@@ -41,12 +43,46 @@ export const getProviderHelpText = (provider: string) => {
export const getAWSCredentialsTemplateLinks = (
externalId: string,
bucketName?: string,
-) => {
+ integrationType?: IntegrationType,
+): {
+ cloudformation: string;
+ terraform: string;
+ cloudformationQuickLink: string;
+} => {
+ let links = {};
+
+ if (integrationType === undefined) {
+ links = {
+ cloudformation:
+ "https://github.com/prowler-cloud/prowler/blob/master/permissions/templates/cloudformation/prowler-scan-role.yml",
+ terraform:
+ "https://github.com/prowler-cloud/prowler/tree/master/permissions/templates/terraform",
+ };
+ }
+
+ if (integrationType === "aws_security_hub") {
+ links = {
+ cloudformation:
+ "https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/prowler-app-s3-integration/",
+ terraform:
+ "https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/prowler-app-s3-integration/#terraform",
+ };
+ }
+
+ if (integrationType === "amazon_s3") {
+ links = {
+ cloudformation:
+ "https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/prowler-app-s3-integration/",
+ terraform:
+ "https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/prowler-app-s3-integration/#terraform",
+ };
+ }
+
return {
- cloudformation:
- "https://github.com/prowler-cloud/prowler/blob/master/permissions/templates/cloudformation/prowler-scan-role.yml",
+ ...(links as {
+ cloudformation: string;
+ terraform: string;
+ }),
cloudformationQuickLink: `https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https%3A%2F%2Fprowler-cloud-public.s3.eu-west-1.amazonaws.com%2Fpermissions%2Ftemplates%2Faws%2Fcloudformation%2Fprowler-scan-role.yml&stackName=Prowler¶m_ExternalId=${externalId}${bucketName ? `¶m_EnableS3Integration=true¶m_S3IntegrationBucketName=${bucketName}` : ""}`,
- terraform:
- "https://github.com/prowler-cloud/prowler/tree/master/permissions/templates/terraform",
};
};
diff --git a/ui/lib/integrations/test-connection-helper.ts b/ui/lib/integrations/test-connection-helper.ts
new file mode 100644
index 0000000000..6c92adbf39
--- /dev/null
+++ b/ui/lib/integrations/test-connection-helper.ts
@@ -0,0 +1,161 @@
+import {
+ pollConnectionTestStatus,
+ testIntegrationConnection,
+} from "@/actions/integrations";
+
+// Integration configuration type
+export interface IntegrationMessages {
+ testingMessage: string;
+ successMessage: string;
+ errorMessage: string;
+}
+
+// Configuration map for integration-specific messages
+const INTEGRATION_CONFIG: Record = {
+ "amazon-s3": {
+ testingMessage: "Testing connection to Amazon S3 bucket...",
+ successMessage: "Successfully connected to Amazon S3 bucket.",
+ errorMessage: "Failed to connect to Amazon S3 bucket.",
+ },
+ "aws-security-hub": {
+ testingMessage: "Testing connection to AWS Security Hub...",
+ successMessage: "Successfully connected to AWS Security Hub.",
+ errorMessage: "Failed to connect to AWS Security Hub.",
+ },
+ // Legacy mappings for backward compatibility
+ s3: {
+ testingMessage: "Testing connection to Amazon S3 bucket...",
+ successMessage: "Successfully connected to Amazon S3 bucket.",
+ errorMessage: "Failed to connect to Amazon S3 bucket.",
+ },
+ security_hub: {
+ testingMessage: "Testing connection to AWS Security Hub...",
+ successMessage: "Successfully connected to AWS Security Hub.",
+ errorMessage: "Failed to connect to AWS Security Hub.",
+ },
+ // Add new integrations here as needed
+};
+
+// Helper function to register new integration types
+export const registerIntegrationType = (
+ type: string,
+ messages: IntegrationMessages,
+): void => {
+ INTEGRATION_CONFIG[type] = messages;
+};
+
+// Helper function to get supported integration types
+export const getSupportedIntegrationTypes = (): string[] => {
+ return Object.keys(INTEGRATION_CONFIG);
+};
+
+interface TestConnectionOptions {
+ integrationId: string;
+ integrationType: string;
+ onSuccess?: (message: string) => void;
+ onError?: (message: string) => void;
+ onStart?: () => void;
+ onComplete?: () => void;
+}
+
+export const runTestConnection = async ({
+ integrationId,
+ integrationType,
+ onSuccess,
+ onError,
+ onStart,
+ onComplete,
+}: TestConnectionOptions) => {
+ try {
+ // Start the test without waiting for completion
+ const result = await testIntegrationConnection(integrationId, false);
+
+ if (!result || (!result.success && !result.error)) {
+ onError?.("Connection test could not be started. Please try again.");
+ onComplete?.();
+ return;
+ }
+
+ if (result.error) {
+ onError?.(result.error);
+ onComplete?.();
+ return;
+ }
+
+ if (!result.taskId) {
+ onError?.("Failed to start connection test. No task ID received.");
+ onComplete?.();
+ return;
+ }
+
+ // Notify that test has started
+ onStart?.();
+
+ // Poll for the test completion
+ const pollResult = await pollConnectionTestStatus(result.taskId);
+
+ if (pollResult.success) {
+ const config = INTEGRATION_CONFIG[integrationType];
+ const defaultMessage =
+ config?.successMessage ||
+ `Successfully connected to ${integrationType}.`;
+ onSuccess?.(pollResult.message || defaultMessage);
+ } else {
+ const config = INTEGRATION_CONFIG[integrationType];
+ const defaultError =
+ config?.errorMessage || `Failed to connect to ${integrationType}.`;
+ onError?.(pollResult.error || defaultError);
+ }
+ } catch (error) {
+ onError?.(
+ "Failed to start connection test. You can try manually using the Test Connection button.",
+ );
+ } finally {
+ onComplete?.();
+ }
+};
+
+export const triggerTestConnectionWithDelay = (
+ integrationId: string | undefined,
+ shouldTestConnection: boolean | undefined,
+ integrationType: string,
+ toast: any,
+ delay = 200,
+ onComplete?: () => void,
+) => {
+ if (!integrationId || !shouldTestConnection) {
+ onComplete?.();
+ return;
+ }
+
+ setTimeout(() => {
+ runTestConnection({
+ integrationId,
+ integrationType,
+ onStart: () => {
+ const config = INTEGRATION_CONFIG[integrationType];
+ const description =
+ config?.testingMessage ||
+ `Testing connection to ${integrationType}...`;
+ toast({
+ title: "Connection test started!",
+ description,
+ });
+ },
+ onSuccess: (message) => {
+ toast({
+ title: "Connection test successful!",
+ description: message,
+ });
+ },
+ onError: (message) => {
+ toast({
+ variant: "destructive",
+ title: "Connection test failed",
+ description: message,
+ });
+ },
+ onComplete,
+ });
+ }, delay);
+};
diff --git a/ui/lib/lighthouse/utils.ts b/ui/lib/lighthouse/utils.ts
index 296bdced18..78f760c8c7 100644
--- a/ui/lib/lighthouse/utils.ts
+++ b/ui/lib/lighthouse/utils.ts
@@ -6,6 +6,8 @@ import {
} from "@langchain/core/messages";
import type { Message } from "ai";
+import type { ModelParams } from "@/types/lighthouse";
+
// https://stackoverflow.com/questions/79081298/how-to-stream-langchain-langgraphs-final-generation
/**
* Converts a Vercel message to a LangChain message.
@@ -46,3 +48,20 @@ export const convertLangChainMessageToVercelMessage = (
return { content: message.content, role: message.getType() };
}
};
+
+export const getModelParams = (config: any): ModelParams => {
+ const modelId = config.model;
+
+ const params: ModelParams = {
+ maxTokens: config.max_tokens,
+ temperature: config.temperature,
+ reasoningEffort: undefined,
+ };
+
+ if (modelId.startsWith("gpt-5")) {
+ params.temperature = undefined;
+ params.reasoningEffort = "minimal";
+ }
+
+ return params;
+};
diff --git a/ui/lib/lighthouse/workflow.ts b/ui/lib/lighthouse/workflow.ts
index ff5996b95b..d07b04cc51 100644
--- a/ui/lib/lighthouse/workflow.ts
+++ b/ui/lib/lighthouse/workflow.ts
@@ -47,28 +47,28 @@ import {
getMyProfileInfoTool,
getUsersTool,
} from "@/lib/lighthouse/tools/users";
+import { getModelParams } from "@/lib/lighthouse/utils";
export async function initLighthouseWorkflow() {
const apiKey = await getAIKey();
- const aiConfig = await getLighthouseConfig();
- const modelConfig = aiConfig?.data?.attributes;
+ const lighthouseConfig = await getLighthouseConfig();
+
+ const modelParams = getModelParams(lighthouseConfig);
// Initialize models without API keys
const llm = new ChatOpenAI({
- model: modelConfig?.model || "gpt-4o",
- temperature: modelConfig?.temperature || 0,
- maxTokens: modelConfig?.max_tokens || 4000,
+ model: lighthouseConfig.model,
apiKey: apiKey,
tags: ["agent"],
+ ...modelParams,
});
const supervisorllm = new ChatOpenAI({
- model: modelConfig?.model || "gpt-4o",
- temperature: modelConfig?.temperature || 0,
- maxTokens: modelConfig?.max_tokens || 4000,
+ model: lighthouseConfig.model,
apiKey: apiKey,
streaming: true,
tags: ["supervisor"],
+ ...modelParams,
});
const providerAgent = createReactAgent({
diff --git a/ui/package-lock.json b/ui/package-lock.json
index 848d06cba1..0d53f26376 100644
--- a/ui/package-lock.json
+++ b/ui/package-lock.json
@@ -10,7 +10,7 @@
"dependencies": {
"@hookform/resolvers": "^3.9.0",
"@langchain/langgraph-supervisor": "^0.0.12",
- "@langchain/openai": "0.5.10",
+ "@langchain/openai": "^0.6.9",
"@next/third-parties": "^15.3.3",
"@nextui-org/react": "2.4.8",
"@nextui-org/system": "2.2.1",
@@ -1052,9 +1052,9 @@
}
},
"node_modules/@langchain/core": {
- "version": "0.3.62",
- "resolved": "https://registry.npmjs.org/@langchain/core/-/core-0.3.62.tgz",
- "integrity": "sha512-GqRTcoUPnozGRMUcA6QkP7LHL/OvanGdB51Jgb0w7IIPDI3wFugxMHZ4gphnGDtxsD1tQY5ykyEpYNxFK8kl1w==",
+ "version": "0.3.72",
+ "resolved": "https://registry.npmjs.org/@langchain/core/-/core-0.3.72.tgz",
+ "integrity": "sha512-WsGWVZYnlKffj2eEfDocPNiaTRoxyYiLSQdQ7oxZvxGZBqo/90vpjbC33UGK1uPNBM4kT+pkdaol/MnvKUh8TQ==",
"license": "MIT",
"peer": true,
"dependencies": {
@@ -1063,7 +1063,7 @@
"camelcase": "6",
"decamelize": "1.2.0",
"js-tiktoken": "^1.0.12",
- "langsmith": "^0.3.33",
+ "langsmith": "^0.3.46",
"mustache": "^4.2.0",
"p-queue": "^6.6.2",
"p-retry": "4",
@@ -1228,21 +1228,20 @@
}
},
"node_modules/@langchain/openai": {
- "version": "0.5.10",
- "resolved": "https://registry.npmjs.org/@langchain/openai/-/openai-0.5.10.tgz",
- "integrity": "sha512-hBQIWjcVxGS7tgVvgBBmrZ5jSaJ8nu9g6V64/Tx6KGjkW7VdGmUvqCO+koiQCOZVL7PBJkHWAvDsbghPYXiZEA==",
+ "version": "0.6.9",
+ "resolved": "https://registry.npmjs.org/@langchain/openai/-/openai-0.6.9.tgz",
+ "integrity": "sha512-Dl+YVBTFia7WE4/jFemQEVchPbsahy/dD97jo6A9gLnYfTkWa/jh8Q78UjHQ3lobif84j2ebjHPcDHG1L0NUWg==",
"license": "MIT",
"dependencies": {
"js-tiktoken": "^1.0.12",
- "openai": "^4.96.0",
- "zod": "^3.22.4",
- "zod-to-json-schema": "^3.22.3"
+ "openai": "5.12.2",
+ "zod": "^3.25.32"
},
"engines": {
"node": ">=18"
},
"peerDependencies": {
- "@langchain/core": ">=0.3.48 <0.4.0"
+ "@langchain/core": ">=0.3.68 <0.4.0"
}
},
"node_modules/@napi-rs/wasm-runtime": {
@@ -6688,18 +6687,9 @@
"version": "20.5.7",
"resolved": "https://registry.npmjs.org/@types/node/-/node-20.5.7.tgz",
"integrity": "sha512-dP7f3LdZIysZnmvP3ANJYTSwg+wLLl8p7RqniVlV7j+oXSXAbt9h0WIBFmJy5inWZoX9wZN6eXx+YXd9Rh3RBA==",
+ "dev": true,
"license": "MIT"
},
- "node_modules/@types/node-fetch": {
- "version": "2.6.12",
- "resolved": "https://registry.npmjs.org/@types/node-fetch/-/node-fetch-2.6.12.tgz",
- "integrity": "sha512-8nneRWKCg3rMtF69nLQJnOYUcbafYeFSjqkw3jCRLsqkWFlHaoQrr5mXmofFGOx3DKn7UfmBMyov8ySvLRVldA==",
- "license": "MIT",
- "dependencies": {
- "@types/node": "*",
- "form-data": "^4.0.0"
- }
- },
"node_modules/@types/prop-types": {
"version": "15.7.15",
"resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.15.tgz",
@@ -7213,18 +7203,6 @@
"win32"
]
},
- "node_modules/abort-controller": {
- "version": "3.0.0",
- "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
- "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==",
- "license": "MIT",
- "dependencies": {
- "event-target-shim": "^5.0.0"
- },
- "engines": {
- "node": ">=6.5"
- }
- },
"node_modules/acorn": {
"version": "8.15.0",
"resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
@@ -7263,18 +7241,6 @@
"node": ">= 14"
}
},
- "node_modules/agentkeepalive": {
- "version": "4.6.0",
- "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.6.0.tgz",
- "integrity": "sha512-kja8j7PjmncONqaTsB8fQ+wE2mSU2DJ9D4XKoJ5PFWIdRMa6SLSN1ff4mOr4jCbfRSsxR4keIiySJU0N9T5hIQ==",
- "license": "MIT",
- "dependencies": {
- "humanize-ms": "^1.2.1"
- },
- "engines": {
- "node": ">= 8.0.0"
- }
- },
"node_modules/ai": {
"version": "4.3.16",
"resolved": "https://registry.npmjs.org/ai/-/ai-4.3.16.tgz",
@@ -7606,12 +7572,6 @@
"node": ">= 0.4"
}
},
- "node_modules/asynckit": {
- "version": "0.4.0",
- "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
- "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
- "license": "MIT"
- },
"node_modules/autoprefixer": {
"version": "10.4.19",
"resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.19.tgz",
@@ -7863,6 +7823,7 @@
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
"integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+ "dev": true,
"license": "MIT",
"dependencies": {
"es-errors": "^1.3.0",
@@ -8268,18 +8229,6 @@
"dev": true,
"license": "MIT"
},
- "node_modules/combined-stream": {
- "version": "1.0.8",
- "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
- "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
- "license": "MIT",
- "dependencies": {
- "delayed-stream": "~1.0.0"
- },
- "engines": {
- "node": ">= 0.8"
- }
- },
"node_modules/comma-separated-tokens": {
"version": "2.0.3",
"resolved": "https://registry.npmjs.org/comma-separated-tokens/-/comma-separated-tokens-2.0.3.tgz",
@@ -8698,15 +8647,6 @@
"url": "https://github.com/sponsors/ljharb"
}
},
- "node_modules/delayed-stream": {
- "version": "1.0.0",
- "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
- "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
- "license": "MIT",
- "engines": {
- "node": ">=0.4.0"
- }
- },
"node_modules/dequal": {
"version": "2.0.3",
"resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
@@ -8811,6 +8751,7 @@
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
"integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+ "dev": true,
"license": "MIT",
"dependencies": {
"call-bind-apply-helpers": "^1.0.1",
@@ -8944,6 +8885,7 @@
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
"integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+ "dev": true,
"license": "MIT",
"engines": {
"node": ">= 0.4"
@@ -8953,6 +8895,7 @@
"version": "1.3.0",
"resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
"integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+ "dev": true,
"license": "MIT",
"engines": {
"node": ">= 0.4"
@@ -8990,6 +8933,7 @@
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
"integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+ "dev": true,
"license": "MIT",
"dependencies": {
"es-errors": "^1.3.0"
@@ -9002,6 +8946,7 @@
"version": "2.1.0",
"resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
"integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
+ "dev": true,
"license": "MIT",
"dependencies": {
"es-errors": "^1.3.0",
@@ -9827,15 +9772,6 @@
"node": ">=0.10.0"
}
},
- "node_modules/event-target-shim": {
- "version": "5.0.1",
- "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
- "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==",
- "license": "MIT",
- "engines": {
- "node": ">=6"
- }
- },
"node_modules/eventemitter3": {
"version": "5.0.1",
"resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.1.tgz",
@@ -10084,41 +10020,6 @@
"url": "https://github.com/sponsors/isaacs"
}
},
- "node_modules/form-data": {
- "version": "4.0.4",
- "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
- "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
- "license": "MIT",
- "dependencies": {
- "asynckit": "^0.4.0",
- "combined-stream": "^1.0.8",
- "es-set-tostringtag": "^2.1.0",
- "hasown": "^2.0.2",
- "mime-types": "^2.1.12"
- },
- "engines": {
- "node": ">= 6"
- }
- },
- "node_modules/form-data-encoder": {
- "version": "1.7.2",
- "resolved": "https://registry.npmjs.org/form-data-encoder/-/form-data-encoder-1.7.2.tgz",
- "integrity": "sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A==",
- "license": "MIT"
- },
- "node_modules/formdata-node": {
- "version": "4.4.1",
- "resolved": "https://registry.npmjs.org/formdata-node/-/formdata-node-4.4.1.tgz",
- "integrity": "sha512-0iirZp3uVDjVGt9p49aTaqjk84TrglENEDuqfdlZQ1roC9CWlPk6Avf8EEnZNcAqPonwkG35x4n3ww/1THYAeQ==",
- "license": "MIT",
- "dependencies": {
- "node-domexception": "1.0.0",
- "web-streams-polyfill": "4.0.0-beta.3"
- },
- "engines": {
- "node": ">= 12.20"
- }
- },
"node_modules/formdata-polyfill": {
"version": "4.0.10",
"resolved": "https://registry.npmjs.org/formdata-polyfill/-/formdata-polyfill-4.0.10.tgz",
@@ -10264,6 +10165,7 @@
"version": "1.3.0",
"resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
"integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+ "dev": true,
"license": "MIT",
"dependencies": {
"call-bind-apply-helpers": "^1.0.2",
@@ -10297,6 +10199,7 @@
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
"integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+ "dev": true,
"license": "MIT",
"dependencies": {
"dunder-proto": "^1.0.1",
@@ -10442,6 +10345,7 @@
"version": "1.2.0",
"resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
"integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+ "dev": true,
"license": "MIT",
"engines": {
"node": ">= 0.4"
@@ -10518,6 +10422,7 @@
"version": "1.1.0",
"resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
"integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+ "dev": true,
"license": "MIT",
"engines": {
"node": ">= 0.4"
@@ -10530,6 +10435,7 @@
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
"integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
+ "dev": true,
"license": "MIT",
"dependencies": {
"has-symbols": "^1.0.3"
@@ -10626,15 +10532,6 @@
"node": ">=16.17.0"
}
},
- "node_modules/humanize-ms": {
- "version": "1.2.1",
- "resolved": "https://registry.npmjs.org/humanize-ms/-/humanize-ms-1.2.1.tgz",
- "integrity": "sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==",
- "license": "MIT",
- "dependencies": {
- "ms": "^2.0.0"
- }
- },
"node_modules/husky": {
"version": "9.1.7",
"resolved": "https://registry.npmjs.org/husky/-/husky-9.1.7.tgz",
@@ -11533,9 +11430,9 @@
}
},
"node_modules/langsmith": {
- "version": "0.3.38",
- "resolved": "https://registry.npmjs.org/langsmith/-/langsmith-0.3.38.tgz",
- "integrity": "sha512-2f3h427UCEi9jpGvdZp6eZNDhOzcSFSdwyZAax4Wo80NWozkXunepKkiXdQNloUZzE++fh3lxrjOqvimAJ0SSg==",
+ "version": "0.3.62",
+ "resolved": "https://registry.npmjs.org/langsmith/-/langsmith-0.3.62.tgz",
+ "integrity": "sha512-ApoGLs28cJCxL91l1PDDkjsA4oLrbeNlE1pyTvyopqXq9bNJrP8JPUNWZm/tpU0DzZpvZFctRzru4gNAr/bkxg==",
"license": "MIT",
"peer": true,
"dependencies": {
@@ -12075,6 +11972,7 @@
"version": "1.1.0",
"resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
"integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+ "dev": true,
"license": "MIT",
"engines": {
"node": ">= 0.4"
@@ -12703,27 +12601,6 @@
"node": ">=8.6"
}
},
- "node_modules/mime-db": {
- "version": "1.52.0",
- "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
- "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
- "license": "MIT",
- "engines": {
- "node": ">= 0.6"
- }
- },
- "node_modules/mime-types": {
- "version": "2.1.35",
- "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
- "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
- "license": "MIT",
- "dependencies": {
- "mime-db": "1.52.0"
- },
- "engines": {
- "node": ">= 0.6"
- }
- },
"node_modules/mimic-fn": {
"version": "4.0.0",
"resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-4.0.0.tgz",
@@ -13026,26 +12903,6 @@
"node": ">=10.5.0"
}
},
- "node_modules/node-fetch": {
- "version": "2.7.0",
- "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
- "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
- "license": "MIT",
- "dependencies": {
- "whatwg-url": "^5.0.0"
- },
- "engines": {
- "node": "4.x || >=6.0.0"
- },
- "peerDependencies": {
- "encoding": "^0.1.0"
- },
- "peerDependenciesMeta": {
- "encoding": {
- "optional": true
- }
- }
- },
"node_modules/node-releases": {
"version": "2.0.19",
"resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.19.tgz",
@@ -13265,19 +13122,10 @@
}
},
"node_modules/openai": {
- "version": "4.104.0",
- "resolved": "https://registry.npmjs.org/openai/-/openai-4.104.0.tgz",
- "integrity": "sha512-p99EFNsA/yX6UhVO93f5kJsDRLAg+CTA2RBqdHK4RtK8u5IJw32Hyb2dTGKbnnFmnuoBv5r7Z2CURI9sGZpSuA==",
+ "version": "5.12.2",
+ "resolved": "https://registry.npmjs.org/openai/-/openai-5.12.2.tgz",
+ "integrity": "sha512-xqzHHQch5Tws5PcKR2xsZGX9xtch+JQFz5zb14dGqlshmmDAFBFEWmeIpf7wVqWV+w7Emj7jRgkNJakyKE0tYQ==",
"license": "Apache-2.0",
- "dependencies": {
- "@types/node": "^18.11.18",
- "@types/node-fetch": "^2.6.4",
- "abort-controller": "^3.0.0",
- "agentkeepalive": "^4.2.1",
- "form-data-encoder": "1.7.2",
- "formdata-node": "^4.3.2",
- "node-fetch": "^2.6.7"
- },
"bin": {
"openai": "bin/cli"
},
@@ -13294,15 +13142,6 @@
}
}
},
- "node_modules/openai/node_modules/@types/node": {
- "version": "18.19.115",
- "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.115.tgz",
- "integrity": "sha512-kNrFiTgG4a9JAn1LMQeLOv3MvXIPokzXziohMrMsvpYgLpdEt/mMiVYc4sGKtDfyxM5gIDF4VgrPRyCw4fHOYg==",
- "license": "MIT",
- "dependencies": {
- "undici-types": "~5.26.4"
- }
- },
"node_modules/optionator": {
"version": "0.9.4",
"resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
@@ -15984,12 +15823,6 @@
"node": ">=8.0"
}
},
- "node_modules/tr46": {
- "version": "0.0.3",
- "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
- "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
- "license": "MIT"
- },
"node_modules/trim-lines": {
"version": "3.0.1",
"resolved": "https://registry.npmjs.org/trim-lines/-/trim-lines-3.0.1.tgz",
@@ -16195,12 +16028,6 @@
"url": "https://github.com/sponsors/ljharb"
}
},
- "node_modules/undici-types": {
- "version": "5.26.5",
- "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
- "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==",
- "license": "MIT"
- },
"node_modules/unified": {
"version": "11.0.5",
"resolved": "https://registry.npmjs.org/unified/-/unified-11.0.5.tgz",
@@ -16564,31 +16391,6 @@
"defaults": "^1.0.3"
}
},
- "node_modules/web-streams-polyfill": {
- "version": "4.0.0-beta.3",
- "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-4.0.0-beta.3.tgz",
- "integrity": "sha512-QW95TCTaHmsYfHDybGMwO5IJIM93I/6vTRk+daHTWFPhwh+C8Cg7j7XyKrwrj8Ib6vYXe0ocYNrmzY4xAAN6ug==",
- "license": "MIT",
- "engines": {
- "node": ">= 14"
- }
- },
- "node_modules/webidl-conversions": {
- "version": "3.0.1",
- "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
- "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
- "license": "BSD-2-Clause"
- },
- "node_modules/whatwg-url": {
- "version": "5.0.0",
- "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
- "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
- "license": "MIT",
- "dependencies": {
- "tr46": "~0.0.3",
- "webidl-conversions": "^3.0.0"
- }
- },
"node_modules/which": {
"version": "2.0.2",
"resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
diff --git a/ui/package.json b/ui/package.json
index d569e10eff..05484fe77d 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -2,7 +2,7 @@
"dependencies": {
"@hookform/resolvers": "^3.9.0",
"@langchain/langgraph-supervisor": "^0.0.12",
- "@langchain/openai": "0.5.10",
+ "@langchain/openai": "^0.6.9",
"@next/third-parties": "^15.3.3",
"@nextui-org/react": "2.4.8",
"@nextui-org/system": "2.2.1",
@@ -43,9 +43,9 @@
"react": "^18.3.1",
"react-dom": "^18.3.1",
"react-hook-form": "^7.52.2",
- "rss-parser": "^3.13.0",
"react-markdown": "^10.1.0",
"recharts": "^2.15.2",
+ "rss-parser": "^3.13.0",
"server-only": "^0.0.1",
"shadcn-ui": "^0.2.3",
"sharp": "^0.33.5",
diff --git a/ui/tests/auth-login.spec.ts b/ui/tests/auth-login.spec.ts
index fc612a71a5..7176159d2b 100644
--- a/ui/tests/auth-login.spec.ts
+++ b/ui/tests/auth-login.spec.ts
@@ -134,25 +134,56 @@ test.describe("Session Persistence", () => {
await goToLogin(page);
await login(page, TEST_CREDENTIALS.VALID);
await verifySuccessfulLogin(page);
+
// Logout
await logout(page);
await verifyLogoutSuccess(page);
+
// Verify cannot access protected route after logout
await page.goto(URLS.DASHBOARD);
await expect(page).toHaveURL(URLS.LOGIN);
});
- test("should handle session timeout gracefully", async ({ page }) => {
- // Login first
- await goToLogin(page);
- await login(page, TEST_CREDENTIALS.VALID);
- await verifySuccessfulLogin(page);
- // Simulate session timeout by clearing cookies
- await page.context().clearCookies();
- // Try to navigate to a protected route
- await page.goto(URLS.PROFILE);
- // Should be redirected to login
- await expect(page).toHaveURL(URLS.LOGIN);
+ test("should handle session timeout gracefully", async ({ browser }) => {
+ // Test approach: Verify that a new browser context without auth cookies
+ // gets redirected to login when accessing protected routes
+
+ // First, login in one context to verify auth works
+ const authContext = await browser.newContext();
+ const authPage = await authContext.newPage();
+
+ await goToLogin(authPage);
+ await login(authPage, TEST_CREDENTIALS.VALID);
+ await verifySuccessfulLogin(authPage);
+
+ // Verify session exists in authenticated context
+ const authResponse = await authPage.request.get("/api/auth/session");
+ const authSession = await authResponse.json();
+ expect(authSession).toBeTruthy();
+ expect(authSession.user).toBeTruthy();
+
+ // Now create a completely separate context without any auth
+ const unauthContext = await browser.newContext();
+ const unauthPage = await unauthContext.newPage();
+
+ // Try to access protected route in unauthenticated context
+ await unauthPage.goto(URLS.PROFILE, {
+ waitUntil: "networkidle",
+ });
+
+ // Should be redirected to login since this context has no auth
+ await expect(unauthPage).toHaveURL(URLS.LOGIN);
+
+ // Verify session is null in unauthenticated context
+ const unauthResponse = await unauthPage.request.get("/api/auth/session");
+ const unauthSessionText = await unauthResponse.text();
+ expect(unauthSessionText).toBe("null");
+
+ // Clean up
+ await authPage.close();
+ await authContext.close();
+ await unauthPage.close();
+ await unauthContext.close();
});
});
diff --git a/ui/types/integrations.ts b/ui/types/integrations.ts
index 7601ae4e6d..a95174cb45 100644
--- a/ui/types/integrations.ts
+++ b/ui/types/integrations.ts
@@ -32,59 +32,45 @@ export interface IntegrationProps {
links: { self: string };
}
-const baseS3IntegrationSchema = z.object({
- integration_type: z.literal("amazon_s3"),
- bucket_name: z.string().min(1, "Bucket name is required"),
- output_directory: z.string().min(1, "Output directory is required"),
- providers: z.array(z.string()).optional(),
- enabled: z.boolean().optional(),
- // AWS Credentials fields compatible with AWSCredentialsRole
+// Shared AWS credential fields schema
+const awsCredentialFields = {
credentials_type: z.enum(["aws-sdk-default", "access-secret-key"]),
aws_access_key_id: z.string().optional(),
aws_secret_access_key: z.string().optional(),
aws_session_token: z.string().optional(),
- // IAM Role fields
role_arn: z.string().optional(),
external_id: z.string().optional(),
role_session_name: z.string().optional(),
session_duration: z.string().optional(),
-});
+ show_role_section: z.boolean().optional(),
+};
-const s3IntegrationValidation = (data: any, ctx: z.RefinementCtx) => {
- // If using access-secret-key, require AWS credentials (for create form)
- if (data.credentials_type === "access-secret-key") {
+// Shared validation helper for AWS credentials (create mode)
+const validateAwsCredentialsCreate = (
+ data: any,
+ ctx: z.RefinementCtx,
+ requireCredentials: boolean = true,
+) => {
+ if (data.credentials_type === "access-secret-key" && requireCredentials) {
if (!data.aws_access_key_id) {
ctx.addIssue({
code: z.ZodIssueCode.custom,
- message:
- "AWS Access Key ID is required when using access and secret key",
+ message: "AWS Access Key ID is required when using access and secret key",
path: ["aws_access_key_id"],
});
}
if (!data.aws_secret_access_key) {
ctx.addIssue({
code: z.ZodIssueCode.custom,
- message:
- "AWS Secret Access Key is required when using access and secret key",
+ message: "AWS Secret Access Key is required when using access and secret key",
path: ["aws_secret_access_key"],
});
}
}
-
- // If role_arn is provided, external_id is required
- if (data.role_arn && data.role_arn.trim() !== "") {
- if (!data.external_id || data.external_id.trim() === "") {
- ctx.addIssue({
- code: z.ZodIssueCode.custom,
- message: "External ID is required when using Role ARN",
- path: ["external_id"],
- });
- }
- }
};
-const s3IntegrationEditValidation = (data: any, ctx: z.RefinementCtx) => {
- // If using access-secret-key, and credentials are provided, require both
+// Shared validation helper for AWS credentials (edit mode)
+const validateAwsCredentialsEdit = (data: any, ctx: z.RefinementCtx) => {
if (data.credentials_type === "access-secret-key") {
const hasAccessKey = !!data.aws_access_key_id;
const hasSecretKey = !!data.aws_secret_access_key;
@@ -92,8 +78,7 @@ const s3IntegrationEditValidation = (data: any, ctx: z.RefinementCtx) => {
if (hasAccessKey && !hasSecretKey) {
ctx.addIssue({
code: z.ZodIssueCode.custom,
- message:
- "AWS Secret Access Key is required when providing Access Key ID",
+ message: "AWS Secret Access Key is required when providing Access Key ID",
path: ["aws_secret_access_key"],
});
}
@@ -101,16 +86,29 @@ const s3IntegrationEditValidation = (data: any, ctx: z.RefinementCtx) => {
if (hasSecretKey && !hasAccessKey) {
ctx.addIssue({
code: z.ZodIssueCode.custom,
- message:
- "AWS Access Key ID is required when providing Secret Access Key",
+ message: "AWS Access Key ID is required when providing Secret Access Key",
path: ["aws_access_key_id"],
});
}
}
+};
- // If role_arn is provided, external_id is required
- if (data.role_arn && data.role_arn.trim() !== "") {
- if (!data.external_id || data.external_id.trim() === "") {
+// Shared validation helper for IAM Role fields
+const validateIamRole = (
+ data: any,
+ ctx: z.RefinementCtx,
+ checkShowSection: boolean = true,
+) => {
+ const shouldValidate = checkShowSection ? data.show_role_section === true : true;
+
+ if (shouldValidate && data.role_arn) {
+ if (data.role_arn.trim() === "") {
+ ctx.addIssue({
+ code: z.ZodIssueCode.custom,
+ message: "Role ARN is required",
+ path: ["role_arn"],
+ });
+ } else if (!data.external_id || data.external_id.trim() === "") {
ctx.addIssue({
code: z.ZodIssueCode.custom,
message: "External ID is required when using Role ARN",
@@ -118,8 +116,35 @@ const s3IntegrationEditValidation = (data: any, ctx: z.RefinementCtx) => {
});
}
}
+
+ if (checkShowSection && data.show_role_section === true) {
+ if (!data.role_arn || data.role_arn.trim() === "") {
+ ctx.addIssue({
+ code: z.ZodIssueCode.custom,
+ message: "Role ARN is required",
+ path: ["role_arn"],
+ });
+ }
+ if (!data.external_id || data.external_id.trim() === "") {
+ ctx.addIssue({
+ code: z.ZodIssueCode.custom,
+ message: "External ID is required",
+ path: ["external_id"],
+ });
+ }
+ }
};
+// S3 Integration Schemas
+const baseS3IntegrationSchema = z.object({
+ integration_type: z.literal("amazon_s3"),
+ bucket_name: z.string().min(1, "Bucket name is required"),
+ output_directory: z.string().min(1, "Output directory is required"),
+ providers: z.array(z.string()).optional(),
+ enabled: z.boolean().optional(),
+ ...awsCredentialFields,
+});
+
export const s3IntegrationFormSchema = baseS3IntegrationSchema
.extend({
enabled: z.boolean().default(true),
@@ -127,18 +152,67 @@ export const s3IntegrationFormSchema = baseS3IntegrationSchema
.enum(["aws-sdk-default", "access-secret-key"])
.default("aws-sdk-default"),
})
- .superRefine(s3IntegrationValidation);
+ .superRefine((data, ctx) => {
+ validateAwsCredentialsCreate(data, ctx);
+ validateIamRole(data, ctx);
+ });
export const editS3IntegrationFormSchema = baseS3IntegrationSchema
.extend({
bucket_name: z.string().min(1, "Bucket name is required").optional(),
- output_directory: z
- .string()
- .min(1, "Output directory is required")
- .optional(),
+ output_directory: z.string().min(1, "Output directory is required").optional(),
providers: z.array(z.string()).optional(),
+ credentials_type: z.enum(["aws-sdk-default", "access-secret-key"]).optional(),
+ })
+ .superRefine((data, ctx) => {
+ validateAwsCredentialsEdit(data, ctx);
+ validateIamRole(data, ctx);
+ });
+
+// Security Hub Integration Schemas
+const baseSecurityHubIntegrationSchema = z.object({
+ integration_type: z.literal("aws_security_hub"),
+ provider_id: z.string().min(1, "AWS Provider is required"),
+ send_only_fails: z.boolean().optional(),
+ archive_previous_findings: z.boolean().optional(),
+ use_custom_credentials: z.boolean().optional(),
+ enabled: z.boolean().optional(),
+ ...awsCredentialFields,
+});
+
+export const securityHubIntegrationFormSchema = baseSecurityHubIntegrationSchema
+ .extend({
+ enabled: z.boolean().default(true),
+ send_only_fails: z.boolean().default(true),
+ archive_previous_findings: z.boolean().default(false),
+ use_custom_credentials: z.boolean().default(false),
credentials_type: z
.enum(["aws-sdk-default", "access-secret-key"])
- .optional(),
+ .default("aws-sdk-default"),
})
- .superRefine(s3IntegrationEditValidation);
+ .superRefine((data, ctx) => {
+ if (data.use_custom_credentials) {
+ validateAwsCredentialsCreate(data, ctx);
+ validateIamRole(data, ctx);
+ }
+ // Always validate role if role_arn is provided
+ if (!data.use_custom_credentials && data.role_arn) {
+ validateIamRole(data, ctx, false);
+ }
+ });
+
+export const editSecurityHubIntegrationFormSchema = baseSecurityHubIntegrationSchema
+ .extend({
+ provider_id: z.string().optional(),
+ send_only_fails: z.boolean().optional(),
+ archive_previous_findings: z.boolean().optional(),
+ use_custom_credentials: z.boolean().optional(),
+ credentials_type: z.enum(["aws-sdk-default", "access-secret-key"]).optional(),
+ })
+ .superRefine((data, ctx) => {
+ if (data.use_custom_credentials !== false) {
+ validateAwsCredentialsEdit(data, ctx);
+ }
+ // Always validate role if role_arn is provided
+ validateIamRole(data, ctx, false);
+ });
\ No newline at end of file
diff --git a/ui/types/lighthouse/index.ts b/ui/types/lighthouse/index.ts
index 882cd2833c..38bcc6a1cd 100644
--- a/ui/types/lighthouse/index.ts
+++ b/ui/types/lighthouse/index.ts
@@ -1,6 +1,7 @@
export * from "./checks";
export * from "./compliances";
export * from "./findings";
+export * from "./model-params";
export * from "./overviews";
export * from "./providers";
export * from "./resources";
diff --git a/ui/types/lighthouse/model-params.ts b/ui/types/lighthouse/model-params.ts
new file mode 100644
index 0000000000..455146751a
--- /dev/null
+++ b/ui/types/lighthouse/model-params.ts
@@ -0,0 +1,5 @@
+export type ModelParams = {
+ maxTokens: number | undefined;
+ temperature: number | undefined;
+ reasoningEffort: string | undefined;
+};
diff --git a/util/prowler-bulk-provisioning/README.md b/util/prowler-bulk-provisioning/README.md
new file mode 100644
index 0000000000..3851979248
--- /dev/null
+++ b/util/prowler-bulk-provisioning/README.md
@@ -0,0 +1,422 @@
+# Prowler Provider Bulk Provisioning
+
+A Python script to bulk-provision cloud providers in Prowler Cloud/App via REST API. This tool streamlines the process of adding multiple cloud providers to Prowler by reading configuration from YAML and making API calls with concurrency and retry support.
+
+## Supported Providers
+
+- **AWS** (Amazon Web Services)
+- **Azure** (Microsoft Azure)
+- **GCP** (Google Cloud Platform)
+- **Kubernetes**
+- **M365** (Microsoft 365)
+- **GitHub**
+
+## Features
+
+- **Concurrent Processing:** Configurable concurrency for faster bulk operations
+- **Retry Logic:** Built-in retry mechanism for handling temporary API failures
+- **Dry-Run Mode:** Test configuration without making actual API calls
+- **Flexible Authentication:** Supports various authentication methods per provider
+- **Error Handling:** Comprehensive error reporting and validation
+- **Connection Testing:** Built-in provider connection verification
+
+## How It Works
+
+The script uses a two-step process to provision providers in Prowler:
+
+1. **Provider Creation:** Creates the provider with basic information (provider type, UID, alias)
+2. **Secret Creation:** Creates and links authentication credentials as a separate secret resource
+
+This two-step approach follows the Prowler API design where providers and their credentials are managed as separate but linked resources, providing better security and flexibility.
+
+## Installation
+
+### Requirements
+
+- Python 3.7 or higher
+- Required packages (install via requirements.txt)
+
+### Setup
+
+1. Clone or navigate to the Prowler repository:
+ ```bash
+ cd contrib/other-contrib/provider-bulk-importer
+ ```
+
+2. Install dependencies:
+ ```bash
+ pip install -r requirements.txt
+ ```
+
+3. Get your Prowler API token:
+ - **Prowler Cloud:** Generate token at https://api.prowler.com
+ - **Self-hosted Prowler App:** Generate token in your local instance
+
+ ```bash
+ export PROWLER_API_TOKEN=$(curl --location 'https://api.prowler.com/api/v1/tokens' \
+ --header 'Content-Type: application/vnd.api+json' \
+ --header 'Accept: application/vnd.api+json' \
+ --data-raw '{
+ "data": {
+ "type": "tokens",
+ "attributes": {
+ "email": "your@email.com",
+ "password": "your-password"
+ }
+ }
+ }' | jq -r .data.attributes.access)
+ ```
+
+
+## Configuration
+
+### Environment Variables
+
+```bash
+export PROWLER_API_TOKEN="your-prowler-token"
+export PROWLER_API_BASE="https://api.prowler.com/api/v1" # Optional, defaults to Prowler Cloud
+```
+
+### Provider Configuration Files
+
+Create a configuration file (YAML recommended) listing the providers to add:
+
+#### YAML Format (Recommended)
+
+```yaml
+# providers.yaml
+- provider: aws
+ uid: "123456789012" # AWS Account ID
+ alias: "prod-root"
+ auth_method: role # role | credentials
+ credentials:
+ role_arn: "arn:aws:iam::123456789012:role/ProwlerScan"
+ external_id: "ext-abc123" # optional
+ session_name: "prowler-bulk" # optional
+ duration_seconds: 3600 # optional
+
+- provider: aws
+ uid: "210987654321"
+ alias: "dev"
+ auth_method: credentials # long/short-lived keys
+ credentials:
+ access_key_id: "AKIA..."
+ secret_access_key: "..."
+ session_token: "..." # optional
+
+- provider: azure
+ uid: "00000000-1111-2222-3333-444444444444" # Subscription ID
+ alias: "sub-eastus"
+ auth_method: service_principal
+ credentials:
+ tenant_id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
+ client_id: "ffffffff-1111-2222-3333-444444444444"
+ client_secret: "..."
+
+- provider: gcp
+ uid: "my-gcp-project-id" # Project ID
+ alias: "gcp-prod"
+ auth_method: service_account # Service Account authentication
+ credentials:
+ service_account_key_json_path: "./gcp-key.json"
+
+- provider: kubernetes
+ uid: "my-eks-context" # kubeconfig context name
+ alias: "eks-prod"
+ auth_method: kubeconfig
+ credentials:
+ kubeconfig_path: "~/.kube/config"
+
+- provider: m365
+ uid: "contoso.onmicrosoft.com" # Domain ID
+ alias: "contoso"
+ auth_method: service_principal
+ credentials:
+ tenant_id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
+ client_id: "ffffffff-1111-2222-3333-444444444444"
+ client_secret: "..."
+
+- provider: github
+ uid: "my-org" # organization or username
+ alias: "gh-org"
+ auth_method: personal_access_token # oauth_app_token | github_app
+ credentials:
+ token: "ghp_..."
+```
+
+## Usage
+
+### Basic Usage
+
+```bash
+python prowler_bulk_provisioning.py providers.yaml
+```
+
+### Advanced Usage
+
+```bash
+python prowler_bulk_provisioning.py providers.yaml \
+ --base-url https://api.prowler.com/api/v1 \
+ --providers-endpoint /providers \
+ --concurrency 6 \
+ --timeout 120
+```
+
+### Command Line Options
+
+| Option | Description | Default |
+|--------|-------------|---------|
+| `input_file` | YAML file with provider entries | Required |
+| `--base-url` | API base URL | `https://api.prowler.com/api/v1` |
+| `--token` | Bearer token | `PROWLER_API_TOKEN` env var |
+| `--providers-endpoint` | Providers API endpoint | `/providers` |
+| `--concurrency` | Number of concurrent requests | `5` |
+| `--timeout` | Per-request timeout in seconds | `60` |
+| `--insecure` | Disable TLS verification | `False` |
+| `--dry-run` | Print payloads without sending | `False` |
+| `--test-provider` | Test connection after creating each provider (true/false) | `true` (enabled by default) |
+| `--test-provider-only` | Only test connections for existing providers (skip creation) | `False` |
+
+### Self-hosted Prowler App
+
+For self-hosted installations:
+
+```bash
+python prowler_bulk_provisioning.py providers.yaml \
+ --base-url http://localhost:8080/api/v1
+```
+
+## Provider-Specific Configuration
+
+### AWS Authentication Methods
+
+#### IAM Role (Recommended)
+```yaml
+- provider: aws
+ uid: "123456789012"
+ alias: "prod"
+ auth_method: role
+ credentials:
+ role_arn: "arn:aws:iam::123456789012:role/ProwlerScan"
+ external_id: "optional-external-id"
+```
+
+#### Access Keys
+```yaml
+- provider: aws
+ uid: "123456789012"
+ alias: "dev"
+ auth_method: credentials
+ credentials:
+ access_key_id: "AKIA..."
+ secret_access_key: "..."
+ session_token: "..." # optional for temporary credentials
+```
+
+### Azure Authentication
+
+```yaml
+- provider: azure
+ uid: "subscription-uuid"
+ alias: "azure-prod"
+ auth_method: service_principal
+ credentials:
+ tenant_id: "tenant-uuid"
+ client_id: "client-uuid"
+ client_secret: "client-secret"
+```
+
+### GCP Authentication
+
+The Prowler API supports the following authentication methods for GCP:
+
+#### Method 1: Service Account JSON (Recommended)
+```yaml
+- provider: gcp
+ uid: "project-id"
+ alias: "gcp-prod"
+ auth_method: service_account # or 'service_account_json'
+ credentials:
+ service_account_key_json_path: "/path/to/key.json"
+ # OR inline:
+ # inline_json:
+ # type: "service_account"
+ # project_id: "your-project"
+ # private_key_id: "key-id"
+ # private_key: "-----BEGIN PRIVATE KEY-----\n..."
+ # client_email: "service-account@project.iam.gserviceaccount.com"
+ # client_id: "1234567890"
+ # auth_uri: "https://accounts.google.com/o/oauth2/auth"
+ # token_uri: "https://oauth2.googleapis.com/token"
+ # auth_provider_x509_cert_url: "https://www.googleapis.com/oauth2/v1/certs"
+ # client_x509_cert_url: "https://www.googleapis.com/robot/v1/metadata/x509/..."
+```
+
+#### Method 2: OAuth2 Credentials
+```yaml
+- provider: gcp
+ uid: "project-id"
+ alias: "gcp-prod"
+ auth_method: oauth2 # or 'adc' for Application Default Credentials
+ credentials:
+ client_id: "123456789012345678901.apps.googleusercontent.com"
+ client_secret: "GOCSPX-xxxxxxxxxxxxxxxxx"
+ refresh_token: "1//0exxxxxxxxxxxxxxxxx"
+```
+
+### Kubernetes Authentication
+
+```yaml
+- provider: kubernetes
+ uid: "context-name"
+ alias: "k8s-prod"
+ auth_method: kubeconfig
+ credentials:
+ kubeconfig_path: "~/.kube/config"
+ # OR
+ # kubeconfig_inline: |
+ # apiVersion: v1
+ # clusters: ...
+```
+
+### Microsoft 365 Authentication
+
+```yaml
+- provider: m365
+ uid: "domain.onmicrosoft.com"
+ alias: "m365-tenant"
+ auth_method: service_principal
+ credentials:
+ tenant_id: "tenant-uuid"
+ client_id: "client-uuid"
+ client_secret: "client-secret"
+```
+
+### GitHub Authentication
+
+#### Personal Access Token
+```yaml
+- provider: github
+ uid: "organization-name"
+ alias: "gh-org"
+ auth_method: personal_access_token
+ credentials:
+ token: "ghp_..."
+```
+
+#### GitHub App
+```yaml
+- provider: github
+ uid: "organization-name"
+ alias: "gh-org"
+ auth_method: github_app
+ credentials:
+ app_id: "123456"
+ private_key_path: "/path/to/private-key.pem"
+ # OR
+ # private_key_inline: "-----BEGIN RSA PRIVATE KEY-----\n..."
+```
+
+## Connection Testing
+
+The script includes built-in connection testing to verify that providers can successfully authenticate with their respective cloud services.
+
+By default, the script tests connections immediately after creating providers:
+
+```bash
+python prowler_bulk_provisioning.py providers.yaml
+```
+
+This will:
+1. Create the provider
+2. Add credentials
+3. Test the connection
+4. Report connection status
+
+To skip connection testing, use:
+
+```bash
+python prowler_bulk_provisioning.py providers.yaml --test-provider false
+```
+
+### Test Existing Providers
+
+Test connections for already existing providers without creating new ones:
+
+```bash
+python prowler_bulk_provisioning.py providers.yaml --test-provider-only
+```
+
+This is useful for:
+- Verifying existing provider configurations
+- Debugging authentication issues
+- Regular connection health checks
+- Testing after credential updates
+
+### Example Output
+
+```
+[1] ✅ Created provider (id=db9a8985-f9ec-4dd8-b5a0-e05ab3880bed)
+[1] ✅ Created secret (id=466f76c6-5878-4602-a4bc-13f9522c1fd2)
+[1] ✅ Connection test: Connected
+
+[2] ✅ Created provider (id=7a99f789-0cf5-4329-8279-2d443a962676)
+[2] ✅ Created secret (id=c5702180-f7c4-40fd-be0e-f6433479b126)
+[2] ❌ Connection test: Not connected
+```
+
+## Advanced Features
+
+### Dry Run Mode
+
+Test your configuration without making API calls:
+
+```bash
+python prowler_bulk_provisioning.py providers.yaml --dry-run
+```
+
+## Troubleshooting
+
+### Common Issues
+
+1. **Invalid API Token**
+ ```
+ Error: 401 Unauthorized
+ Solution: Check your PROWLER_API_TOKEN or --token parameter
+ ```
+
+2. **Network Timeouts**
+ ```
+ Error: Request timeout
+ Solution: Increase --timeout value or check network connectivity
+ ```
+
+3. **Invalid Provider Configuration**
+ ```
+ Error: Each item must include 'provider' and 'uid'
+ Solution: Verify all required fields are present in your config file
+ ```
+
+4. **File Not Found Errors**
+ ```
+ Error: No such file or directory
+ Solution: Check file paths for credentials files (JSON keys, kubeconfig, etc.)
+ ```
+
+## Examples
+
+See the `examples/` directory for sample configuration files:
+
+- `examples/simple-providers.yaml` - Basic example with minimal configuration
+
+## Support
+
+For issues and questions:
+
+1. Check the [Prowler documentation](https://docs.prowler.com)
+2. Review the [API documentation](https://api.prowler.com/api/v1/docs)
+3. Open an issue in the [Prowler repository](https://github.com/prowler-cloud/prowler)
+
+## License
+
+This tool is part of the Prowler project and follows the same licensing terms.
diff --git a/util/prowler-bulk-provisioning/examples/simple-providers.yaml b/util/prowler-bulk-provisioning/examples/simple-providers.yaml
new file mode 100644
index 0000000000..3a5b53e523
--- /dev/null
+++ b/util/prowler-bulk-provisioning/examples/simple-providers.yaml
@@ -0,0 +1,56 @@
+# Simple Prowler Provider Configuration Example
+#
+# This is a minimal example showing the basic required fields for each provider type.
+# Use this as a starting point and refer to providers.yaml for complete examples.
+
+# AWS with IAM Role (Recommended)
+- provider: aws
+ uid: "123456789012"
+ alias: "my-aws-account"
+ auth_method: role
+ credentials:
+ role_arn: "arn:aws:iam::123456789012:role/ProwlerScan"
+
+# Azure with Service Principal
+- provider: azure
+ uid: "00000000-1111-2222-3333-444444444444"
+ alias: "my-azure-subscription"
+ auth_method: service_principal
+ credentials:
+ tenant_id: "tenant-id-here"
+ client_id: "client-id-here"
+ client_secret: "client-secret-here"
+
+# GCP with Service Account
+- provider: gcp
+ uid: "my-gcp-project"
+ alias: "my-gcp-project"
+ auth_method: service_account_json
+ credentials:
+ service_account_key_json_path: "/path/to/service-account-key.json"
+
+# Kubernetes with kubeconfig
+- provider: kubernetes
+ uid: "my-cluster-context"
+ alias: "my-k8s-cluster"
+ auth_method: kubeconfig
+ credentials:
+ kubeconfig_path: "~/.kube/config"
+
+# Microsoft 365 with Service Principal
+- provider: m365
+ uid: "company.onmicrosoft.com"
+ alias: "my-m365-tenant"
+ auth_method: service_principal
+ credentials:
+ tenant_id: "tenant-id-here"
+ client_id: "client-id-here"
+ client_secret: "client-secret-here"
+
+# GitHub with Personal Access Token
+- provider: github
+ uid: "my-organization"
+ alias: "my-github-org"
+ auth_method: personal_access_token
+ credentials:
+ token: "ghp_token_here"
diff --git a/util/prowler-bulk-provisioning/nuke_providers.py b/util/prowler-bulk-provisioning/nuke_providers.py
new file mode 100755
index 0000000000..348855611f
--- /dev/null
+++ b/util/prowler-bulk-provisioning/nuke_providers.py
@@ -0,0 +1,449 @@
+#!/usr/bin/env python3
+"""
+Delete ALL providers from Prowler Cloud/App via REST API.
+
+⚠️ WARNING: This script will DELETE ALL PROVIDERS in your Prowler account!
+Use with extreme caution. There is no undo.
+
+Environment:
+ PROWLER_API_BASE (default: https://api.prowler.com/api/v1)
+ PROWLER_API_TOKEN (required unless --token is provided)
+
+Usage:
+ python nuke_providers.py --confirm
+ python nuke_providers.py --confirm --filter-provider aws
+ python nuke_providers.py --confirm --filter-alias "prod-*"
+
+Safety features:
+ * Requires explicit --confirm flag
+ * Shows preview of what will be deleted
+ * Optional filters to limit scope
+ * Dry-run mode available
+
+Author: Prowler Contributors ✨
+"""
+
+from __future__ import annotations
+
+import argparse
+import fnmatch
+import json
+import os
+import sys
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from dataclasses import dataclass
+from typing import Any, Dict, List, Optional, Tuple
+
+import requests
+
+# ----------------------------- CLI / Utils --------------------------------- #
+
+
+def env_or_arg(token_arg: Optional[str]) -> str:
+ """Get API token from argument or environment variable."""
+ token = token_arg or os.getenv("PROWLER_API_TOKEN")
+ if not token:
+ sys.exit("Missing API token. Set --token or PROWLER_API_TOKEN.")
+ return token
+
+
+def normalize_base_url(url: str) -> str:
+ """Normalize base URL format."""
+ url = url.rstrip("/")
+ if not url.lower().startswith(("http://", "https://")):
+ url = "https://" + url
+ return url
+
+
+# ----------------------------- HTTP client --------------------------------- #
+
+
+@dataclass
+class ApiClient:
+ """HTTP client for Prowler API."""
+
+ base_url: str
+ token: str
+ verify_ssl: bool = True
+ timeout: int = 60
+
+ def _headers(self) -> Dict[str, str]:
+ """Generate HTTP headers for API requests."""
+ return {
+ "Authorization": f"Bearer {self.token}",
+ "Content-Type": "application/vnd.api+json",
+ "Accept": "application/vnd.api+json",
+ }
+
+ def get(self, path: str) -> requests.Response:
+ """Make GET request to API endpoint."""
+ url = f"{self.base_url}{path}"
+ return requests.get(
+ url,
+ headers=self._headers(),
+ timeout=self.timeout,
+ verify=self.verify_ssl,
+ )
+
+ def delete(self, path: str) -> requests.Response:
+ """Make DELETE request to API endpoint."""
+ url = f"{self.base_url}{path}"
+ return requests.delete(
+ url,
+ headers=self._headers(),
+ timeout=self.timeout,
+ verify=self.verify_ssl,
+ )
+
+
+def fetch_all_providers(client: ApiClient) -> List[Dict[str, Any]]:
+ """Fetch all providers from the API with pagination."""
+ all_providers = []
+ page = 1
+ per_page = 100 # Max allowed by API
+
+ while True:
+ try:
+ # API uses page[number] and page[size] parameters
+ resp = client.get(f"/providers?page[number]={page}&page[size]={per_page}")
+
+ if resp.status_code != 200:
+ print(f"Error fetching providers (page {page}): {resp.status_code}")
+ print(f"Response: {resp.text}")
+ break
+
+ data = resp.json()
+ providers = data.get("data", [])
+
+ if not providers:
+ break
+
+ all_providers.extend(providers)
+
+ # Check if there's a next page
+ links = data.get("links", {})
+ if not links.get("next"):
+ break
+
+ page += 1
+
+ except Exception as e:
+ print(f"Error fetching providers: {e}")
+ break
+
+ return all_providers
+
+
+def apply_filters(
+ providers: List[Dict[str, Any]],
+ filter_provider: Optional[str] = None,
+ filter_alias: Optional[str] = None,
+ filter_uid: Optional[str] = None,
+) -> List[Dict[str, Any]]:
+ """Apply filters to provider list."""
+ filtered = providers
+
+ if filter_provider:
+ filtered = [
+ p
+ for p in filtered
+ if p.get("attributes", {}).get("provider") == filter_provider.lower()
+ ]
+
+ if filter_alias:
+ filtered = [
+ p
+ for p in filtered
+ if fnmatch.fnmatch(p.get("attributes", {}).get("alias", ""), filter_alias)
+ ]
+
+ if filter_uid:
+ filtered = [
+ p
+ for p in filtered
+ if fnmatch.fnmatch(p.get("attributes", {}).get("uid", ""), filter_uid)
+ ]
+
+ return filtered
+
+
+def delete_provider(client: ApiClient, provider_id: str) -> Tuple[bool, Dict[str, Any]]:
+ """Delete a single provider."""
+ try:
+ resp = client.delete(f"/providers/{provider_id}")
+
+ if resp.status_code in [200, 202, 204]:
+ # 202 means accepted for async processing (which is what Prowler returns)
+ # Check if it's a task response
+ try:
+ data = resp.json()
+ if data.get("data", {}).get("type") == "tasks":
+ task_state = data.get("data", {}).get("attributes", {}).get("state")
+ # If it's a deletion task that's available or completed, consider it success
+ if task_state in ["available", "completed"]:
+ return True, {
+ "status": "deleted (async)",
+ "id": provider_id,
+ "task": data,
+ }
+ except (json.JSONDecodeError, ValueError, KeyError):
+ pass
+
+ return True, {"status": "deleted", "id": provider_id}
+ else:
+ try:
+ data = resp.json()
+ except ValueError:
+ data = {"text": resp.text}
+ return False, {"status": resp.status_code, "body": data}
+
+ except Exception as e:
+ return False, {"error": str(e)}
+
+
+def print_provider_summary(providers: List[Dict[str, Any]]) -> None:
+ """Print a summary of providers to be deleted."""
+ if not providers:
+ print("No providers found matching the criteria.")
+ return
+
+ # Group by provider type
+ by_type: Dict[str, List[Dict[str, Any]]] = {}
+ for p in providers:
+ provider_type = p.get("attributes", {}).get("provider", "unknown")
+ if provider_type not in by_type:
+ by_type[provider_type] = []
+ by_type[provider_type].append(p)
+
+ print(f"\n{'=' * 60}")
+ print(f"PROVIDERS TO BE DELETED: {len(providers)} total")
+ print(f"{'=' * 60}")
+
+ for provider_type, items in sorted(by_type.items()):
+ print(f"\n{provider_type.upper()}: {len(items)} providers")
+ print("-" * 40)
+
+ # Show first 5 and last 2 if more than 7
+ if len(items) > 7:
+ for p in items[:5]:
+ attrs = p.get("attributes", {})
+ print(
+ f" • {attrs.get('alias', 'N/A'):30} (UID: {attrs.get('uid', 'N/A')})"
+ )
+ print(f" ... and {len(items) - 7} more ...")
+ for p in items[-2:]:
+ attrs = p.get("attributes", {})
+ print(
+ f" • {attrs.get('alias', 'N/A'):30} (UID: {attrs.get('uid', 'N/A')})"
+ )
+ else:
+ for p in items:
+ attrs = p.get("attributes", {})
+ print(
+ f" • {attrs.get('alias', 'N/A'):30} (UID: {attrs.get('uid', 'N/A')})"
+ )
+
+ print(f"\n{'=' * 60}\n")
+
+
+# ----------------------------- Main ---------------------------------------- #
+
+
+def main():
+ """Main function to delete providers."""
+ parser = argparse.ArgumentParser(
+ description="⚠️ DELETE ALL providers from Prowler (use with caution!)"
+ )
+ parser.add_argument(
+ "--confirm",
+ action="store_true",
+ required=True,
+ help="Required confirmation flag to proceed with deletion",
+ )
+ parser.add_argument(
+ "--base-url",
+ default=os.getenv("PROWLER_API_BASE", "https://api.prowler.com/api/v1"),
+ help="API base URL (default: env PROWLER_API_BASE or Prowler Cloud SaaS)",
+ )
+ parser.add_argument(
+ "--token", default=None, help="Bearer token (default: PROWLER_API_TOKEN)"
+ )
+ parser.add_argument(
+ "--filter-provider",
+ help="Only delete specific provider type (aws, azure, gcp, kubernetes, github, m365)",
+ )
+ parser.add_argument(
+ "--filter-alias",
+ help="Only delete providers matching alias pattern (supports wildcards: prod-*)",
+ )
+ parser.add_argument(
+ "--filter-uid",
+ help="Only delete providers matching UID pattern (supports wildcards: 100000*)",
+ )
+ parser.add_argument(
+ "--dry-run",
+ action="store_true",
+ help="Show what would be deleted without actually deleting",
+ )
+ parser.add_argument(
+ "--concurrency",
+ type=int,
+ default=5,
+ help="Number of concurrent deletion requests",
+ )
+ parser.add_argument(
+ "--timeout", type=int, default=60, help="Per-request timeout (seconds)"
+ )
+ parser.add_argument(
+ "--insecure",
+ action="store_true",
+ help="Disable TLS verification (not recommended)",
+ )
+ parser.add_argument(
+ "--yes",
+ action="store_true",
+ help="Skip interactive confirmation prompt",
+ )
+
+ args = parser.parse_args()
+
+ token = env_or_arg(args.token)
+ base_url = normalize_base_url(args.base_url)
+
+ client = ApiClient(
+ base_url=base_url,
+ token=token,
+ verify_ssl=not args.insecure,
+ timeout=args.timeout,
+ )
+
+ # Fetch all providers
+ print("Fetching providers from Prowler...")
+ all_providers = fetch_all_providers(client)
+
+ if not all_providers:
+ print("No providers found in your account.")
+ return
+
+ print(f"Found {len(all_providers)} total providers in your account.")
+
+ # Apply filters
+ providers_to_delete = apply_filters(
+ all_providers,
+ filter_provider=args.filter_provider,
+ filter_alias=args.filter_alias,
+ filter_uid=args.filter_uid,
+ )
+
+ if not providers_to_delete:
+ print("No providers match the specified filters.")
+ return
+
+ # Show what will be deleted
+ print_provider_summary(providers_to_delete)
+
+ if args.dry_run:
+ print("DRY RUN MODE - No providers will be deleted.")
+ print(f"Would delete {len(providers_to_delete)} providers.")
+ return
+
+ # Final confirmation
+ if not args.yes:
+ print("⚠️ WARNING: This action cannot be undone!")
+ print(f"⚠️ You are about to DELETE {len(providers_to_delete)} providers!")
+ print()
+ response = input("Type 'DELETE ALL' to confirm: ")
+ if response != "DELETE ALL":
+ print("Cancelled. No providers were deleted.")
+ return
+
+ # Perform deletion
+ print(f"\nDeleting {len(providers_to_delete)} providers...")
+
+ successes = 0
+ failures = 0
+ results: List[Tuple[str, bool, Dict[str, Any]]] = []
+
+ with ThreadPoolExecutor(max_workers=max(1, args.concurrency)) as executor:
+ futures = {
+ executor.submit(delete_provider, client, p.get("id")): (
+ p.get("id"),
+ p.get("attributes", {}).get("alias", "unknown"),
+ p.get("attributes", {}).get("provider", "unknown"),
+ )
+ for p in providers_to_delete
+ }
+
+ for fut in as_completed(futures):
+ provider_id, alias, provider_type = futures[fut]
+ try:
+ ok, data = fut.result()
+ results.append((provider_id, ok, data))
+
+ if ok:
+ successes += 1
+ # Check if it was an async deletion
+ if data.get("status") == "deleted (async)":
+ print(
+ f"✅ Deleting: {alias} ({provider_type}/{provider_id}) - queued"
+ )
+ else:
+ print(f"✅ Deleted: {alias} ({provider_type}/{provider_id})")
+ else:
+ failures += 1
+ print(f"❌ Failed: {alias} ({provider_type}/{provider_id})")
+ if "body" in data:
+ # Sanitize error data to avoid printing sensitive information
+ error_body = data["body"]
+ # Simple sanitization - just show error messages without full details
+ if isinstance(error_body, dict) and "errors" in error_body:
+ print(
+ f" Error: {error_body.get('errors', 'Unknown error')}"
+ )
+ else:
+ print(" Error: API request failed")
+
+ except Exception as e:
+ failures += 1
+ print(f"❌ Exception deleting {alias}: {e}")
+
+ # Summary with nuclear explosion art if successful
+ if successes > 0 and failures == 0:
+ # Nuclear explosion ASCII art
+ print(
+ r"""
+ _.-^^---....,,--
+ _-- --_
+ < >)
+ | |
+ \._ _./
+ ```--. . , ; .--'''
+ | | |
+ .-=|| | |=-.
+ `-=#$%&%$#=-'
+ | ; :|
+ _____.,-#%&$@%#&#~,._____
+ """
+ )
+ print(f"\n{'=' * 60}")
+ print("💥 NUCLEAR DELETION COMPLETE 💥")
+ print(f"{'=' * 60}")
+ print(f"✅ Successfully deleted: {successes} providers")
+ print("☢️ All targets eliminated!")
+ else:
+ print(f"\n{'=' * 60}")
+ print("DELETION COMPLETE")
+ print(f"{'=' * 60}")
+ print(f"✅ Successfully deleted: {successes} providers")
+ if failures > 0:
+ print(f"❌ Failed to delete: {failures} providers")
+
+ print(f"{'=' * 60}\n")
+
+ # Exit with error code if any failures
+ if failures > 0:
+ sys.exit(1)
+
+
+if __name__ == "__main__":
+ main()
diff --git a/util/prowler-bulk-provisioning/prowler_bulk_provisioning.py b/util/prowler-bulk-provisioning/prowler_bulk_provisioning.py
new file mode 100755
index 0000000000..e7ebdaac3b
--- /dev/null
+++ b/util/prowler-bulk-provisioning/prowler_bulk_provisioning.py
@@ -0,0 +1,811 @@
+#!/usr/bin/env python3
+
+from __future__ import annotations
+
+import argparse
+import csv
+import json
+import os
+import sys
+import time
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+import requests
+
+# ----------------------------- CLI / I/O utils ----------------------------- #
+
+
+def sanitize_sensitive_data(data: Any, depth: int = 0) -> Any:
+ """
+ Recursively sanitize sensitive data in dictionaries and lists.
+ Replaces sensitive field values with masked versions.
+ """
+ if depth > 10: # Prevent infinite recursion
+ return data
+
+ # List of sensitive field names to mask
+ sensitive_fields = {
+ "password",
+ "secret",
+ "token",
+ "key",
+ "credentials",
+ "client_secret",
+ "refresh_token",
+ "access_key_id",
+ "secret_access_key",
+ "session_token",
+ "private_key",
+ "api_key",
+ "apikey",
+ "auth",
+ "authorization",
+ "private_key_id",
+ "client_id",
+ "tenant_id",
+ "service_account_key",
+ "kubeconfig",
+ "role_arn",
+ "external_id",
+ }
+
+ if isinstance(data, dict):
+ sanitized = {}
+ for key, value in data.items():
+ # Check if the key name suggests sensitive data
+ key_lower = key.lower()
+ if any(sensitive in key_lower for sensitive in sensitive_fields):
+ if isinstance(value, str) and value:
+ # Mask the value but show first few chars for debugging
+ if len(value) > 8:
+ sanitized[key] = (
+ f"{value[:4]}...{value[-2:]}" if len(value) > 6 else "***"
+ )
+ else:
+ sanitized[key] = "***"
+ elif isinstance(value, (dict, list)):
+ # Still recurse into nested structures
+ sanitized[key] = sanitize_sensitive_data(value, depth + 1)
+ else:
+ sanitized[key] = "***" if value else value
+ else:
+ # Recurse into non-sensitive fields
+ if isinstance(value, (dict, list)):
+ sanitized[key] = sanitize_sensitive_data(value, depth + 1)
+ else:
+ sanitized[key] = value
+ return sanitized
+ elif isinstance(data, list):
+ return [sanitize_sensitive_data(item, depth + 1) for item in data]
+ else:
+ return data
+
+
+def load_items(path: Path) -> List[Dict[str, Any]]:
+ """Load provider items from YAML, JSON, or CSV file."""
+ ext = path.suffix.lower()
+ if ext in (".yaml", ".yml"):
+ try:
+ import yaml # type: ignore
+ except Exception:
+ sys.exit("PyYAML is required for YAML inputs. pip install pyyaml")
+ with path.open("r", encoding="utf-8") as f:
+ data = yaml.safe_load(f)
+ if isinstance(data, dict):
+ # allow single object with "items" key
+ data = data.get("items") or []
+ if not isinstance(data, list):
+ sys.exit("YAML root must be a list (or dict with 'items').")
+ return data
+
+ if ext == ".json":
+ with path.open("r", encoding="utf-8") as f:
+ data = json.load(f)
+ if isinstance(data, dict):
+ data = data.get("items") or []
+ if not isinstance(data, list):
+ sys.exit("JSON root must be a list (or dict with 'items').")
+ return data
+
+ if ext == ".csv":
+ items: List[Dict[str, Any]] = []
+ with path.open("r", encoding="utf-8") as f:
+ reader = csv.DictReader(f)
+ for row in reader:
+ # Support a 'credentials' column containing JSON
+ creds = row.get("credentials")
+ if creds:
+ try:
+ row["credentials"] = json.loads(creds)
+ except Exception:
+ sys.exit("Invalid JSON in 'credentials' column")
+ # Normalize empty strings to None
+ for k, v in list(row.items()):
+ if isinstance(v, str) and v.strip() == "":
+ row[k] = None
+ items.append(row)
+ return items
+
+ sys.exit(f"Unsupported input file type: {ext}")
+
+
+def env_or_arg(token_arg: Optional[str]) -> str:
+ """Get API token from argument or environment variable."""
+ token = token_arg or os.getenv("PROWLER_API_TOKEN")
+ if not token:
+ sys.exit("Missing API token. Set --token or PROWLER_API_TOKEN.")
+ return token
+
+
+def normalize_base_url(url: str) -> str:
+ """Normalize base URL format."""
+ url = url.rstrip("/")
+ if not url.lower().startswith(("http://", "https://")):
+ url = "https://" + url
+ return url
+
+
+# ----------------------------- Payload builders ---------------------------- #
+
+
+def read_text_file(path: Optional[str]) -> Optional[str]:
+ """Read text content from file path."""
+ if not path:
+ return None
+ p = Path(os.path.expanduser(path))
+ return p.read_text(encoding="utf-8")
+
+
+def build_payload(
+ item: Dict[str, Any],
+) -> Tuple[str, Dict[str, Any], Optional[Dict[str, Any]]]:
+ """
+ Returns (endpoint_path, provider_payload, secret_payload) to POST.
+
+ The API requires two steps:
+ 1. Create provider with minimal info
+ 2. Create secret linked to the provider
+ """
+ provider = str(item.get("provider", "")).strip().lower()
+ uid = item.get("uid") # account id / subscription id / project id / etc.
+ alias = item.get("alias")
+ auth_method = str(item.get("auth_method", "")).strip().lower()
+ creds: Dict[str, Any] = item.get("credentials") or {}
+
+ if not provider or not uid:
+ raise ValueError("Each item must include 'provider' and 'uid'.")
+
+ # Step 1: Build provider creation payload (minimal)
+ provider_payload: Dict[str, Any] = {
+ "data": {
+ "type": "providers",
+ "attributes": {
+ "provider": provider,
+ "uid": uid,
+ "alias": alias,
+ },
+ }
+ }
+
+ # Step 2: Build secret creation payload if credentials are provided
+ secret_payload: Optional[Dict[str, Any]] = None
+
+ if auth_method and creds:
+ # Determine secret_type based on auth_method and provider
+ if auth_method == "role":
+ secret_type = "role"
+ elif provider == "gcp" and auth_method in [
+ "service_account",
+ "service_account_json",
+ ]:
+ secret_type = "service_account"
+ else:
+ secret_type = "static"
+ secret_data: Dict[str, Any] = {}
+
+ if provider == "aws":
+ if auth_method == "role":
+ external_id = creds.get("external_id")
+ if not external_id:
+ raise ValueError(
+ "AWS role authentication requires 'external_id' in credentials"
+ )
+ secret_data = {
+ "role_arn": creds.get("role_arn"),
+ "external_id": external_id,
+ }
+ # Optional fields for role
+ if creds.get("session_name"):
+ secret_data["role_session_name"] = creds.get("session_name")
+ if creds.get("duration_seconds"):
+ secret_data["session_duration"] = creds.get("duration_seconds")
+ if creds.get("access_key_id"):
+ secret_data["aws_access_key_id"] = creds.get("access_key_id")
+ if creds.get("secret_access_key"):
+ secret_data["aws_secret_access_key"] = creds.get(
+ "secret_access_key"
+ )
+ if creds.get("session_token"):
+ secret_data["aws_session_token"] = creds.get("session_token")
+ elif auth_method == "credentials":
+ secret_type = "static"
+ secret_data = {
+ "aws_access_key_id": creds.get("access_key_id"),
+ "aws_secret_access_key": creds.get("secret_access_key"),
+ }
+ if creds.get("session_token"):
+ secret_data["aws_session_token"] = creds.get("session_token")
+ else:
+ raise ValueError("AWS 'auth_method' must be 'role' or 'credentials'.")
+
+ elif provider == "azure":
+ if auth_method != "service_principal":
+ raise ValueError("Azure 'auth_method' must be 'service_principal'.")
+ secret_data = {
+ "tenant_id": creds.get("tenant_id"),
+ "client_id": creds.get("client_id"),
+ "client_secret": creds.get("client_secret"),
+ }
+
+ elif provider == "gcp":
+ # GCP supports 3 authentication methods
+ if (
+ auth_method == "service_account"
+ or auth_method == "service_account_json"
+ ):
+ # Method 1: Service Account JSON key
+ inline = creds.get("inline_json")
+ path = creds.get("service_account_key_json_path")
+
+ # Load the service account JSON
+ sa_data = None
+ if path and not inline:
+ inline_content = read_text_file(path)
+ if inline_content:
+ try:
+ import json
+
+ sa_data = json.loads(inline_content)
+ except (json.JSONDecodeError, ValueError):
+ # If parsing fails, try sending as string
+ sa_data = {"private_key": inline_content}
+ elif inline:
+ if isinstance(inline, dict):
+ sa_data = inline
+ else:
+ try:
+ import json
+
+ sa_data = json.loads(inline)
+ except (json.JSONDecodeError, ValueError):
+ sa_data = {"private_key": inline}
+
+ # The API expects the service account JSON wrapped in a service_account_key field
+ if sa_data and isinstance(sa_data, dict):
+ # Wrap the service account JSON in the service_account_key field
+ secret_data = {"service_account_key": sa_data}
+ else:
+ raise ValueError("Could not parse service account JSON")
+
+ elif auth_method == "oauth2" or auth_method == "adc":
+ # Method 2: OAuth2 credentials (Application Default Credentials)
+ secret_data = {
+ "client_id": creds.get("client_id"),
+ "client_secret": creds.get("client_secret"),
+ "refresh_token": creds.get("refresh_token"),
+ }
+ elif (
+ auth_method == "workload_identity"
+ or auth_method == "workload_identity_federation"
+ ):
+ # Method 3: Workload Identity Federation
+ secret_data = {
+ "type": creds.get("type", "external_account"),
+ "audience": creds.get("audience"),
+ "subject_token_type": creds.get("subject_token_type"),
+ "service_account_impersonation_url": creds.get(
+ "service_account_impersonation_url"
+ ),
+ "token_url": creds.get("token_url"),
+ "credential_source": creds.get("credential_source"),
+ }
+ else:
+ raise ValueError(
+ "GCP 'auth_method' must be 'service_account', 'oauth2', or 'workload_identity'."
+ )
+
+ elif provider == "kubernetes":
+ if auth_method != "kubeconfig":
+ raise ValueError("Kubernetes 'auth_method' must be 'kubeconfig'.")
+ inline = creds.get("kubeconfig_inline")
+ path = creds.get("kubeconfig_path")
+ if path and not inline:
+ inline = read_text_file(path)
+ secret_data = {"kubeconfig_content": inline}
+
+ elif provider == "m365":
+ # M365 is not in the API schema, might need special handling
+ if auth_method != "service_principal":
+ raise ValueError("M365 'auth_method' must be 'service_principal'.")
+ secret_data = {
+ "tenant_id": creds.get("tenant_id"),
+ "client_id": creds.get("client_id"),
+ "client_secret": creds.get("client_secret"),
+ }
+ # User/password might be additional fields
+ if creds.get("username"):
+ secret_data["user"] = creds.get("username")
+ if creds.get("password"):
+ secret_data["password"] = creds.get("password")
+
+ elif provider == "github":
+ if auth_method == "personal_access_token":
+ secret_data = {"personal_access_token": creds.get("token")}
+ elif auth_method == "oauth_app_token":
+ secret_data = {"oauth_app_token": creds.get("oauth_token")}
+ elif auth_method == "github_app":
+ # Accept inline PK or path
+ pk = creds.get("private_key_inline")
+ if not pk and creds.get("private_key_path"):
+ pk = read_text_file(creds.get("private_key_path"))
+ secret_data = {
+ "github_app_id": int(creds.get("app_id", 0)),
+ "github_app_key": pk,
+ }
+ else:
+ raise ValueError(
+ "GitHub 'auth_method' must be personal_access_token | oauth_app_token | github_app."
+ )
+
+ else:
+ raise ValueError(f"Unsupported provider: {provider}")
+
+ # Build secret payload
+ secret_payload = {
+ "data": {
+ "type": "provider-secrets",
+ "attributes": {
+ "secret_type": secret_type,
+ "secret": secret_data,
+ "name": alias, # Use alias as the secret name
+ },
+ "relationships": {
+ "provider": {
+ "data": {
+ "type": "providers",
+ "id": None, # Will be filled after provider creation
+ }
+ }
+ },
+ }
+ }
+
+ # Return both payloads
+ return "/providers", provider_payload, secret_payload
+
+
+# ----------------------------- HTTP client --------------------------------- #
+
+
+@dataclass
+class ApiClient:
+ """HTTP client for Prowler API."""
+
+ base_url: str
+ token: str
+ verify_ssl: bool = True
+ timeout: int = 60
+
+ def _headers(self) -> Dict[str, str]:
+ """Generate HTTP headers for API requests."""
+ return {
+ "Authorization": f"Bearer {self.token}",
+ "Content-Type": "application/vnd.api+json",
+ "Accept": "application/vnd.api+json",
+ }
+
+ def post(self, path: str, json_body: Dict[str, Any]) -> requests.Response:
+ """Make POST request to API endpoint."""
+ url = f"{self.base_url}{path}"
+ return requests.post(
+ url,
+ headers=self._headers(),
+ json=json_body,
+ timeout=self.timeout,
+ verify=self.verify_ssl,
+ )
+
+ def get(self, path: str) -> requests.Response:
+ """Make GET request to API endpoint."""
+ url = f"{self.base_url}{path}"
+ return requests.get(
+ url,
+ headers=self._headers(),
+ timeout=self.timeout,
+ verify=self.verify_ssl,
+ )
+
+
+def with_retries(
+ func, *, retries=4, base_delay=1.25, exceptions=(requests.RequestException,)
+):
+ """Decorator to add retry logic to HTTP requests."""
+
+ def wrapper(*args, **kwargs):
+ for attempt in range(retries + 1):
+ try:
+ return func(*args, **kwargs)
+ except exceptions:
+ if attempt >= retries:
+ raise
+ sleep = base_delay * (2**attempt)
+ time.sleep(sleep)
+ # Shouldn't reach here
+ return func(*args, **kwargs)
+
+ return wrapper
+
+
+@with_retries
+def create_one(
+ client: ApiClient,
+ provider_endpoint: str,
+ provider_payload: Dict[str, Any],
+ secret_payload: Optional[Dict[str, Any]] = None,
+ test_provider: bool = False,
+) -> Tuple[bool, Dict[str, Any]]:
+ """Create a single provider with optional secret using two-step process."""
+ # Step 1: Create provider
+ resp = client.post(provider_endpoint, provider_payload)
+ try:
+ data = resp.json()
+ except ValueError:
+ data = {"text": resp.text}
+
+ if not (200 <= resp.status_code < 300):
+ return False, {"status": resp.status_code, "body": data, "step": "provider"}
+
+ provider_id = data.get("data", {}).get("id")
+ if not provider_id:
+ return False, {"error": "No provider ID returned", "body": data}
+
+ result = {"provider": data}
+
+ # Step 2: Create secret if provided
+ if secret_payload:
+ # Update the provider ID in the secret payload
+ secret_payload["data"]["relationships"]["provider"]["data"]["id"] = provider_id
+
+ # POST to /providers/secrets endpoint
+ secret_resp = client.post("/providers/secrets", secret_payload)
+ try:
+ secret_data = secret_resp.json()
+ except ValueError:
+ secret_data = {"text": secret_resp.text}
+
+ if not (200 <= secret_resp.status_code < 300):
+ # Provider was created but secret failed
+ result["secret_error"] = {
+ "status": secret_resp.status_code,
+ "body": secret_data,
+ }
+ return False, result
+
+ result["secret"] = secret_data
+
+ # Step 3: Test connection if requested
+ if test_provider:
+ connection_result = test_provider_connection(client, provider_id)
+ result["connection_test"] = connection_result
+
+ return True, result
+
+
+def test_provider_connection(client: ApiClient, provider_id: str) -> Dict[str, Any]:
+ """Test connection for a provider."""
+ try:
+ # Trigger connection test
+ resp = client.post(f"/providers/{provider_id}/connection", {})
+ if resp.status_code in [200, 202]:
+ # Wait a bit for the connection test to complete
+ time.sleep(2)
+
+ # Check the connection status
+ status_resp = client.get(f"/providers/{provider_id}")
+ if status_resp.status_code == 200:
+ provider_data = status_resp.json()
+ connection = (
+ provider_data.get("data", {})
+ .get("attributes", {})
+ .get("connection", {})
+ )
+ return {
+ "success": True,
+ "connected": connection.get("connected"),
+ "last_checked_at": connection.get("last_checked_at"),
+ }
+
+ return {
+ "success": False,
+ "error": f"Connection test failed with status {resp.status_code}",
+ }
+ except Exception as e:
+ return {"success": False, "error": str(e)}
+
+
+def find_existing_provider(client: ApiClient, provider: str, uid: str) -> Optional[str]:
+ """Find an existing provider by provider type and UID."""
+ try:
+ # Query for the specific provider
+ resp = client.get(f"/providers?filter[provider]={provider}&filter[uid]={uid}")
+ if resp.status_code == 200:
+ data = resp.json()
+ providers = data.get("data", [])
+ if providers:
+ return providers[0].get("id")
+ except Exception:
+ pass
+ return None
+
+
+# ----------------------------- main ---------------------------------------- #
+
+
+def main():
+ """Main function to process bulk provider provisioning."""
+ parser = argparse.ArgumentParser(description="Bulk provision providers in Prowler.")
+ parser.add_argument("input_file", help="YAML/JSON/CSV file with provider entries.")
+ parser.add_argument(
+ "--base-url",
+ default=os.getenv("PROWLER_API_BASE", "https://api.prowler.com/api/v1"),
+ help="API base URL (default: env PROWLER_API_BASE or Prowler Cloud SaaS).",
+ )
+ parser.add_argument(
+ "--token", default=None, help="Bearer token (default: PROWLER_API_TOKEN)."
+ )
+ parser.add_argument(
+ "--providers-endpoint",
+ default="/providers",
+ help="Path to the providers create endpoint (default: /providers).",
+ )
+ parser.add_argument(
+ "--concurrency", type=int, default=5, help="Number of concurrent requests."
+ )
+ parser.add_argument(
+ "--timeout", type=int, default=60, help="Per-request timeout (seconds)."
+ )
+ parser.add_argument(
+ "--insecure",
+ action="store_true",
+ help="Disable TLS verification (not recommended).",
+ )
+ parser.add_argument(
+ "--dry-run",
+ action="store_true",
+ help="Print what would be sent without calling the API.",
+ )
+ parser.add_argument(
+ "--test-provider",
+ type=lambda x: x.lower() in ["true", "1", "yes"],
+ default=True,
+ help="Test provider connection after creating each provider (default: true). Use --test-provider false to disable.",
+ )
+ parser.add_argument(
+ "--test-provider-only",
+ action="store_true",
+ help="Only test connections for existing providers (skip creation).",
+ )
+ args = parser.parse_args()
+
+ token = env_or_arg(args.token)
+ base_url = normalize_base_url(args.base_url)
+
+ items = load_items(Path(args.input_file))
+ if not items:
+ print("No items found in input file.")
+ return
+
+ client = ApiClient(
+ base_url=base_url,
+ token=token,
+ verify_ssl=not args.insecure,
+ timeout=args.timeout,
+ )
+
+ # Handle test-only mode
+ if args.test_provider_only:
+ print(
+ "Running in test-only mode: checking connections for existing providers..."
+ )
+ tested, connected, failed = 0, 0, 0
+
+ for idx, item in enumerate(items, start=1):
+ provider = str(item.get("provider", "")).strip().lower()
+ uid = item.get("uid")
+ alias = item.get("alias", "")
+
+ if not provider or not uid:
+ print(f"[{idx}] ❌ Skipping: missing provider or uid")
+ continue
+
+ # Find existing provider
+ provider_id = find_existing_provider(client, provider, uid)
+ if not provider_id:
+ print(f"[{idx}] ⚠️ Provider not found: {provider}/{uid} ({alias})")
+ continue
+
+ print(f"[{idx}] Testing connection for {provider}/{uid} ({alias})...")
+ result = test_provider_connection(client, provider_id)
+ tested += 1
+
+ if result.get("success"):
+ if result.get("connected"):
+ connected += 1
+ print(f"[{idx}] ✅ Connected successfully")
+ else:
+ failed += 1
+ print(f"[{idx}] ❌ Connection failed")
+ else:
+ failed += 1
+ # Sanitize error message to avoid potential sensitive data
+ error = str(result.get("error", "Unknown error"))
+ if any(
+ word in error.lower()
+ for word in [
+ "key",
+ "secret",
+ "token",
+ "password",
+ "credential",
+ "bearer",
+ ]
+ ):
+ print(f"[{idx}] ❌ Test failed: Authentication error")
+ else:
+ print(f"[{idx}] ❌ Test failed: {error}")
+
+ print(
+ f"\nConnection Test Results: Tested: {tested}, Connected: {connected}, Failed: {failed}"
+ )
+ return
+
+ # Regular mode: create providers
+ requests_to_send: List[
+ Tuple[int, str, Dict[str, Any], Optional[Dict[str, Any]]]
+ ] = []
+ for idx, item in enumerate(items, start=1):
+ try:
+ endpoint, provider_payload, secret_payload = build_payload(item)
+ except Exception as e:
+ # Sanitize exception message to avoid leaking sensitive data
+ error_msg = str(e)
+ if any(
+ word in error_msg.lower()
+ for word in ["key", "secret", "token", "password", "credential"]
+ ):
+ print(
+ f"[{idx}] ❌ Skipping item due to build error: Invalid credentials format"
+ )
+ else:
+ print(f"[{idx}] ❌ Skipping item due to build error: {error_msg}")
+ continue
+
+ # Allow overriding endpoint path globally (for standard creation)
+ if endpoint == "/providers":
+ endpoint = args.providers_endpoint
+
+ if args.dry_run:
+ print(f"[{idx}] DRY-RUN → Provider Creation")
+ print(f" POST {base_url}{endpoint}")
+ # Sanitize provider payload (usually safe but might contain some sensitive data)
+ sanitized_provider = sanitize_sensitive_data(provider_payload)
+ print(f" {json.dumps(sanitized_provider, indent=2)}")
+ if secret_payload:
+ print("\n Then Secret Creation:")
+ print(f" POST {base_url}/providers/secrets")
+ # Always sanitize secret payload as it contains credentials
+ sanitized_secret = sanitize_sensitive_data(secret_payload)
+ print(f" {json.dumps(sanitized_secret, indent=2)}")
+ if args.test_provider:
+ print("\n Then Test Connection")
+ print()
+ else:
+ requests_to_send.append((idx, endpoint, provider_payload, secret_payload))
+
+ if args.dry_run or not requests_to_send:
+ if not requests_to_send:
+ print("Nothing to send.")
+ return
+
+ successes, failures = 0, 0
+ results: List[Tuple[int, bool, Dict[str, Any]]] = []
+
+ with ThreadPoolExecutor(max_workers=max(1, args.concurrency)) as executor:
+ futures = {
+ executor.submit(
+ create_one,
+ client,
+ endpoint,
+ provider_payload,
+ secret_payload,
+ args.test_provider,
+ ): idx
+ for (idx, endpoint, provider_payload, secret_payload) in requests_to_send
+ }
+ for fut in as_completed(futures):
+ idx = futures[fut]
+ try:
+ ok, data = fut.result()
+ results.append((idx, ok, data))
+ if ok:
+ successes += 1
+ provider_id = data.get("provider", {}).get("data", {}).get("id")
+ print(f"[{idx}] ✅ Created provider (id={provider_id})")
+ if "secret" in data:
+ secret_id = data.get("secret", {}).get("data", {}).get("id")
+ print(f"[{idx}] ✅ Created secret (id={secret_id})")
+ if "connection_test" in data:
+ conn = data["connection_test"]
+ if conn.get("success") and conn.get("connected"):
+ print(f"[{idx}] ✅ Connection test: Connected")
+ elif conn.get("success"):
+ print(f"[{idx}] ⚠️ Connection test: Not connected")
+ else:
+ # Sanitize error message to avoid potential sensitive data
+ error = str(conn.get("error", "Unknown error"))
+ if any(
+ word in error.lower()
+ for word in [
+ "key",
+ "secret",
+ "token",
+ "password",
+ "credential",
+ "bearer",
+ ]
+ ):
+ print(
+ f"[{idx}] ❌ Connection test failed: Authentication error"
+ )
+ else:
+ print(f"[{idx}] ❌ Connection test failed: {error}")
+ else:
+ failures += 1
+ if "secret_error" in data:
+ print(f"[{idx}] ⚠️ Provider created but secret failed:")
+ # Sanitize error data which might contain sensitive information
+ sanitized_error = sanitize_sensitive_data(data["secret_error"])
+ print(f" {json.dumps(sanitized_error, indent=2)}")
+ else:
+ # Sanitize general error data
+ sanitized_data = sanitize_sensitive_data(data)
+ print(
+ f"[{idx}] ❌ API error: {json.dumps(sanitized_data, indent=2)}"
+ )
+ except Exception as e:
+ failures += 1
+ # Sanitize exception message to avoid leaking sensitive data
+ error_msg = str(e)
+ if any(
+ word in error_msg.lower()
+ for word in [
+ "key",
+ "secret",
+ "token",
+ "password",
+ "credential",
+ "bearer",
+ ]
+ ):
+ print(f"[{idx}] ❌ Request failed: Authentication or network error")
+ else:
+ print(f"[{idx}] ❌ Request failed: {error_msg}")
+
+ print(f"\nDone. Success: {successes} Failures: {failures}")
+
+
+if __name__ == "__main__":
+ main()
diff --git a/util/prowler-bulk-provisioning/requirements.txt b/util/prowler-bulk-provisioning/requirements.txt
new file mode 100644
index 0000000000..772e1a1565
--- /dev/null
+++ b/util/prowler-bulk-provisioning/requirements.txt
@@ -0,0 +1,10 @@
+# Prowler Provider Bulk Importer Dependencies
+#
+# Core HTTP library for API requests
+requests>=2.28.0
+
+# YAML parsing support (optional, only needed for YAML input files)
+PyYAML>=6.0
+
+# Type hints support for older Python versions (optional)
+typing-extensions>=4.0.0; python_version < '3.8'