+### Side Panel
+
+You do not have to switch to the full chat view to reach Lighthouse AI. A side panel is available on every page of Prowler Cloud. While collapsed it stays out of the way; open it from any dashboard, findings list, or configuration screen to ask questions without leaving what you are working on. Open it using the Lighthouse AI button, circled in red in the image below.
+
+
+
+Once open, the panel slides in alongside your current page and shares the same agent, tools, and persistent chat sessions as the full Chat View, so a conversation started in the panel can be reopened and continued later from either place.
+
+
+
+- **Available everywhere:** Summon the assistant from any page while you keep working in the normal view.
+- **Context-aware help:** Ask about the findings, resources, or compliance data you are currently looking at.
+- **Continuous sessions:** Conversations opened in the side panel are saved alongside the rest of your chat history.
+
### Tool Usage
Lighthouse AI on Prowler Cloud renders the agent's work as it happens, so responses are easier to follow and to trust. Tool calls and reasoning steps appear in the order they occur within the conversation.
@@ -63,6 +80,53 @@ At the top of the configuration page, the optional **Business Context** field le
Lighthouse AI on Prowler Cloud supports OpenAI, Amazon Bedrock, and OpenAI-compatible providers, with GPT-5.5 as the default. For per-provider setup and how to switch the default provider or model, see [Using Multiple LLM Providers](/user-guide/tutorials/prowler-cloud-lighthouse-multi-llm).
+## Capabilities
+
+Lighthouse AI works through the [Prowler MCP Server](/getting-started/products/prowler-mcp), which gives the agent a growing catalog of tools to explore and act on your security data. These actions run inside Prowler and never modify your cloud resources. Everything the agent can do maps to one of the following capability areas.
+
+### Findings and Finding Groups
+
+- Search and filter security findings across every connected provider by severity, status, region, service, check, date range, and muted state.
+- Retrieve full finding details, including remediation guidance, check metadata, and affected resources.
+- Summarize findings with aggregate statistics and trends.
+- Browse finding groups aggregated by check and drill down into the specific resources each group affects.
+
+### Resources
+
+- List and filter cloud resources by provider, region, service, resource type, and tags.
+- Inspect a resource's configuration, metadata, and related findings.
+- Review the timeline of cloud API actions performed on a resource (AWS CloudTrail), including who did what and when.
+- Get an aggregate overview of the resources Prowler has discovered.
+
+### Compliance
+
+- Review high-level compliance status across all frameworks, with pass/fail statistics per framework.
+- Get a requirement-level breakdown for a specific framework, including failed requirements and their associated findings.
+
+### Attack Paths
+
+- List Attack Paths scans and discover the queries available for each completed scan.
+- Run graph-based queries to reveal privilege-escalation chains and exploitable misconfigurations.
+- Retrieve the Cartography graph schema to build accurate custom queries.
+
+### Scans and Providers
+
+- List, inspect, and rename security scans across providers.
+- Trigger manual scans and schedule automated daily scans for continuous monitoring.
+- Search connected providers and check their connection status, connect new providers, or remove existing ones.
+
+### Muting
+
+- Manage the mutelist for pattern-based bulk muting.
+- Create, update, list, and delete finding-specific mute rules, each with a documented reason and audit trail.
+
+### Security Check Catalog and Documentation
+
+- Browse and search the Prowler Hub catalog of security checks and compliance frameworks, including check code and automated fixers.
+- Search and retrieve official Prowler documentation to answer how-to and product questions.
+
+For the complete list of underlying tools, see the [Prowler MCP Tools Reference](/getting-started/basic-usage/prowler-mcp-tools).
+
## FAQ
**Which LLM providers are supported?**
@@ -71,7 +135,11 @@ OpenAI (GPT models, including the default GPT-5.5), Amazon Bedrock (Claude, Llam
**Can Lighthouse AI change my cloud environment?**
-No. Lighthouse AI has read-only access to security data and no tools to modify resources, even when the connected cloud credentials would allow changes.
+No. Lighthouse AI cannot modify the resources in your connected cloud providers (AWS, Azure, GCP, and others). It has read-only access to that environment and no tools to change it, even when the connected cloud credentials would allow it.
+
+**Can Lighthouse AI change my Prowler Cloud environment?**
+
+Yes. Lighthouse AI can take action within Prowler Cloud itself, such as connecting or removing providers, triggering and scheduling scans, and managing mute rules and the mutelist. See [Capabilities](#capabilities) for the full list of what it can do. These actions only affect your Prowler Cloud workspace, never the resources in your cloud providers.
## Looking for the Open Source Version?
diff --git a/docs/getting-started/products/prowler-mcp.mdx b/docs/getting-started/products/prowler-mcp.mdx
index 93159b2e7d..a30c4e5488 100644
--- a/docs/getting-started/products/prowler-mcp.mdx
+++ b/docs/getting-started/products/prowler-mcp.mdx
@@ -26,7 +26,7 @@ The fastest way to get started is the **Cloud MCP Server** at `https://mcp.prowl
```
+
+
+
+
+
+## Start Using Prowler MCP
+
+- *"Show me all critical findings from my AWS accounts"*
+- *"What does the S3 bucket public access check do?"*
+- *"Onboard this new AWS account in my Prowler organization"*
+
+
+ 
+
+
+---
+
+# Claude Code in the Desktop App (Code Tab)
+
+The **Code** tab in the Claude desktop app runs the same Claude Code as the CLI, and reads the same `~/.claude.json`. There is no separate Prowler setup for it — you configure it **from a terminal** and the Code tab picks it up.
+
+
+
+
+Add the following, replacing the `command` path with the absolute path to the installed binary and the placeholder with your API key:
+
+```json
+{
+ "mcpServers": {
+ "prowler": {
+ "command": "/absolute/path/to/.local/share/prowler-mcp-bridge/node_modules/.bin/mcp-remote",
+ "args": [
+ "https://mcp.prowler.com/mcp",
+ "--header",
+ "Authorization: Bearer ${PROWLER_API_KEY}"
+ ],
+ "env": {
+ "PROWLER_API_KEY": "pk_your_api_key_here"
+ }
+ }
+ }
+}
+```
+
+
+
+
+## Troubleshooting
+
+### Server Does Not Appear After Editing the Config
+
+- Quit and reopen the app entirely — closing the window is not enough on macOS.
+- Confirm `claude_desktop_config.json` is valid JSON.
+- Confirm the `command` path points at a real executable. A wrong path surfaces as the server failing to start rather than as an auth error.
+
+### Tools Appear in Claude Code but Not in Chat
+
+Expected. The Chat tab does not read `~/.claude.json`, so servers added with `claude mcp add` never appear here. The Chat tab needs an entry in `claude_desktop_config.json`, which is what this guide sets up.
+
+### Authentication Fails With 401
+
+- Confirm the header value includes the `Bearer ` prefix.
+- Confirm the key has not been revoked in Prowler Cloud.
+
+### Checking the Logs
+
+- **macOS:** `~/Library/Logs/Claude/mcp*.log`
+- **Windows:** `%APPDATA%\Claude\logs\mcp*.log`
+
+```bash
+tail -f ~/Library/Logs/Claude/mcp*.log
+```
+
+## Next Steps
+
+
+
+
+ 
+
+
+From the CLI you can also inspect the stored entry directly:
+
+```bash
+codex mcp list # one row per server, with status and auth
+codex mcp get prowler # full entry, header values masked
+```
+
+
+
+
+## Troubleshooting
+
+### Startup Fails With HTTP 403 Forbidden
+
+Codex reports a handshake failure on startup, with an HTML error page rather than a JSON response:
+
+```
+⚠ MCP client for `prowler` failed to start: MCP startup failed: handshaking with MCP server
+ failed: ... unexpected server response: HTTP 403:
+ 
+
+ 
+
+ 
+
+
+## Step 4: Start Using Prowler MCP
+
+Open the chat panel and ask questions that use the Prowler tools:
+
+- *"Show me all critical findings from my AWS accounts"*
+- *"What does the S3 bucket public access check do?"*
+- *"Which of my providers failed the most CIS checks in the last scan?"*
+
+Cursor asks for approval before running an MCP tool the first time.
+
+
+ 
+
+
+You can toggle individual tools on or off from the tools list at the top of the chat panel, which is useful for keeping the active tool count down.
+
+## Troubleshooting
+
+### Server Does Not Connect
+
+- Check that `mcp.json` is valid JSON. A trailing comma or missing brace prevents the whole file from loading.
+- Open **MCP Logs** in the Output panel for the specific error.
+- Confirm the URL is exactly `https://mcp.prowler.com/mcp`.
+
+### Authentication Fails With 401
+
+- Verify the header value includes the `Bearer ` prefix: `"Bearer pk_..."`, not just the key.
+- Confirm the key has not been revoked in Prowler Cloud.
+- If using `${env:PROWLER_API_KEY}`, check the variable is set in the environment Cursor inherits. Restart Cursor after editing your shell profile — a value exported only in an already-open terminal will not reach the app.
+
+### The Entire `mcp.json` Is Ignored
+
+Remove any `"type": "streamable-http"` field. One such entry causes the Cursor CLI to drop every server in the file silently.
+
+### Some Prowler Tools Are Missing
+
+Cursor limits how many tools it exposes to the agent at once. With several MCP servers enabled you may exceed it, and some tools become unavailable. Disable servers you are not using, or turn off individual tools from the chat panel's tools list.
+
+## Next Steps
+
+
+
+ 
+
+ 
+
+
+Select the server to start, stop, or restart it, and to view its output log if the connection fails.
+
+## Step 4: Start Using Prowler MCP
+
+Open the Chat view and switch the mode selector to **Agent**. Click the tools icon to confirm the Prowler tools are available, then ask:
+
+- *"Show me all critical findings from my AWS accounts"*
+- *"What does the S3 bucket public access check do?"*
+- *"Summarize my CIS compliance status by provider"*
+
+
+ 
+
+
+Copilot asks for confirmation before running an MCP tool for the first time.
+
+## Troubleshooting
+
+### Server Does Not Appear
+
+- Confirm the root key is `servers`, not `mcpServers`.
+- Confirm each server entry has `"type": "http"`.
+- Check that `mcp.json` is valid JSON.
+- Verify your VS Code version is 1.102 or later.
+
+### Authentication Fails With 401
+
+- Verify the header value includes the `Bearer ` prefix.
+- Confirm the key has not been revoked in Prowler Cloud.
+- If you mistyped the key at the prompt, run **MCP: List Servers**, select `prowler`, and restart it to be prompted again.
+
+### Tools Do Not Appear in Chat
+
+- Make sure the Chat view is in **Agent** mode. MCP tools are not available in Ask mode.
+- Open the tools picker and confirm the Prowler tools are enabled.
+
+## Next Steps
+
+
-## Key Concepts
+## Step 1: Start the Organization Wizard
-### What Is an External ID?
-
-An **External ID** is a security token that Prowler generates unique to your tenant. When Prowler assumes the IAM role in your AWS account, it presents this External ID to prove its identity.
-
-This prevents the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html) — a scenario where an unauthorized party could trick AWS into granting access to your account. By requiring the External ID, only your specific Prowler tenant can assume the role.
-
-You don't need to create the External ID yourself — Prowler generates it automatically and displays it in the wizard for you to copy.
-
-### Two Roles Architecture
-
-Prowler requires **two separate IAM roles** deployed in different places, each with a distinct purpose:
-
-| Role | Where it lives | What it does | How to deploy it |
-|------|---------------|--------------|------------------|
-| **ProwlerScan** (management account) | Your management (root) account only | Discovers the Organization structure **and** scans the management account. Has additional Organizations discovery permissions. | By the wizard's **single stack** ([Step 4](#step-4-authenticate-with-your-management-account)), or on its own via **Quick Create** link or **manually** in the IAM Console ([Step 1](#step-1-create-the-management-account-role)). Cannot be deployed via StackSet. |
-| **ProwlerScan** (member accounts) | Every member account | Scans the account for security findings. | By the wizard's **single stack** ([Step 4](#step-4-authenticate-with-your-management-account)), or on its own via a **CloudFormation StackSet** ([Step 2](#step-2-deploy-the-cloudformation-stackset)). Automated across all accounts. |
-
-
- 
-
-
-
+
+
-
-
### Enter the Deployment Account Role ARN
-Paste the **Role ARN** created by the single stack above into the **Management Account Role ARN** field or, when delegated administrator mode is selected, the **Delegated Administrator Account Role ARN** field. If you deployed the management account role beforehand, use the role created in [Step 1](#step-1-create-the-management-account-role).
+Paste the **Role ARN** created by the stack above into the **Management Account Role ARN** field or, when delegated administrator mode is selected, the **Delegated Administrator Account Role ARN** field.
The ARN follows this format:
```
@@ -334,6 +130,10 @@ For example: `arn:aws:iam::123456789012:role/ProwlerScan`
+
-- Each account shows a real-time status indicator:
- - **Spinner** — test in progress
- - **Green checkmark (✓)** — connection successful
- - **Red icon (✗)** — connection failed (hover to see the error)
-
-### All Tests Pass
+Each account shows a real-time status indicator:
+- **Spinner** — test in progress
+- **Green checkmark (✓)** — connection successful
+- **Red icon (✗)** — connection failed (hover to see the error)
If every account connects successfully, you automatically advance to the next step.
-### Some Tests Fail
+### When Some Tests Fail
-An error banner appears: **"There was a problem connecting to some accounts."**
-
-You have two options:
+An error banner appears: **"There was a problem connecting to some accounts."** You have two options:
**a) Fix and retry:**
1. Go to the AWS Console and verify the StackSet deployed to the failing accounts.
2. Check that the External ID in the StackSet matches the one shown in Prowler.
3. Return to Prowler and click **Test Connections** — only the **failed accounts are re-tested** (smart retry). Accounts that already passed are not tested again.
-
- 
-
-
**b) Skip and continue:**
-Click **Skip Connection Validation** to proceed with only the accounts that connected successfully. The failed accounts will not be scanned.
+Click **Skip Connection Validation** to proceed with only the accounts that connected successfully. The failed accounts will not be scanned. This option is only available when at least one account connected successfully.
-
-### What Happens Next
-
+After launching:
- Scans appear in the **Scans** page as they start and complete.
- Results populate the **Overview** and **Findings** pages.
-- Prowler runs an **automatic sync every 6 hours** to detect new accounts added to your Organization or accounts that have been removed. New accounts are onboarded automatically based on the parent OU configuration.
+- Prowler runs an **automatic sync every 6 hours** to detect accounts added to or removed from your Organization. New accounts under the targeted OU or root are onboarded automatically.
## Billing Impact
Each AWS account you connect through the Organizations wizard counts as one **provider** in your Prowler Cloud subscription.
- **Already-connected accounts**: if an account was already linked as a provider, adding it to the organization does **not** incur additional billing. The existing provider is reused.
-- **Large organizations**: connecting a 500-account organization will result in up to 500 providers on your subscription. Review your plan limits before proceeding.
+- **Large organizations**: connecting a 500-account organization results in up to 500 providers on your subscription. Review your plan limits before proceeding.
- **Deleted providers**: if you later remove an account, the deleted provider no longer counts toward your subscription.
For pricing details, see [Prowler Cloud Pricing](https://prowler.com/pricing).
## Troubleshooting
-### Invalid AWS Organization ID
+### Only Some Accounts Connect
-*"Must be a valid AWS Organization ID"*
+Discovery succeeds and the tree view appears, but only one account — or a handful — passes the connection test. This almost always means the ProwlerScan role reached the deployment account but not every member account.
-- Verify the Organization ID format: `o-` followed by 10–32 lowercase alphanumeric characters (e.g., `o-abc123def4`)
-- Copy it directly from the [AWS Organizations Console](https://console.aws.amazon.com/organizations/) to avoid typos
+- **Confirm the StackSet deployed.** Open the [CloudFormation Console](https://console.aws.amazon.com/cloudformation/) in the deployment account, select your Prowler StackSet, open the **Stack instances** tab, and confirm every instance shows **Status: CURRENT** and **Stack status: CREATE_COMPLETE**. Instances still in progress or in a failed state explain the missing accounts.
+- **Check the targeted OU or root.** The single stack only rolls the role out to accounts under the **Organizational Unit or Root ID** you entered in [Step 2](#step-2-authenticate-with-your-management-account). Accounts in other OUs are not covered — redeploy targeting the organization root (`r-`) or add the missing OUs.
+- **Verify the deployment account.** The role is created only in the account where you launched the stack. If you deployed from a **delegated administrator account**, confirm that account is a **registered delegated administrator** for CloudFormation StackSets (registered through AWS Organizations), not just a regular member account. A regular member account cannot create a service-managed StackSet, so only its own role is created — leaving every other account without the role.
+- **Suspended accounts** cannot be scanned. Deselect them and proceed.
-### Invalid IAM Role ARN
+### No Accounts Connect
-*"Must be a valid IAM Role ARN"*
+No account passes the connection test.
-- Verify the ARN format: `arn:aws:iam::<12-digit-account-id>:role/
+
+
+### What Is a CloudFormation StackSet?
+
+A [CloudFormation StackSet](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html) deploys the same CloudFormation template across multiple AWS accounts in a single operation. Prowler uses a service-managed StackSet to deploy the **ProwlerScan** IAM role into every member account of your organization, so you don't create the role manually in each account. StackSets do not deploy to the management account, which is why that role is created separately.
## What's Next
diff --git a/mcp_server/CHANGELOG.md b/mcp_server/CHANGELOG.md
index ec0a2e354f..5898f816c9 100644
--- a/mcp_server/CHANGELOG.md
+++ b/mcp_server/CHANGELOG.md
@@ -4,6 +4,14 @@ All notable changes to the **Prowler MCP Server** are documented in this file.
+## [0.8.0] (Prowler v5.35.0)
+
+### 🔄 Changed
+
+- Core Prowler tool namespace from the `prowler_app_*` prefix to `prowler_*` [(#12017)](https://github.com/prowler-cloud/prowler/pull/12017)
+
+---
+
## [0.7.2] (Prowler v5.28.1)
### 🐞 Fixed
diff --git a/mcp_server/changelog.d/prowler-tools-namespace.changed.md b/mcp_server/changelog.d/prowler-tools-namespace.changed.md
deleted file mode 100644
index 0ca03d15ca..0000000000
--- a/mcp_server/changelog.d/prowler-tools-namespace.changed.md
+++ /dev/null
@@ -1 +0,0 @@
-Core Prowler tool namespace from the `prowler_app_*` prefix to `prowler_*`
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index e2f20c952f..408c76d3e1 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -4,6 +4,18 @@ All notable changes to the **Prowler SDK** are documented in this file.
+## [5.35.0] (Prowler v5.35.0)
+
+### 🚀 Added
+
+- `excluded_checks` and `excluded_services` in scan configurations to narrow the execution scope [(#12028)](https://github.com/prowler-cloud/prowler/pull/12028)
+
+### 🔐 Security
+
+- Jira tenant information requests validate site names and do not follow redirects [(#12012)](https://github.com/prowler-cloud/prowler/pull/12012)
+
+---
+
## [5.34.0] (Prowler v5.34.0)
### 🚀 Added
diff --git a/prowler/changelog.d/alibabacloud-security-group-policy-case.fixed.md b/prowler/changelog.d/alibabacloud-security-group-policy-case.fixed.md
new file mode 100644
index 0000000000..cef4ff076c
--- /dev/null
+++ b/prowler/changelog.d/alibabacloud-security-group-policy-case.fixed.md
@@ -0,0 +1 @@
+Alibaba Cloud SSH and RDP security group checks no longer produce false negatives when allowed rules use capitalized `Policy="Accept"` values
diff --git a/prowler/changelog.d/bucket-validation-syntaxwarning.fixed.md b/prowler/changelog.d/bucket-validation-syntaxwarning.fixed.md
new file mode 100644
index 0000000000..ceba09541c
--- /dev/null
+++ b/prowler/changelog.d/bucket-validation-syntaxwarning.fixed.md
@@ -0,0 +1 @@
+Fix invalid escape sequence `SyntaxWarning` raised on startup by the S3 bucket name validation regex
diff --git a/prowler/changelog.d/grouped-jira-dispatch.changed.md b/prowler/changelog.d/grouped-jira-dispatch.changed.md
new file mode 100644
index 0000000000..8dd2e43ab5
--- /dev/null
+++ b/prowler/changelog.d/grouped-jira-dispatch.changed.md
@@ -0,0 +1 @@
+Jira output rendering supports grouped Finding Group issues with caller-provided links and capped or uncapped finding copy
diff --git a/prowler/changelog.d/jira-tenant-info-request.security.md b/prowler/changelog.d/jira-tenant-info-request.security.md
deleted file mode 100644
index 270ba01bfc..0000000000
--- a/prowler/changelog.d/jira-tenant-info-request.security.md
+++ /dev/null
@@ -1 +0,0 @@
-Jira tenant information requests validate site names and do not follow redirects
diff --git a/prowler/changelog.d/sagemaker-notebook-no-secrets.added.md b/prowler/changelog.d/sagemaker-notebook-no-secrets.added.md
new file mode 100644
index 0000000000..4789aa6aaf
--- /dev/null
+++ b/prowler/changelog.d/sagemaker-notebook-no-secrets.added.md
@@ -0,0 +1 @@
+`sagemaker_notebook_instance_no_secrets` check for AWS provider, scanning SageMaker notebook instance lifecycle configuration scripts (`OnCreate` and `OnStart`) for hardcoded secrets such as API keys, passwords, tokens, and connection strings
diff --git a/prowler/config/config.py b/prowler/config/config.py
index c76f79910a..bee2984db3 100644
--- a/prowler/config/config.py
+++ b/prowler/config/config.py
@@ -49,7 +49,7 @@ class _MutableTimestamp:
timestamp = _MutableTimestamp(datetime.today())
timestamp_utc = _MutableTimestamp(datetime.now(timezone.utc))
-prowler_version = "5.35.0"
+prowler_version = "5.36.0"
html_logo_url = "https://github.com/prowler-cloud/prowler/"
square_logo_img = "https://raw.githubusercontent.com/prowler-cloud/prowler/dc7d2d5aeb92fdf12e8604f42ef6472cd3e8e889/docs/img/prowler-logo-black.png"
aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png"
diff --git a/prowler/config/scan_config_schema.py b/prowler/config/scan_config_schema.py
index ac00250c78..431c4cec60 100644
--- a/prowler/config/scan_config_schema.py
+++ b/prowler/config/scan_config_schema.py
@@ -9,21 +9,49 @@ The Prowler App, however, needs to surface those errors to the user when
they save a Scan Config from the UI, and to expose the schema as JSON so
the UI can validate live with `ajv`. This module provides:
-- `validate_scan_config(payload)` — STRICT: returns a list of
- `{path, message}` errors without silently dropping anything. The DRF
- serializer (`api/.../v1/serializers.py:validate_scan_config_payload`)
- turns each entry into a `ValidationError`.
+- `validate_and_normalize_scan_config(payload)` — STRICT: returns
+ ``(normalized, errors)``. When ``errors`` is non-empty the normalized
+ dictionary is empty so callers never persist a partially validated
+ configuration. On success the normalized payload is JSON-serializable
+ (`model_dump(mode="json", exclude_unset=True)`), so the API can store
+ it directly in a Django ``JSONField`` and consume it at scan time
+ without re-running schema validation.
+
+- `validate_scan_config(payload)` — thin backward-compatible wrapper that
+ returns only the validation errors, preserved for callers that don't
+ need the normalized payload.
- `SCAN_CONFIG_SCHEMA` — aggregated JSON Schema derived from the Pydantic
models via `model_json_schema()`. Served by the `/scan-configs/schema`
endpoint and consumed by the UI editor for in-editor live validation.
"""
+import json
+from functools import lru_cache
from typing import Any
from pydantic import ValidationError
from prowler.config.schema.registry import SCHEMAS
+from prowler.lib.check.check import list_services
+from prowler.lib.check.models import CheckMetadata
+
+# Pydantic v2 prefixes messages emitted from a ``field_validator`` that
+# raises ``ValueError`` with this string. Strip it so the message that
+# reaches the UI is the one the validator actually wrote.
+_PYDANTIC_VALUE_ERROR_PREFIX = "Value error, "
+
+
+@lru_cache(maxsize=None)
+def _get_provider_check_ids(provider: str) -> frozenset[str]:
+ """Return cached check identifiers for a provider."""
+ return frozenset(CheckMetadata.get_bulk(provider))
+
+
+@lru_cache(maxsize=None)
+def _get_provider_services(provider: str) -> frozenset[str]:
+ """Return cached service identifiers for a provider."""
+ return frozenset(list_services(provider))
def _format_loc(loc: tuple) -> str:
@@ -50,48 +78,145 @@ def _format_loc(loc: tuple) -> str:
return ".".join(parts) if parts else "
-
+
{
it("groups the Local Server navigation without losing available features", () => {
// Given
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ vi.stubEnv("UI_CLOUD_ENABLED", "false");
// When
const sections = getNavigationConfig({
@@ -71,7 +71,7 @@ describe("getNavigationConfig", () => {
it("models Local Server Cloud features as contextual upgrade actions", () => {
// Given
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ vi.stubEnv("UI_CLOUD_ENABLED", "false");
// When
const children = getConfigurationChildren();
@@ -108,7 +108,7 @@ describe("getNavigationConfig", () => {
it("uses Cloud destinations and current New badges", () => {
// Given
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ vi.stubEnv("UI_CLOUD_ENABLED", "true");
// When
const sections = getNavigationConfig({
@@ -148,7 +148,7 @@ describe("getNavigationConfig", () => {
it("keeps the Cloud Billing destination for users with billing permission", () => {
// Given
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ vi.stubEnv("UI_CLOUD_ENABLED", "true");
const permissions = {
manage_billing: true,
} as RolePermissionAttributes;
@@ -157,6 +157,7 @@ describe("getNavigationConfig", () => {
const billing = getNavigationConfig({
pathname: "/billing",
apiDocsUrl: null,
+ cloudBillingEnabled: true,
permissions,
})
.flatMap((section) => section.items)
@@ -177,29 +178,40 @@ describe("getNavigationConfig", () => {
const permissions = {
manage_billing: false,
} as RolePermissionAttributes;
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ vi.stubEnv("UI_CLOUD_ENABLED", "true");
// When
const cloudItems = getNavigationConfig({
pathname: "/",
apiDocsUrl: null,
+ cloudBillingEnabled: true,
permissions,
}).flatMap((section) => section.items);
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ const enterpriseItems = getNavigationConfig({
+ pathname: "/",
+ apiDocsUrl: null,
+ cloudBillingEnabled: false,
+ permissions: { ...permissions, manage_billing: true },
+ }).flatMap((section) => section.items);
+ vi.stubEnv("UI_CLOUD_ENABLED", "false");
const localItems = getNavigationConfig({
pathname: "/",
apiDocsUrl: null,
+ cloudBillingEnabled: true,
permissions: { ...permissions, manage_billing: true },
}).flatMap((section) => section.items);
// Then
expect(cloudItems.find((item) => item.label === "Billing")).toBeUndefined();
+ expect(
+ enterpriseItems.find((item) => item.label === "Billing"),
+ ).toBeUndefined();
expect(localItems.find((item) => item.label === "Billing")).toBeUndefined();
});
it("keeps environment-specific API documentation destinations", () => {
// Given
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ vi.stubEnv("UI_CLOUD_ENABLED", "false");
// When
const localApiReference = getNavigationConfig({
@@ -209,7 +221,7 @@ describe("getNavigationConfig", () => {
.flatMap((section) => section.items)
.find((item) => item.label === "API Reference");
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ vi.stubEnv("UI_CLOUD_ENABLED", "true");
const cloudApiReference = getNavigationConfig({
pathname: "/",
apiDocsUrl: "https://ignored.example/docs",
@@ -228,7 +240,7 @@ describe("getNavigationConfig", () => {
it("omits the Local Server API reference when no URL is configured", () => {
// Given
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ vi.stubEnv("UI_CLOUD_ENABLED", "false");
// When
const items = getNavigationConfig({
@@ -244,7 +256,7 @@ describe("getNavigationConfig", () => {
it("filters navigation by required permission after visible copy changes", () => {
// Given
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ vi.stubEnv("UI_CLOUD_ENABLED", "true");
const sections = getNavigationConfig({
pathname: "/integrations",
apiDocsUrl: null,
@@ -282,7 +294,7 @@ describe("getNavigationConfig", () => {
it("keeps navigation when the required permission is granted", () => {
// Given
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ vi.stubEnv("UI_CLOUD_ENABLED", "true");
const permissions = {
manage_integrations: true,
} as RolePermissionAttributes;
@@ -308,7 +320,7 @@ describe("getNavigationConfig", () => {
it("matches complete route segments without stealing nested settings routes", () => {
// Given
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ vi.stubEnv("UI_CLOUD_ENABLED", "false");
// When
const scanDetails = getNavigationConfig({
diff --git a/ui/components/layout/app-sidebar/navigation-config.ts b/ui/components/layout/app-sidebar/navigation-config.ts
index 40e15cb6e7..05ff31abae 100644
--- a/ui/components/layout/app-sidebar/navigation-config.ts
+++ b/ui/components/layout/app-sidebar/navigation-config.ts
@@ -31,6 +31,7 @@ import {
interface NavigationConfigOptions {
pathname: string;
apiDocsUrl?: string | null;
+ cloudBillingEnabled?: boolean;
permissions?: RolePermissionAttributes;
}
@@ -106,6 +107,7 @@ export function filterNavigationByPermissions(
export function getNavigationConfig({
pathname,
apiDocsUrl = null,
+ cloudBillingEnabled = false,
permissions,
}: NavigationConfigOptions): NavigationSection[] {
const isCloudEnvironment = isCloud();
@@ -265,7 +267,7 @@ export function getNavigationConfig({
},
],
},
- ...(isCloudEnvironment
+ ...(isCloudEnvironment && cloudBillingEnabled
? [
{
kind: NAVIGATION_ITEM_KIND.LINK,
diff --git a/ui/components/layout/nav-bar/navbar-client.test.tsx b/ui/components/layout/nav-bar/navbar-client.test.tsx
index c93ed3f6e5..5be780cc30 100644
--- a/ui/components/layout/nav-bar/navbar-client.test.tsx
+++ b/ui/components/layout/nav-bar/navbar-client.test.tsx
@@ -67,7 +67,7 @@ describe("NavbarClient", () => {
navigationMocks.searchParams = new URLSearchParams();
window.localStorage.clear();
// Replay icon is Cloud-only.
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+ vi.stubEnv("UI_CLOUD_ENABLED", "true");
// Default: the current route's content has loaded, so the icon is enabled.
usePageReadyStore.setState({ readyPath: "/findings" });
useSidePanelStore.setState({
@@ -223,7 +223,7 @@ describe("NavbarClient", () => {
});
it("hides the replay icon entirely in self-hosted (OSS) deployments", () => {
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ vi.stubEnv("UI_CLOUD_ENABLED", "false");
render(
{
it("hides the Lighthouse AI side-panel trigger in self-hosted (OSS) deployments", () => {
// Given
- vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+ vi.stubEnv("UI_CLOUD_ENABLED", "false");
// When
render(
1) Choose the AWS Organizational Unit (or root) - to deploy to. Prowler creates the role in your deployment + to deploy to. Prowler creates the IAM Role in your deployment account and rolls it out to every member account under this target.
@@ -422,7 +422,7 @@ export function OrgSetupForm({ to the whole organization, or an OU ID (starts withou-) to target a specific unit.
-
+
field.onChange(Boolean(checked))
@@ -438,10 +438,10 @@ export function OrgSetupForm({
/>
)}
@@ -454,12 +454,12 @@ export function OrgSetupForm({
2) Create the CloudFormation Stack in your{" "} {deploymentAccountName}. It deploys the - ProwlerScan role and a service-managed StackSet that rolls the - role out to your member accounts in one step. + ProwlerScan IAM Role and a service-managed StackSet that rolls + the IAM Role out to your member accounts in one step.
{orgQuickLink ? (