docs: add onboarding information step by step for each provider (#7362)

2026-07-24 04:51:51 +00:00 · 2025-04-04 13:00:43 +02:00
parent 0fd395ea83
commit 44174526d6
82 changed files with 499 additions and 4 deletions
@@ -0,0 +1,214 @@
+# Getting Started with AWS on Prowler Cloud
+
+<iframe width="560" height="380" src="https://www.youtube-nocookie.com/embed/RPgIWOCERzY" title="Prowler Cloud Onboarding AWS" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="1"></iframe>
+
+Set up your AWS account to enable security scanning using Prowler Cloud.
+
+## Requirements
+
+To configure your AWS account, you’ll need:
+
+1. Access to Prowler Cloud
+2. Properly configured AWS credentials (either static or via an assumed IAM role)
+
+---
+
+## Step 1: Get Your AWS Account ID
+
+1. Log in to the [AWS Console](https://console.aws.amazon.com)
+2. Locate your AWS account ID in the top-right dropdown menu
+
+![Account ID detail](./img/aws-account-id.png)
+
+---
+
+## Step 2: Access Prowler Cloud
+
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/)
+2. Go to `Configuration` > `Cloud Providers`
+
+    ![Cloud Providers Page](../img/cloud-providers-page.png)
+
+3. Click `Add Cloud Provider`
+
+    ![Add a Cloud Provider](../img/add-cloud-provider.png)
+
+4. Select `Amazon Web Services`
+
+    ![Select AWS Provider](./img/select-aws.png)
+
+5. Enter your AWS Account ID and optionally provide a friendly alias
+
+    ![Add account ID](./img/add-account-id.png)
+
+6. Choose your preferred authentication method (next step)
+
+    ![Select auth method](./img/select-auth-method.png)
+
+---
+
+## Step 3: Set Up AWS Authentication
+
+Before proceeding, choose your preferred authentication mode:
+
+Credentials
+
+* Quick scan as current user ✅
+* No extra setup ✅
+* Credentials time out ❌
+
+Assumed Role
+
+* Preferred Setup ✅
+* Permanent Credentials ✅
+* Requires access to create role ❌
+
+---
+
+### 🔐 Assume Role (Recommended)
+
+![Assume Role Overview](./img/assume-role-overview.png)
+
+This method grants permanent access and is the recommended setup for production environments.
+
+=== "CloudFormation"
+
+    1. Download the [Prowler Scan Role Template](https://raw.githubusercontent.com/prowler-cloud/prowler/refs/heads/master/permissions/templates/cloudformation/prowler-scan-role.yml)
+
+        ![Prowler Scan Role Template](./img/prowler-scan-role-template.png)
+
+        ![Download Role Template](./img/download-role-template.png)
+
+    2. Open the [AWS Console](https://console.aws.amazon.com), search for **CloudFormation**
+
+        ![CloudFormation Search](./img/cloudformation-nav.png)
+
+    3. Go to **Stacks** and click `Create stack` > `With new resources (standard)`
+
+        ![Create Stack](./img/create-stack.png)
+
+    4. In **Specify Template**, choose `Upload a template file` and select the downloaded file
+
+        ![Upload a template file](./img/upload-template-file.png)
+        ![Upload file from downloads](./img/upload-template-from-downloads.png)
+
+    5. Click `Next`, provide a stack name and the **External ID** shown in the Prowler Cloud setup screen
+
+        ![External ID](./img/prowler-cloud-external-id.png)
+        ![Stack Data](./img/fill-stack-data.png)
+
+    6. Acknowledge the IAM resource creation warning and proceed
+
+        ![Stack Creation Second Step](./img/stack-creation-second-step.png)
+
+    7. Click `Submit` to deploy the stack
+
+        ![Click on submit](./img/submit-third-page.png)
+
+=== "Terraform"
+
+    To provision the scan role using Terraform:
+
+    1. Run the following commands:
+
+        ```bash
+        terraform init
+        terraform plan
+        terraform apply
+        ```
+
+    2. During `plan` and `apply`, you will be prompted for the **External ID**, which is available in the Prowler Cloud UI:
+
+        ![Get External ID](./img/get-external-id-prowler-cloud.png)
+
+    > 💡 Note: Terraform will use the AWS credentials of your default profile.
+
+---
+
+### Finish Setup with Assume Role
+
+8. Once the role is created, go to the **IAM Console**, click on the `ProwlerScan` role to open its details:
+
+    ![ProwlerScan role info](./img/prowler-scan-pre-info.png)
+
+9. Copy the **Role ARN**
+
+    ![New Role Info](./img/get-role-arn.png)
+
+10. Paste the ARN into the corresponding field in Prowler Cloud
+
+    ![Input the Role ARN](./img/paste-role-arn-prowler.png)
+
+11. Click `Next`, then `Launch Scan`
+
+    ![Next button in Prowler Cloud](./img/next-button-prowler-cloud.png)
+    ![Launch Scan](./img/launch-scan-button-prowler-cloud.png)
+
+---
+
+### 🔑 Credentials (Static Access Keys)
+
+You can also configure your AWS account using static credentials (not recommended for long-term use):
+
+![Connect via credentials](./img/connect-via-credentials.png)
+
+=== "Long term credentials"
+
+    1. Go to the [AWS Console](https://console.aws.amazon.com), open **CloudShell**
+
+        ![AWS CloudShell](./img/aws-cloudshell.png)
+
+    2. Run:
+
+        ```bash
+        aws iam create-access-key
+        ```
+
+    3. Copy the output containing:
+
+        - `AccessKeyId`
+        - `SecretAccessKey`
+
+        ![CloudShell Output](./img/cloudshell-output.png)
+
+    > ⚠️ Save these credentials securely and paste them into the Prowler Cloud setup screen.
+
+=== "Short term credentials (Recommended)"
+
+    You can use your [AWS Access Portal](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtogetcredentials.html) or the CLI:
+
+    1. Retrieve short-term credentials for the IAM identity using this command:
+
+        ```bash
+        aws sts get-session-token --duration-seconds 900
+        ```
+
+        ???+ note
+            Check the aws documentation [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/sts_example_sts_GetSessionToken_section.html)
+
+    2. Copy the output containing:
+
+        - `AccessKeyId`
+        - `SecretAccessKey`
+
+        > Sample output:
+            ```json
+            {
+                "Credentials": {
+                    "AccessKeyId": "ASIAIOSFODNN7EXAMPLE",
+                    "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY",
+                    "SessionToken": "AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAE",
+                    "Expiration": "2020-05-19T18:06:10+00:00"
+                }
+            }
+            ```
+
+    > ⚠️ Save these credentials securely and paste them into the Prowler Cloud setup screen.
+
+Complete the form in Prowler Cloud and click `Next`
+
+![Filled credentials page](./img/prowler-cloud-credentials-next.png)
+
+Click `Launch Scan`
+
+![Launch Scan](./img/launch-scan-button-prowler-cloud.png)
@@ -0,0 +1,171 @@
+# Getting Started with Azure on Prowler Cloud
+
+<iframe width="560" height="380" src="https://www.youtube-nocookie.com/embed/v1as8vTFlMg" title="Prowler Cloud Onboarding Azure" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="1"></iframe>
+
+Set up your Azure subscription to enable security scanning using Prowler Cloud.
+
+## Requirements
+
+To configure your Azure subscription, you’ll need:
+
+1. Get the `Subscription ID`
+2. Access to Prowler Cloud
+3. Configure authentication in Azure:
+
+    3.1 Create a Service Principal
+
+    3.2 Assign required permissions
+
+    3.3 Assign permissions at the subscription level
+
+4. Add the credentials to Prowler Cloud
+
+---
+
+## Step 1: Get the Subscription ID
+
+1. Go to the [Azure Portal](https://portal.azure.com/#home) and search for `Subscriptions`
+2. Locate and copy your Subscription ID
+
+    ![Search Subscription](./img/search-subscriptions.png)
+    ![Subscriptions Page](./img/get-subscription-id.png)
+
+---
+
+## Step 2: Access Prowler Cloud
+
+1. Go to [Prowler Cloud](https://cloud.prowler.com/)
+2. Navigate to `Configuration` > `Cloud Providers`
+
+    ![Cloud Providers Page](../img/cloud-providers-page.png)
+
+3. Click on `Add Cloud Provider`
+
+    ![Add a Cloud Provider](../img/add-cloud-provider.png)
+
+4. Select `Microsoft Azure`
+
+    ![Select Microsoft Azure](./img/select-azure-prowler-cloud.png)
+
+5. Add the Subscription ID and an optional alias, then click `Next`
+
+    ![Add Subscription ID](./img/add-subscription-id.png)
+
+---
+
+## Step 3: Configure the Azure Subscription
+
+### Create the Service Principal
+
+A Service Principal is required to grant Prowler the necessary privileges.
+
+1. Access **Microsoft Entra ID**
+
+    ![Search Microsoft Entra ID](./img/search-microsoft-entra-id.png)
+
+2. Navigate to `Manage` > `App registrations`
+
+    ![App Registration nav](./img/app-registration-menu.png)
+
+3. Click `+ New registration`, complete the form, and click `Register`
+
+    ![New Registration](./img/new-registration.png)
+
+4. Go to `Certificates & secrets` > `+ New client secret`
+
+    ![Certificate & Secrets nav](./img/certificates-and-secrets.png)
+    ![New Client Secret](./img/new-client-secret.png)
+
+5. Fill in the required fields and click `Add`, then copy the generated value
+
+| Value | Description |
+|-------|-------------|
+| Client ID | Application ID |
+| Client Secret | AZURE_CLIENT_SECRET |
+| Tenant ID | Azure Active Directory tenant ID |
+
+---
+
+### Assign Required API Permissions
+
+Assign the following Microsoft Graph permissions:
+
+    - Directory.Read.All
+
+    - Policy.Read.All
+
+    - UserAuthenticationMethod.Read.All (optional, for MFA checks)
+
+1. Go to your App Registration > `API permissions`
+
+    ![API Permission Page](./img/api-permissions-page.png)
+
+2. Click `+ Add a permission` > `Microsoft Graph` > `Application permissions`
+
+    ![Add API Permission](./img/add-api-permission.png)
+    ![Microsoft Graph Detail](./img/microsoft-graph-detail.png)
+
+3. Search and select:
+
+    - `Directory.Read.All`
+    - `Policy.Read.All`
+    - `UserAuthenticationMethod.Read.All`
+
+    ![Permission Screenshots](./img/directory-permission.png)
+
+4. Click `Add permissions`, then grant admin consent
+
+    ![Grant Admin Consent](./img/grant-admin-consent.png)
+
+---
+
+### Assign Permissions at the Subscription Level
+
+1. Download the [Prowler Azure Custom Role](https://github.com/prowler-cloud/prowler/blob/master/permissions/prowler-azure-custom-role.json)
+
+    ![Azure Custom Role](./img/download-prowler-role.png)
+
+2. Modify `assignableScopes` to match your Subscription ID (e.g. `/subscriptions/xxxx-xxxx-xxxx-xxxx`)
+
+3. Go to your Azure Subscription > `Access control (IAM)`
+
+    ![IAM Page](./img/iam-azure-page.png)
+
+4. Click `+ Add` > `Add custom role`, choose "Start from JSON" and upload the modified file
+
+    ![Add custom role via JSON](./img/add-custom-role-json.png)
+
+5. Click `Review + Create` to finish
+
+    ![Select review and create](./img/review-and-create.png)
+
+6. Return to `Access control (IAM)` > `+ Add` > `Add role assignment`
+
+    - Assign the `Reader` role
+    - Then repeat and assign the custom `ProwlerRole`
+
+    ![Role Assignment](./img/add-role-assigment.png)
+
+---
+
+## Step 4: Add Credentials to Prowler Cloud
+
+1. Go to your App Registration overview and copy the `Client ID` and `Tenant ID`
+
+    ![App Overview](./img/app-overview.png)
+
+2. Go to Prowler Cloud and paste:
+
+    - `Client ID`
+    - `Tenant ID`
+    - `AZURE_CLIENT_SECRET` from earlier
+
+    ![Prowler Cloud Azure Credentials](./img/add-credentials-azure-prowler-cloud.png)
+
+3. Click `Next`
+
+    ![Next Detail](./img/click-next-azure.png)
+
+4. Click `Launch Scan`
+
+    ![Launch Scan Azure](./img/launch-scan.png)
@@ -0,0 +1,107 @@
+# Getting Started with GCP on Prowler Cloud
+
+<iframe width="560" height="380" src="https://www.youtube-nocookie.com/embed/v1as8vTFlMg" title="Prowler Cloud Onboarding GCP" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="1"></iframe>
+
+Set up your GCP project to enable security scanning using Prowler Cloud.
+
+## Requirements
+
+To configure your GCP project, you’ll need:
+
+1. Get the `Project ID`
+2. Access to Prowler Cloud
+3. Configure authentication in GCP:
+
+    3.1 Retrieve credentials from Google Cloud
+
+4. Add the credentials to Prowler Cloud
+
+---
+
+## Step 1: Get the Project ID
+
+1. Go to the [GCP Console](https://console.cloud.google.com/)
+2. Locate your Project ID on the welcome screen
+
+![Get the Project ID](./img/project-id-console.png)
+
+---
+
+## Step 2: Access Prowler Cloud
+
+1. Go to [Prowler Cloud](https://cloud.prowler.com/)
+2. Navigate to `Configuration` > `Cloud Providers`
+
+    ![Cloud Providers Page](../img/cloud-providers-page.png)
+
+3. Click `Add Cloud Provider`
+
+    ![Add a Cloud Provider](../img/add-cloud-provider.png)
+
+4. Select `Google Cloud Platform`
+
+    ![Select GCP](./img/select-gcp.png)
+
+5. Add the Project ID and optionally provide a provider alias, then click `Next`
+
+    ![Add Project ID](./img/add-project-id.png)
+
+---
+
+## Step 3: Configure Authentication in GCP
+
+### Retrieve Credentials from Google Cloud
+
+1. In the [GCP Console](https://console.cloud.google.com/), click on `Activate Cloud Shell`
+
+    ![Activate Cloud Shell](./img/access-console.png)
+
+2. Click `Authorize Cloud Shell`
+
+    ![Authorize Cloud Shell](./img/authorize-cloud-shell.png)
+
+3. Run the following command:
+
+    ```bash
+    gcloud auth application-default login
+    ```
+
+    - Type `Y` when prompted
+
+    ![Run Gcloud Auth](./img/run-gcloud-auth.png)
+
+4. Open the authentication URL provided in a browser and select your Google account
+
+    ![Choose the account](./img/take-account-email.png)
+
+5. Follow the steps to obtain the authentication code
+
+    ![Copy auth code](./img/copy-auth-code.png)
+
+6. Paste the authentication code back in Cloud Shell
+
+    ![Enter Auth Code](./img/enter-auth-code.png)
+
+7. Use `cat <file_name>` to view the temporary credentials file
+
+    ![Get the FileName](./img/get-temp-file-credentials.png)
+
+8. Extract the following values for Prowler Cloud:
+
+    - `client_id`
+    - `client_secret`
+    - `refresh_token`
+
+    ![Get the values](./img/get-needed-values-auth.png)
+
+---
+
+## Step 4: Add Credentials to Prowler Cloud
+
+1. Go back to Prowler Cloud and enter the required credentials, then click `Next`
+
+    ![Enter the Credentials](./img/enter-credentials-prowler-cloud.png)
+
+2. Click `Launch Scan` to begin scanning your GCP environment
+
+    ![Launch Scan GCP](./img/launch-scan.png)
@@ -34,10 +34,10 @@ theme:
        icon: material/weather-sunny
        name: Switch to light mode

-plugins:
-  - search
-  - git-revision-date-localized:
-      enable_creation_date: true
+# plugins:
+#   - search
+#   - git-revision-date-localized:
+#       enable_creation_date: true

 edit_uri: "https://github.com/prowler-cloud/prowler/tree/master/docs"
 # Prowler OSS Repository
@@ -72,6 +72,7 @@ nav:
          - Developer Guide: developer-guide/introduction.md
          - Prowler Check Kreator: tutorials/prowler-check-kreator.md
      - AWS:
+          - Getting Started: tutorials/aws/getting-started-aws.md
          - Authentication: tutorials/aws/authentication.md
          - Assume Role: tutorials/aws/role-assumption.md
          - AWS Security Hub: tutorials/aws/securityhub.md
@@ -86,11 +87,13 @@ nav:
          - Boto3 Configuration: tutorials/aws/boto3-configuration.md
          - Threat Detection: tutorials/aws/threat-detection.md
      - Azure:
+          - Getting Started: tutorials/azure/getting-started-azure.md
          - Authentication: tutorials/azure/authentication.md
          - Non default clouds: tutorials/azure/use-non-default-cloud.md
          - Subscriptions: tutorials/azure/subscriptions.md
          - Create Prowler Service Principal: tutorials/azure/create-prowler-service-principal.md
      - Google Cloud:
+          - Getting Started: tutorials/gcp/getting-started-gcp.md
          - Authentication: tutorials/gcp/authentication.md
          - Projects: tutorials/gcp/projects.md
          - Organization: tutorials/gcp/organization.md