From 705600038fc6700aa806ab1f91f3c83e29ec3146 Mon Sep 17 00:00:00 2001 From: alejandrobailo Date: Thu, 16 Jul 2026 10:04:11 +0200 Subject: [PATCH] docs(aws): clarify organization deployment accounts --- docs/user-guide/providers/aws/organizations.mdx | 4 ++++ .../prowler-cloud-aws-organizations.mdx | 16 +++++++++------- 2 files changed, 13 insertions(+), 7 deletions(-) diff --git a/docs/user-guide/providers/aws/organizations.mdx b/docs/user-guide/providers/aws/organizations.mdx index 58fa36de43..b48df1c442 100644 --- a/docs/user-guide/providers/aws/organizations.mdx +++ b/docs/user-guide/providers/aws/organizations.mdx @@ -2,6 +2,8 @@ title: 'AWS Organizations in Prowler' --- +import { VersionBadge } from "/snippets/version-badge.mdx" + **Using Prowler Cloud?** You can onboard your entire AWS Organization through the UI with automatic account discovery, OU-aware tree selection, and bulk connection testing — no scripts or YAML files required. @@ -71,6 +73,8 @@ The additional fields in CSV header output are as follows: ## Deploying Prowler IAM Roles Across AWS Organizations + + When onboarding multiple AWS accounts into Prowler Cloud, it is important to deploy the Prowler Scan IAM Role in each account. The most efficient way to do this across an AWS Organization is by leveraging AWS CloudFormation StackSets, which rolls out infrastructure—like IAM roles—to all accounts centrally from the Management or Delegated Admin account. ### Native CloudFormation StackSet Deployment (Recommended) diff --git a/docs/user-guide/tutorials/prowler-cloud-aws-organizations.mdx b/docs/user-guide/tutorials/prowler-cloud-aws-organizations.mdx index 5c8eedffbe..717bbdfc0e 100644 --- a/docs/user-guide/tutorials/prowler-cloud-aws-organizations.mdx +++ b/docs/user-guide/tutorials/prowler-cloud-aws-organizations.mdx @@ -282,7 +282,7 @@ Click **Next** to proceed to the authentication phase. ## Step 4: Authenticate with Your Management Account -The wizard's **Authentication Details** page guides you through three actions: deploying the roles in AWS, entering the management account Role ARN, and confirming the deployment. +The wizard's **Authentication Details** page guides you through three actions: deploying the roles in AWS, entering the deployment account Role ARN, and confirming the deployment. The deployment account is either the management account or, when delegated administrator mode is selected, the delegated administrator account. ### External ID @@ -290,13 +290,15 @@ The wizard displays a **Prowler External ID** at the top — auto-generated and ### Deploy the Roles -The wizard deploys the management account role and the member-account StackSet in a **single** CloudFormation Stack: + + +The wizard deploys the deployment account role and the member-account StackSet in a **single** CloudFormation Stack: 1. **Organizational Unit or Root ID** — enter the AWS OU (`ou-xxxx-yyyyyyyy`) or organization root (`r-xxxx`) you want to onboard. Prowler rolls the ProwlerScan role out to every member account under this target. Find it in the [AWS Organizations Console](https://console.aws.amazon.com/organizations/); use the **root ID** (`r-`) to cover the entire organization or an **OU ID** (`ou-`) to target a specific unit. 2. *(Optional)* Check **"I'm deploying from a delegated administrator account"** if you launch the stack from a delegated administrator account instead of the management account. -3. **Create Stack in Management Account** — opens a Quick Create link that deploys, in a single stack: the ProwlerScan role in your management account (`DeployLocalRole`, with `EnableOrganizations=true`) **and** a service-managed StackSet (`DeployStackSet`) that rolls the role out to your member accounts. The External ID, OU/Root ID, and deployment options are pre-filled. +3. **Create Stack in Management Account** — or **Create Stack in Delegated Administrator Account** when delegated administrator mode is selected — opens a Quick Create link that deploys, in a single stack: the ProwlerScan role in the account where you launch the stack (`DeployLocalRole`, with `EnableOrganizations=true`) **and** a service-managed StackSet (`DeployStackSet`) that rolls the role out to your member accounts. The External ID, OU/Root ID, and deployment options are pre-filled. **Finding your Organizational Unit or Root ID.** In the [AWS Organizations Console](https://console.aws.amazon.com/organizations/) the root (`r-…`) and OU (`ou-…`) IDs appear in the account tree, or run these from your management account: @@ -314,12 +316,12 @@ If you deploy the CloudFormation template manually (instead of via the wizard li - Authentication Details form showing External ID, Organizational Unit or Root ID field, delegated administrator checkbox, the Create Stack in Management Account button, Management Account Role ARN field, and deployment confirmation checkbox + Authentication Details form showing External ID, Organizational Unit or Root ID field, delegated administrator checkbox, deployment account stack button, deployment account Role ARN field, and deployment confirmation checkbox -### Enter the Management Account Role ARN +### Enter the Deployment Account Role ARN -Paste the **Role ARN** of the management account role — created by the single stack above, or beforehand in [Step 1](#step-1-create-the-management-account-role) — into the **Management Account Role ARN** field. +Paste the **Role ARN** created by the single stack above into the **Management Account Role ARN** field or, when delegated administrator mode is selected, the **Delegated Administrator Account Role ARN** field. If you deployed the management account role beforehand, use the role created in [Step 1](#step-1-create-the-management-account-role). The ARN follows this format: ``` @@ -329,7 +331,7 @@ arn:aws:iam:::role/ProwlerScan For example: `arn:aws:iam::123456789012:role/ProwlerScan` - Management Account Role ARN field in the Authentication Details form + Deployment account Role ARN field in the Authentication Details form ### Confirm and Discover