diff --git a/docs/tutorials/img/rbac/invitation_details.png b/docs/tutorials/img/rbac/invitation_details.png new file mode 100644 index 0000000000..656a698308 Binary files /dev/null and b/docs/tutorials/img/rbac/invitation_details.png differ diff --git a/docs/tutorials/img/rbac/invitation_details_1.png b/docs/tutorials/img/rbac/invitation_details_1.png new file mode 100644 index 0000000000..e167db74af Binary files /dev/null and b/docs/tutorials/img/rbac/invitation_details_1.png differ diff --git a/docs/tutorials/img/rbac/invitation_edit.png b/docs/tutorials/img/rbac/invitation_edit.png new file mode 100644 index 0000000000..ef3d81f192 Binary files /dev/null and b/docs/tutorials/img/rbac/invitation_edit.png differ diff --git a/docs/tutorials/img/rbac/invitation_edit_1.png b/docs/tutorials/img/rbac/invitation_edit_1.png new file mode 100644 index 0000000000..6d1a1d2223 Binary files /dev/null and b/docs/tutorials/img/rbac/invitation_edit_1.png differ diff --git a/docs/tutorials/img/rbac/invitation_info.png b/docs/tutorials/img/rbac/invitation_info.png new file mode 100644 index 0000000000..a6ec05f976 Binary files /dev/null and b/docs/tutorials/img/rbac/invitation_info.png differ diff --git a/docs/tutorials/img/rbac/invitation_revoke.png b/docs/tutorials/img/rbac/invitation_revoke.png new file mode 100644 index 0000000000..6c4e042c16 Binary files /dev/null and b/docs/tutorials/img/rbac/invitation_revoke.png differ diff --git a/docs/tutorials/img/rbac/invitation_sign-up.png b/docs/tutorials/img/rbac/invitation_sign-up.png new file mode 100644 index 0000000000..f5b67a7762 Binary files /dev/null and b/docs/tutorials/img/rbac/invitation_sign-up.png differ diff --git a/docs/tutorials/img/rbac/invite.png b/docs/tutorials/img/rbac/invite.png new file mode 100644 index 0000000000..dd60aba314 Binary files /dev/null and b/docs/tutorials/img/rbac/invite.png differ diff --git a/docs/tutorials/img/rbac/membership.png b/docs/tutorials/img/rbac/membership.png new file mode 100644 index 0000000000..e2b96e40f5 Binary files /dev/null and b/docs/tutorials/img/rbac/membership.png differ diff --git a/docs/tutorials/img/rbac/provider_group.png b/docs/tutorials/img/rbac/provider_group.png new file mode 100644 index 0000000000..878306e02f Binary files /dev/null and b/docs/tutorials/img/rbac/provider_group.png differ diff --git a/docs/tutorials/img/rbac/provider_group_edit.png b/docs/tutorials/img/rbac/provider_group_edit.png new file mode 100644 index 0000000000..5de9649578 Binary files /dev/null and b/docs/tutorials/img/rbac/provider_group_edit.png differ diff --git a/docs/tutorials/img/rbac/provider_group_edit_1.png b/docs/tutorials/img/rbac/provider_group_edit_1.png new file mode 100644 index 0000000000..ed4a090eed Binary files /dev/null and b/docs/tutorials/img/rbac/provider_group_edit_1.png differ diff --git a/docs/tutorials/img/rbac/provider_group_remove.png b/docs/tutorials/img/rbac/provider_group_remove.png new file mode 100644 index 0000000000..580a8533cf Binary files /dev/null and b/docs/tutorials/img/rbac/provider_group_remove.png differ diff --git a/docs/tutorials/img/rbac/role_create.png b/docs/tutorials/img/rbac/role_create.png new file mode 100644 index 0000000000..8dc270f209 Binary files /dev/null and b/docs/tutorials/img/rbac/role_create.png differ diff --git a/docs/tutorials/img/rbac/role_create_1.png b/docs/tutorials/img/rbac/role_create_1.png new file mode 100644 index 0000000000..a96b0ac9ef Binary files /dev/null and b/docs/tutorials/img/rbac/role_create_1.png differ diff --git a/docs/tutorials/img/rbac/role_edit.png b/docs/tutorials/img/rbac/role_edit.png new file mode 100644 index 0000000000..775b4b8562 Binary files /dev/null and b/docs/tutorials/img/rbac/role_edit.png differ diff --git a/docs/tutorials/img/rbac/role_edit_details.png b/docs/tutorials/img/rbac/role_edit_details.png new file mode 100644 index 0000000000..6170f210b1 Binary files /dev/null and b/docs/tutorials/img/rbac/role_edit_details.png differ diff --git a/docs/tutorials/img/rbac/role_remove.png b/docs/tutorials/img/rbac/role_remove.png new file mode 100644 index 0000000000..613f770bd4 Binary files /dev/null and b/docs/tutorials/img/rbac/role_remove.png differ diff --git a/docs/tutorials/img/rbac/user_edit.png b/docs/tutorials/img/rbac/user_edit.png new file mode 100644 index 0000000000..421ea93156 Binary files /dev/null and b/docs/tutorials/img/rbac/user_edit.png differ diff --git a/docs/tutorials/img/rbac/user_edit_details.png b/docs/tutorials/img/rbac/user_edit_details.png new file mode 100644 index 0000000000..3e4734f142 Binary files /dev/null and b/docs/tutorials/img/rbac/user_edit_details.png differ diff --git a/docs/tutorials/img/rbac/user_remove.png b/docs/tutorials/img/rbac/user_remove.png new file mode 100644 index 0000000000..4c368ded66 Binary files /dev/null and b/docs/tutorials/img/rbac/user_remove.png differ diff --git a/docs/tutorials/prowler-app-rbac.md b/docs/tutorials/prowler-app-rbac.md new file mode 100644 index 0000000000..5532cda094 --- /dev/null +++ b/docs/tutorials/prowler-app-rbac.md @@ -0,0 +1,191 @@ +# Managing Users and Roles + +The **Prowler App** supports multiple users within a single tenant, enabling seamless collaboration by allowing team members to easily share insights and manage security findings. + +[Roles](#roles) help you control user permissions, determining what actions each user can perform and the data they can access within Prowler. By default, each account includes an immutable **admin** role, ensuring that your account always retains administrative access. + +## Membership + +To get to User-Invitation Management we will focus on the Membership section. + +???+ note + **Only users that have the _Invite and Manage Users_ or _admin_ permission can access this section.** + +Membership tab + +### Users + +#### Editing a User + +Follow these steps to edit a user of your account: + +1. Navigate to **Users** from the side menu. +2. Click on the edit button of the user you want to modify. + + Edit User + +3. Edit the user fields you need and save your changes. + + Edit User Details + +#### Removing a User + +Follow these steps to remove a user of your account: + +1. Navigate to **Users** from the side menu. +2. Click on the delete button of your current user. +> **Note: Each user will be able to delete himself and not others, regardless of his permissions.** + + Remove User + +### Invitations + +#### Inviting Users + +???+note + _Please be aware that at this time, an email address can only be associated with a single Prowler account._ + +Follow these steps to invite a user to your account: + +1. Navigate to **Users** from the side menu. +2. Click on the **Invite User** button on the top right-hand corner of the screen. + + Invite User + +3. In the Invite User screen, enter the email address of the user you want to invite. +4. Pick a Role for the user. You can also change the roles for users and pending invites later. To learn more about the roles and what they can do, see [Roles](#roles). + + Invitation info + +5. Click on the **Send Invitation** button to send the invitation to the user. +6. After clicking you will see a summary of the status of the invitation. You could access this view again from the invitation menu. + + Invitation details + Invitation button + +7. To allow the user to join your Prowler account you will need to share the link with the user. They will only need to access this URL and follow the steps to create a user and complete their registration. **Note: Invitations will expire after 7 days.** + + Invitation sign-up + +???+note + If you are a [Prowler Cloud](https://cloud.prowler.com/sign-in) user, the invited user will receive an email with the link to accept the invitation. + +#### Editing Invitation + +Follow these steps to edit an invitation: + +1. Navigate to **Invitations** from the side menu. +2. Click on the edit button of the invitation and modify the email, the role or both. **Note: Editing an invitation will not reset its expiration time.** + + Invitation edit + Invitation edit details + +#### Cancelling Invitation + +Follow these steps to cancel an invitation: + +1. Navigate to **Invitations** from the side menu. +2. Click on the revoke button of the invitation. + + Invitation revoke + +#### Sending Invitation Again + +To resend the invitation to the user it is necessary to explicitly **delete the previous invitation and create a new invitation**. + +## Managing Groups and Roles + +The Roles section in Prowler is designed to facilitate the assignment of custom user privileges. This section allows administrators to define roles with specific permissions for Prowler administrative tasks and Account visibility. + +???+ note + **Only users that have the _Manage Account_ or _admin_ permission can access this section.** + +### Provider Groups + +Provider Groups control visibility across specific providers. When creating a new role, you can assign specific groups to define their Cloud Provider visibility. This ensures that users with that role have access only to the Cloud Providers that are required. + +By default, a new user role does not have visibility into any group. + +Alternatively, to grant the role unlimited visibility across all providers, check the Grant Unlimited Visibility checkbox. + +#### Creating a Provider Group + +Follow these steps to create a provider group in your account: + +1. 1. Navigate to **Provider Groups** from the side menu.. +2. In this view you can select the provider groups you want to assign to one or more roles. +3. Click on the **Create Group** button on the center of the screen. + + Create Provider Group + +#### Editing a Provider Group + +Follow these steps to edit a provider group on your account: + +1. 1. Navigate to **Provider Groups** from the side menu.. +2. Click on the edit button of the provider group you want to modify. + + Edit Provider Group + +3. Change the provider group parameters you need and save the changes. + + Edit Provider Group Details + +#### Removing a Provider Group + +Follow these steps to remove a provider group of your account: + +1. 1. Navigate to **Provider Groups** from the side menu.. +2. Click on the delete button of the provider group you want to remove. + + Remove Provider Group + +### Roles + +#### Creating a Role + +Follow these steps to create a role for your account: + +1. Navigate to **Roles** from the side menu. +2. Click on the **Add Role** button on the top right-hand corner of the screen. + + Create Role + +3. In the Add Role screen, enter the role name, the administration permissions and the groups of providers to which the Role will have access to. +4. In the Groups and Account Visibility section, you will see a list of available groups with checkboxes next to them. To assign a group to the user role, simply click the checkbox next to the group name. If you need to assign multiple groups, repeat the process for each group you wish to add. + + Role parameters + +#### Editing a Role + +Follow these steps to edit a role on your account: + +1. Navigate to **Roles** from the side menu. +2. Click on the edit button of the role you want to modify. + + Edit Role + +3. Adjust the settings as needed and save the changes. + + Edit Role Details + +#### Removing a Role + +Follow these steps to remove a role of your account: + +1. Navigate to **Roles** from the side menu. +2. Click on the delete button of the role you want to remove. + + Remove Role + +## RBAC Administrative Permissions + +Assign administrative permissions by selecting from the following options: + +**Invite and Manage Users:** Invite new users and manage existing ones.
+**Manage Account:** Adjust account settings and delete users.
+**Manage Scans:** Run and review scans.
+**Manage Cloud Providers:** Add or modify connected cloud providers.
+**Manage Integrations:** Add or modify the Prowler Integrations. + +To grant all administrative permissions, select the **Grant all admin permissions** option. diff --git a/mkdocs.yml b/mkdocs.yml index 6d99d72afd..a2fa253e4e 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -49,24 +49,27 @@ nav: - Overview: index.md - Requirements: getting-started/requirements.md - Tutorials: - - Prowler App: tutorials/prowler-app.md - - Miscellaneous: tutorials/misc.md - - Reporting: tutorials/reporting.md - - Compliance: tutorials/compliance.md - - Dashboard: tutorials/dashboard.md - - Fixer (remediations): tutorials/fixer.md - - Quick Inventory: tutorials/quick-inventory.md - - Slack Integration: tutorials/integrations.md - - Configuration File: tutorials/configuration_file.md - - Logging: tutorials/logging.md - - Mutelist: tutorials/mutelist.md - - Check Aliases: tutorials/check-aliases.md - - Custom Metadata: tutorials/custom-checks-metadata.md - - Scan Unused Services: tutorials/scan-unused-services.md - - Pentesting: tutorials/pentesting.md - - Parallel Execution: tutorials/parallel-execution.md - - Developer Guide: developer-guide/introduction.md - - Prowler Check Kreator: tutorials/prowler-check-kreator.md + - Prowler App: + - Getting Started: tutorials/prowler-app.md + - Role-Based Access Control: tutorials/prowler-app-rbac.md + - CLI: + - Miscellaneous: tutorials/misc.md + - Reporting: tutorials/reporting.md + - Compliance: tutorials/compliance.md + - Dashboard: tutorials/dashboard.md + - Fixer (remediations): tutorials/fixer.md + - Quick Inventory: tutorials/quick-inventory.md + - Slack Integration: tutorials/integrations.md + - Configuration File: tutorials/configuration_file.md + - Logging: tutorials/logging.md + - Mutelist: tutorials/mutelist.md + - Check Aliases: tutorials/check-aliases.md + - Custom Metadata: tutorials/custom-checks-metadata.md + - Scan Unused Services: tutorials/scan-unused-services.md + - Pentesting: tutorials/pentesting.md + - Parallel Execution: tutorials/parallel-execution.md + - Developer Guide: developer-guide/introduction.md + - Prowler Check Kreator: tutorials/prowler-check-kreator.md - AWS: - Authentication: tutorials/aws/authentication.md - Assume Role: tutorials/aws/role-assumption.md