From 9758fc36df4f65c2eaa7e6290c1d81560bda2115 Mon Sep 17 00:00:00 2001 From: "Andoni A." <14891798+andoniaf@users.noreply.github.com> Date: Wed, 22 Oct 2025 12:22:28 +0200 Subject: [PATCH] chore: use Prowler API key instead of temporal token --- .../aws-organizations-bulk-provisioning.mdx | 36 ++++++++----------- .../tutorials/bulk-provider-provisioning.mdx | 34 ++++++++---------- util/prowler-bulk-provisioning/README.md | 30 ++++++---------- .../nuke_providers.py | 28 ++++++++------- .../prowler_bulk_provisioning.py | 26 ++++++++------ 5 files changed, 71 insertions(+), 83 deletions(-) diff --git a/docs/user-guide/tutorials/aws-organizations-bulk-provisioning.mdx b/docs/user-guide/tutorials/aws-organizations-bulk-provisioning.mdx index 302e9aec0a..206e55abae 100644 --- a/docs/user-guide/tutorials/aws-organizations-bulk-provisioning.mdx +++ b/docs/user-guide/tutorials/aws-organizations-bulk-provisioning.mdx @@ -30,8 +30,9 @@ The AWS Organizations Bulk Provisioning tool simplifies multi-account onboarding * Python 3.7 or higher * AWS credentials with Organizations read access * ProwlerRole (or custom role) deployed across all target accounts -* Prowler API token (from Prowler Cloud or self-hosted Prowler App) +* Prowler API key (from Prowler Cloud or self-hosted Prowler App) * For self-hosted Prowler App, remember to [point to your API base URL](./bulk-provider-provisioning#custom-api-endpoints) + * Learn how to create API keys: [Prowler App API Keys](../providers/prowler-app-api-keys) ### Deploying ProwlerRole Across AWS Organizations @@ -98,30 +99,23 @@ export AWS_SECRET_ACCESS_KEY=your-secret-key export AWS_PROFILE=org-management ``` -### Prowler API Token Setup +### Prowler API Key Setup -Configure your Prowler API token: +Configure your Prowler API key: ```bash -export PROWLER_API_TOKEN="your-prowler-api-token" +export PROWLER_API_KEY="pk_your-api-key-here" ``` -To obtain an API token programmatically: +To create an API key: -```bash -export PROWLER_API_TOKEN=$(curl --location 'https://api.prowler.com/api/v1/tokens' \ - --header 'Content-Type: application/vnd.api+json' \ - --header 'Accept: application/vnd.api+json' \ - --data-raw '{ - "data": { - "type": "tokens", - "attributes": { - "email": "your@email.com", - "password": "your-password" - } - } - }' | jq -r .data.attributes.access) -``` +1. Log into Prowler Cloud or Prowler App +2. Navigate to **Profile** → **Account** +3. Click **Create API Key** +4. Provide a descriptive name and optionally set an expiration date +5. Copy the generated API key (it will only be shown once) + +For detailed instructions, see: [Prowler App API Keys](../providers/prowler-app-api-keys) ## Basic Usage @@ -345,8 +339,8 @@ python aws_org_generator.py \ Provision all accounts to Prowler Cloud or Prowler App: ```bash - # Set Prowler API credentials - export PROWLER_API_TOKEN="your-prowler-api-token" + # Set Prowler API key + export PROWLER_API_KEY="pk_your-api-key-here" # Run bulk provisioning with connection testing python prowler_bulk_provisioning.py aws-org-accounts.yaml diff --git a/docs/user-guide/tutorials/bulk-provider-provisioning.mdx b/docs/user-guide/tutorials/bulk-provider-provisioning.mdx index 11e7f14cf8..456b781836 100644 --- a/docs/user-guide/tutorials/bulk-provider-provisioning.mdx +++ b/docs/user-guide/tutorials/bulk-provider-provisioning.mdx @@ -23,8 +23,9 @@ The Bulk Provider Provisioning tool automates the creation of cloud providers in ### Requirements * Python 3.7 or higher -* Prowler API token (from Prowler Cloud or self-hosted Prowler App) +* Prowler API key (from Prowler Cloud or self-hosted Prowler App) * For self-hosted Prowler App, remember to [point to your API base URL](#custom-api-endpoints) + * Learn how to create API keys: [Prowler App API Keys](../providers/prowler-app-api-keys) * Authentication credentials for target cloud providers ### Installation @@ -39,28 +40,21 @@ pip install -r requirements.txt ### Authentication Setup -Configure your Prowler API token: +Configure your Prowler API key: ```bash -export PROWLER_API_TOKEN="your-prowler-api-token" +export PROWLER_API_KEY="pk_your-api-key-here" ``` -To obtain an API token programmatically: +To create an API key: -```bash -export PROWLER_API_TOKEN=$(curl --location 'https://api.prowler.com/api/v1/tokens' \ - --header 'Content-Type: application/vnd.api+json' \ - --header 'Accept: application/vnd.api+json' \ - --data-raw '{ - "data": { - "type": "tokens", - "attributes": { - "email": "your@email.com", - "password": "your-password" - } - } - }' | jq -r .data.attributes.access) -``` +1. Log into Prowler Cloud or Prowler App +2. Navigate to **Profile** → **Account** +3. Click **Create API Key** +4. Provide a descriptive name and optionally set an expiration date +5. Copy the generated API key (it will only be shown once) + +For detailed instructions, see: [Prowler App API Keys](../providers/prowler-app-api-keys) ## Configuration File Structure @@ -340,11 +334,11 @@ Done. Success: 2 Failures: 0 ## Troubleshooting -### Invalid API Token +### Invalid API Key ``` Error: 401 Unauthorized -Solution: Verify your PROWLER_API_TOKEN or --token parameter +Solution: Verify your PROWLER_API_KEY environment variable or --api-key parameter ``` ### Network Timeouts diff --git a/util/prowler-bulk-provisioning/README.md b/util/prowler-bulk-provisioning/README.md index 478f611328..26f1879fa1 100644 --- a/util/prowler-bulk-provisioning/README.md +++ b/util/prowler-bulk-provisioning/README.md @@ -49,25 +49,17 @@ This two-step approach follows the Prowler API design where providers and their pip install -r requirements.txt ``` -3. Get your Prowler API token: - - **Prowler Cloud:** Generate token at https://api.prowler.com - - **Self-hosted Prowler App:** Generate token in your local instance +3. Get your Prowler API key: + - **Prowler Cloud:** Create an API key at https://api.prowler.com + - **Self-hosted Prowler App:** Create an API key in your local instance + - Navigate to **Profile** → **Account** → **Create API Key** ```bash - export PROWLER_API_TOKEN=$(curl --location 'https://api.prowler.com/api/v1/tokens' \ - --header 'Content-Type: application/vnd.api+json' \ - --header 'Accept: application/vnd.api+json' \ - --data-raw '{ - "data": { - "type": "tokens", - "attributes": { - "email": "your@email.com", - "password": "your-password" - } - } - }' | jq -r .data.attributes.access) + export PROWLER_API_KEY="pk_your-api-key-here" ``` + For detailed instructions on creating API keys, see: https://docs.prowler.com/user-guide/providers/prowler-app-api-keys + ## AWS Organizations Integration @@ -155,7 +147,7 @@ python aws_org_generator.py -o aws-accounts.yaml \ ### Environment Variables ```bash -export PROWLER_API_TOKEN="your-prowler-token" +export PROWLER_API_KEY="pk_your-api-key-here" export PROWLER_API_BASE="https://api.prowler.com/api/v1" # Optional, defaults to Prowler Cloud ``` @@ -250,7 +242,7 @@ python prowler_bulk_provisioning.py providers.yaml \ |--------|-------------|---------| | `input_file` | YAML file with provider entries | Required | | `--base-url` | API base URL | `https://api.prowler.com/api/v1` | -| `--token` | Bearer token | `PROWLER_API_TOKEN` env var | +| `--api-key` | Prowler API key | `PROWLER_API_KEY` env var | | `--providers-endpoint` | Providers API endpoint | `/providers` | | `--concurrency` | Number of concurrent requests | `5` | | `--timeout` | Per-request timeout in seconds | `60` | @@ -461,10 +453,10 @@ python prowler_bulk_provisioning.py providers.yaml --dry-run ### Common Issues -1. **Invalid API Token** +1. **Invalid API Key** ``` Error: 401 Unauthorized - Solution: Check your PROWLER_API_TOKEN or --token parameter + Solution: Check your PROWLER_API_KEY environment variable or --api-key parameter ``` 2. **Network Timeouts** diff --git a/util/prowler-bulk-provisioning/nuke_providers.py b/util/prowler-bulk-provisioning/nuke_providers.py index 348855611f..9759ac4626 100755 --- a/util/prowler-bulk-provisioning/nuke_providers.py +++ b/util/prowler-bulk-provisioning/nuke_providers.py @@ -7,7 +7,7 @@ Use with extreme caution. There is no undo. Environment: PROWLER_API_BASE (default: https://api.prowler.com/api/v1) - PROWLER_API_TOKEN (required unless --token is provided) + PROWLER_API_KEY (required unless --api-key is provided) Usage: python nuke_providers.py --confirm @@ -39,12 +39,14 @@ import requests # ----------------------------- CLI / Utils --------------------------------- # -def env_or_arg(token_arg: Optional[str]) -> str: - """Get API token from argument or environment variable.""" - token = token_arg or os.getenv("PROWLER_API_TOKEN") - if not token: - sys.exit("Missing API token. Set --token or PROWLER_API_TOKEN.") - return token +def env_or_arg(api_key_arg: Optional[str]) -> str: + """Get API key from argument or environment variable.""" + api_key = api_key_arg or os.getenv("PROWLER_API_KEY") + if not api_key: + sys.exit( + "Missing API key. Set --api-key or PROWLER_API_KEY environment variable." + ) + return api_key def normalize_base_url(url: str) -> str: @@ -63,14 +65,14 @@ class ApiClient: """HTTP client for Prowler API.""" base_url: str - token: str + api_key: str verify_ssl: bool = True timeout: int = 60 def _headers(self) -> Dict[str, str]: """Generate HTTP headers for API requests.""" return { - "Authorization": f"Bearer {self.token}", + "Authorization": f"Api-Key {self.api_key}", "Content-Type": "application/vnd.api+json", "Accept": "application/vnd.api+json", } @@ -266,7 +268,9 @@ def main(): help="API base URL (default: env PROWLER_API_BASE or Prowler Cloud SaaS)", ) parser.add_argument( - "--token", default=None, help="Bearer token (default: PROWLER_API_TOKEN)" + "--api-key", + default=None, + help="Prowler API key (default: PROWLER_API_KEY env variable)", ) parser.add_argument( "--filter-provider", @@ -307,12 +311,12 @@ def main(): args = parser.parse_args() - token = env_or_arg(args.token) + api_key = env_or_arg(args.api_key) base_url = normalize_base_url(args.base_url) client = ApiClient( base_url=base_url, - token=token, + api_key=api_key, verify_ssl=not args.insecure, timeout=args.timeout, ) diff --git a/util/prowler-bulk-provisioning/prowler_bulk_provisioning.py b/util/prowler-bulk-provisioning/prowler_bulk_provisioning.py index e7ebdaac3b..d5564515e4 100755 --- a/util/prowler-bulk-provisioning/prowler_bulk_provisioning.py +++ b/util/prowler-bulk-provisioning/prowler_bulk_provisioning.py @@ -132,12 +132,14 @@ def load_items(path: Path) -> List[Dict[str, Any]]: sys.exit(f"Unsupported input file type: {ext}") -def env_or_arg(token_arg: Optional[str]) -> str: - """Get API token from argument or environment variable.""" - token = token_arg or os.getenv("PROWLER_API_TOKEN") - if not token: - sys.exit("Missing API token. Set --token or PROWLER_API_TOKEN.") - return token +def env_or_arg(api_key_arg: Optional[str]) -> str: + """Get API key from argument or environment variable.""" + api_key = api_key_arg or os.getenv("PROWLER_API_KEY") + if not api_key: + sys.exit( + "Missing API key. Set --api-key or PROWLER_API_KEY environment variable." + ) + return api_key def normalize_base_url(url: str) -> str: @@ -395,14 +397,14 @@ class ApiClient: """HTTP client for Prowler API.""" base_url: str - token: str + api_key: str verify_ssl: bool = True timeout: int = 60 def _headers(self) -> Dict[str, str]: """Generate HTTP headers for API requests.""" return { - "Authorization": f"Bearer {self.token}", + "Authorization": f"Api-Key {self.api_key}", "Content-Type": "application/vnd.api+json", "Accept": "application/vnd.api+json", } @@ -564,7 +566,9 @@ def main(): help="API base URL (default: env PROWLER_API_BASE or Prowler Cloud SaaS).", ) parser.add_argument( - "--token", default=None, help="Bearer token (default: PROWLER_API_TOKEN)." + "--api-key", + default=None, + help="Prowler API key (default: PROWLER_API_KEY env variable).", ) parser.add_argument( "--providers-endpoint", @@ -600,7 +604,7 @@ def main(): ) args = parser.parse_args() - token = env_or_arg(args.token) + api_key = env_or_arg(args.api_key) base_url = normalize_base_url(args.base_url) items = load_items(Path(args.input_file)) @@ -610,7 +614,7 @@ def main(): client = ApiClient( base_url=base_url, - token=token, + api_key=api_key, verify_ssl=not args.insecure, timeout=args.timeout, )