mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-10-29 14:54:30 +00:00
docs(tutorials): improve quality redrive (#7915)
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com> Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com>
This commit is contained in:
45 files changed
+1305
-872
No files matched your search
@@ -1,34 +1,39 @@
|
||||
# Scan Multiple AWS Accounts
|
||||
# Scanning Multiple AWS Accounts with Prowler
|
||||
|
||||
Prowler can scan multiple accounts when it is executed from one account that can assume a role in those given accounts to scan using [Assume Role feature](role-assumption.md) and [AWS Organizations integration feature](organizations.md).
|
||||
Prowler enables security scanning across multiple AWS accounts by utilizing the [Assume Role feature](role-assumption.md) and [integration with AWS Organizations feature](organizations.md).
|
||||
|
||||
This approach allows execution from a single account with permissions to assume roles in the target accounts.
|
||||
|
||||
## Scan multiple specific accounts sequentially
|
||||
## Scanning Multiple Accounts Sequentially
|
||||
|
||||
- Declare a variable with all the accounts to scan:
|
||||
To scan specific accounts one at a time:
|
||||
|
||||
- Define a variable containing the AWS account IDs to be scanned:
|
||||
|
||||
```
|
||||
ACCOUNTS_LIST='11111111111 2222222222 333333333'
|
||||
```
|
||||
|
||||
- Then run Prowler to assume a role (change `<role_name>` below to yours, that must be the same in all accounts):
|
||||
- Run Prowler with an IAM role that exists in all target accounts: (replace the `<role_name>` with to yours, that is to be consistent throughout all accounts):
|
||||
|
||||
```
|
||||
ROLE_TO_ASSUME=<role_name>
|
||||
for accountId in $ACCOUNTS_LIST; do
|
||||
prowler aws --role arn:aws:iam::$accountId:role/$ROLE_TO_ASSUME
|
||||
for accountId in $ACCOUNTS_LIST; do
|
||||
prowler aws --role arn:aws:iam::$accountId:role/$ROLE_TO_ASSUME
|
||||
done
|
||||
```
|
||||
|
||||
## Scan multiple specific accounts in parallel
|
||||
## Scanning Multiple Accounts in Parallel
|
||||
|
||||
- Declare a variable with all the accounts to scan:
|
||||
- To scan multiple accounts simultaneously:
|
||||
|
||||
Define the AWS accounts to be scanned with a variable:
|
||||
|
||||
```
|
||||
ACCOUNTS_LIST='11111111111 2222222222 333333333'
|
||||
```
|
||||
|
||||
- Then run Prowler to assume a role (change `<role_name>` below to yours, that must be the same in all accounts), in this example it will scan 3 accounts in parallel:
|
||||
- Run Prowler with an IAM role that exists in all target accounts: (replace the `<role_name>` with to yours, that is to be consistent throughout all accounts). The following example executes scanning across three accounts in parallel:
|
||||
|
||||
```
|
||||
ROLE_TO_ASSUME=<role_name>
|
||||
@@ -41,25 +46,35 @@ for accountId in $ACCOUNTS_LIST; do
|
||||
done
|
||||
```
|
||||
|
||||
## Scan multiple accounts from AWS Organizations in parallel
|
||||
## Scanning Multiple AWS Organization Accounts in Parallel
|
||||
|
||||
- Declare a variable with all the accounts to scan. To do so, get the list of your AWS accounts in your AWS Organization by running the following command (will create a variable with all your ACTIVE accounts). Remember to run that command with the permissions needed to get that information in your AWS Organizations Management account.
|
||||
Prowler enables parallel security scans across multiple AWS accounts within an AWS Organization.
|
||||
|
||||
### Retrieve Active AWS Accounts
|
||||
|
||||
To efficiently scan multiple accounts within an AWS Organization, follow these steps:
|
||||
|
||||
- Step 1: Retrieve a List of Active Accounts
|
||||
|
||||
First, declare a variable containing all active accounts in your AWS Organization. Run the following command in your AWS Organizations Management account, ensuring that you have the necessary permissions:
|
||||
|
||||
```
|
||||
ACCOUNTS_IN_ORG=$(aws organizations list-accounts --query Accounts[?Status==`ACTIVE`].Id --output text)
|
||||
```
|
||||
|
||||
- Then run Prowler to assume a role (change `<role_name>` that must be the same in all accounts and `<management_organizations_account_id>` that must be your AWS Organizations management account ID):
|
||||
- Step 2: Run Prowler with Assumed Roles
|
||||
|
||||
Use Prowler to assume roles across accounts in parallel. Modify <role_name> to match the role that exists in all accounts and <management_organizations_account_id> to your AWS Organizations Management account ID.
|
||||
|
||||
```
|
||||
ROLE_TO_ASSUME=<role_name>
|
||||
MGMT_ACCOUNT_ID=<management_organizations_account_id>
|
||||
PARALLEL_ACCOUNTS="3"
|
||||
for accountId in $ACCOUNTS_IN_ORG; do
|
||||
test "$(jobs | wc -l)" -ge $PARALLEL_ACCOUNTS && wait || true
|
||||
{
|
||||
prowler aws --role arn:aws:iam::$accountId:role/$ROLE_TO_ASSUME \
|
||||
--organizations-role arn:aws:iam::$MGMT_ACCOUNT_ID:role/$ROLE_TO_ASSUME
|
||||
} &
|
||||
test "$(jobs | wc -l)" -ge $PARALLEL_ACCOUNTS && wait || true
|
||||
{
|
||||
prowler aws --role arn:aws:iam::$accountId:role/$ROLE_TO_ASSUME \
|
||||
--organizations-role arn:aws:iam::$MGMT_ACCOUNT_ID:role/$ROLE_TO_ASSUME
|
||||
} &
|
||||
done
|
||||
```
|
||||
Reference in new issue
Block a user