mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 21:11:53 +00:00
docs: refactor several sections (#8570)
This commit is contained in:
@@ -97,6 +97,9 @@ This method grants permanent access and is the recommended setup for production
|
||||

|
||||

|
||||
|
||||
!!! info
|
||||
An **External ID** is required when assuming the *ProwlerScan* role to comply with AWS [confused deputy prevention](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html).
|
||||
|
||||
6. Acknowledge the IAM resource creation warning and proceed
|
||||
|
||||

|
||||
|
||||
@@ -21,7 +21,7 @@ AWS Security Hub can be enabled using either of the following methods:
|
||||
|
||||
#### Enabling AWS Security Hub for Prowler Integration
|
||||
|
||||
If AWS Security Hub is already enabled, you can proceed to the [next section](#enable-prowler-integration).
|
||||
If AWS Security Hub is already enabled, you can proceed to the [next section](#enabling-prowler-integration-in-aws-security-hub).
|
||||
|
||||
1. Enable AWS Security Hub via Console: Open the **AWS Security Hub** console: https://console.aws.amazon.com/securityhub/.
|
||||
|
||||
@@ -33,7 +33,7 @@ If AWS Security Hub is already enabled, you can proceed to the [next section](#e
|
||||
|
||||
#### Enabling Prowler Integration in AWS Security Hub
|
||||
|
||||
If the Prowler integration is already enabled in AWS Security Hub, you can proceed to the [next section](#send-findings) and begin sending findings.
|
||||
If the Prowler integration is already enabled in AWS Security Hub, you can proceed to the [next section](#sending-findings-to-aws-security-hub) and begin sending findings.
|
||||
|
||||
Once **AWS Security Hub** is activated, **Prowler** must be enabled as partner integration to allow security findings to be sent to it.
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ export AZURE_CLIENT_SECRET="XXXXXXX"
|
||||
|
||||
Execution with the `--sp-env-auth` flag fails if these variables are not set or exported.
|
||||
|
||||
Refer to the [Create Prowler Service Principal](create-prowler-service-principal.md#how-to-create-prowler-service-principal-application) guide for detailed setup instructions.
|
||||
Refer to the [Create Prowler Service Principal](create-prowler-service-principal.md) guide for detailed setup instructions.
|
||||
|
||||
### Azure Authentication Methods
|
||||
|
||||
@@ -63,8 +63,8 @@ These permissions are required to perform security checks against Azure resource
|
||||
|
||||
To properly configure permissions, follow these guides:
|
||||
|
||||
- [Microsoft Entra ID permissions](create-prowler-service-principal.md#assigning-the-proper-permissions)
|
||||
- [Azure subscription permissions](subscriptions.md#assign-the-appropriate-permissions-to-the-identity-that-is-going-to-be-assumed-by-prowler)
|
||||
- [Microsoft Entra ID permissions](create-prowler-service-principal.md#assigning-proper-permissions)
|
||||
- [Azure subscription permissions](subscriptions.md)
|
||||
|
||||
???+ warning
|
||||
Some permissions in `ProwlerRole` involve **write access**. If a `ReadOnly` lock is attached to certain resources, you may encounter errors, and findings for those checks will not be available.
|
||||
|
||||
@@ -21,7 +21,7 @@ Prowler allows you to specify one or more subscriptions for scanning (up to N),
|
||||
|
||||
To perform scans, ensure that the identity assumed by Prowler has the appropriate permissions.
|
||||
|
||||
By default, Prowler scans all accessible subscriptions. If you need to audit specific subscriptions, you must assign the necessary role `Reader` for each one. For streamlined and less repetitive role assignments in multi-subscription environments, refer to the [following section](#recommendation-for-multiple-subscriptions).
|
||||
By default, Prowler scans all accessible subscriptions. If you need to audit specific subscriptions, you must assign the necessary role `Reader` for each one. For streamlined and less repetitive role assignments in multi-subscription environments, refer to the [following section](#recommendation-for-managing-multiple-subscriptions).
|
||||
|
||||
### Assigning the Reader Role in Azure Portal
|
||||
|
||||
@@ -152,7 +152,7 @@ Scanning multiple subscriptions requires creating and assigning roles for each,
|
||||
|
||||

|
||||
|
||||
2. **Assign Roles**: Assign necessary roles to the management group, similar to the [role assignment process](#assign-the-appropriate-permissions-to-the-identity-that-is-going-to-be-assumed-by-prowler).
|
||||
2. **Assign Roles**: Assign necessary roles to the management group, similar to the [role assignment process](#assigning-permissions-for-subscription-scans).
|
||||
|
||||
Role assignment should be done at the management group level instead of per subscription.
|
||||
|
||||
|
||||
@@ -116,7 +116,7 @@ Each check must reside in a dedicated subfolder, following this structure:
|
||||
???+ note
|
||||
The check name must start with the service name followed by an underscore (e.g., ec2\_instance\_public\_ip).
|
||||
|
||||
To see more information about how to write checks, refer to the [Developer Guide](../developer-guide/checks.md#create-a-new-check-for-a-provider).
|
||||
To see more information about how to write checks, refer to the [Developer Guide](../developer-guide/checks.md#creating-a-check).
|
||||
|
||||
???+ note
|
||||
If you want to run ONLY your custom check(s), import it with -x (--checks-folder) and then run it with -c (--checks), e.g.: `console prowler aws -x s3://bucket/prowler/providers/aws/services/s3/s3_bucket_policy/ -c s3_bucket_policy`
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
## Accessing Prowler App and API Documentation
|
||||
|
||||
After [installing](../index.md#prowler-app-installation) **Prowler App**, access it at [http://localhost:3000](http://localhost:3000). To view the auto-generated **Prowler API** documentation, navigate to [http://localhost:8080/api/v1/docs](http://localhost:8080/api/v1/docs). This documentation provides details on available endpoints, parameters, and responses.
|
||||
After [installing](../installation/prowler-app.md) **Prowler App**, access it at [http://localhost:3000](http://localhost:3000). To view the auto-generated **Prowler API** documentation, navigate to [http://localhost:8080/api/v1/docs](http://localhost:8080/api/v1/docs). This documentation provides details on available endpoints, parameters, and responses.
|
||||
|
||||
???+ note
|
||||
If you are a [Prowler Cloud](https://cloud.prowler.com/sign-in) user, you can access API docs at [https://api.prowler.com/api/v1/docs](https://api.prowler.com/api/v1/docs)
|
||||
@@ -109,7 +109,7 @@ For AWS, enter your `AWS Account ID` and choose one of the following methods to
|
||||
|
||||
### **Step 4.2: Azure Credentials**:
|
||||
|
||||
For Azure, Prowler App uses a service principal application to authenticate. For more information about the process of creating and adding permissions to a service principal refer to this [section](../tutorials/azure/authentication.md). When you finish creating and adding the [Entra](./azure/create-prowler-service-principal.md#assigning-the-proper-permissions) and [Subscription](./azure/subscriptions.md#assign-the-appropriate-permissions-to-the-identity-that-is-going-to-be-assumed-by-prowler) scope permissions to the service principal, enter the `Tenant ID`, `Client ID` and `Client Secret` of the service principal application.
|
||||
For Azure, Prowler App uses a service principal application to authenticate. For more information about the process of creating and adding permissions to a service principal refer to this [section](../tutorials/azure/authentication.md). When you finish creating and adding the [Entra](./azure/create-prowler-service-principal.md#assigning-proper-permissions) and [Subscription](./azure/subscriptions.md) scope permissions to the service principal, enter the `Tenant ID`, `Client ID` and `Client Secret` of the service principal application.
|
||||
|
||||
<img src="../../img/azure-credentials.png" alt="Azure Credentials" width="700"/>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user