Merge master

2026-11-09 04:38:49 +00:00 · 2026-08-10 07:45:51 +00:00
commit aecac60c12
@@ -33,14 +33,14 @@ Before you begin, make sure you have:
 ### Step 1: Get Your Alibaba Cloud Account ID

 1. Log in to the [Alibaba Cloud Console](https://home.console.alibabacloud.com/)
-2. Click on your profile avatar in the top-right corner
+2. Click your profile avatar in the top-right corner
 3. Locate and copy your Account ID

 ![Get Account ID](/images/providers/alibaba-account-id.png)

 ### Step 2: Access Prowler Cloud

-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
 2. Go to "Configuration" > "Providers"

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)
@@ -8,9 +8,9 @@ Prowler requires AWS credentials to function properly. Authentication is availab
 - Static Credentials
 - Assumed Role

-When using **Assumed Role**, the Prowler UI exposes two credential sources for calling `sts:AssumeRole`. The labels differ between Prowler Cloud and self-hosted Prowler App, but both map to the same underlying credential types:
+When using **Assumed Role**, the Prowler UI exposes two credential sources for calling `sts:AssumeRole`. The labels differ between Prowler Cloud and Prowler Local Server, but both map to the same underlying credential types:

- **AWS SDK Default** (shown as *"Prowler Cloud will assume your IAM role"* in Prowler Cloud and *"AWS SDK Default"* in self-hosted Prowler App): Prowler uses the credentials already available to the API and worker containers through the [AWS SDK default credential chain](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html). This is the default in Prowler Cloud and requires extra configuration in self-hosted Prowler App (see [Configuring AWS SDK Default for Self-Hosted Prowler App](#configuring-aws-sdk-default-for-self-hosted-prowler-app)).
+- **AWS SDK Default** (shown as *"Prowler Cloud will assume your IAM role"* in Prowler Cloud and *"AWS SDK Default"* in Prowler Local Server): Prowler uses the credentials already available to the API and worker containers through the [AWS SDK default credential chain](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html). This is the default in Prowler Cloud and requires extra configuration in Prowler Local Server (see [Configuring AWS SDK Default for Prowler Local Server](#configuring-aws-sdk-default-for-prowler-local-server)).
 - **Access & Secret Key**: You paste an IAM user's `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and optionally `AWS_SESSION_TOKEN` into the form. Prowler uses those keys to call `sts:AssumeRole`.

 ## Required Permissions
@@ -82,9 +82,9 @@ This method grants permanent access and is the recommended setup for production

 ---

-## Configuring AWS SDK Default for Self-Hosted Prowler App
+## Configuring AWS SDK Default for Prowler Local Server

-When self-hosting Prowler App with Docker Compose, the API and worker containers do not have AWS credentials by default. Selecting **AWS SDK Default** without configuring those credentials produces:
+When running Prowler Local Server with Docker Compose, the API and worker containers do not have AWS credentials by default. Selecting **AWS SDK Default** without configuring those credentials produces:

 ```
 AWSAssumeRoleError[1012]: AWS assume role error - An error occurred (InvalidClientTokenId) when calling the AssumeRole operation: The security token included in the request is invalid.
@@ -117,7 +117,7 @@ docker compose up -d --force-recreate api worker worker-beat

 ### Option 2: IAM Role (Host with Instance Metadata)

-If you run Prowler App on an EC2 instance, ECS task, or EKS pod with an attached IAM role that can assume the scan role, no extra configuration is needed — `boto3` resolves credentials through instance or task metadata automatically.
+If you run Prowler Local Server on an EC2 instance, ECS task, or EKS pod with an attached IAM role that can assume the scan role, no extra configuration is needed — `boto3` resolves credentials through instance or task metadata automatically.

 ### Trust Policy: Align `IAMPrincipal` With Your Identity

@@ -50,6 +50,6 @@ For testing or modifying Prowler's behavior, use the following steps to confirm
 * Run prowler with `--log-level DEBUG` and `--log-file debuglogs.txt`
 * Search for retry attempts using `grep -i 'Retry needed' debuglogs.txt`

-This approach follows the [AWS documentation](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/retries.html#checking-retry-attempts-in-your-client-logs), which states that if a retry is performed, a message starting with "Retry needed” will be prompted.
+This approach follows the [AWS documentation](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/retries.html#checking-retry-attempts-in-your-client-logs), which states that if a retry is performed, a message starting with "Retry needed" will be prompted.

 It is possible to determine the total number of calls made using `grep -i 'Sending http request' debuglogs.txt | wc -l`
@@ -3,7 +3,7 @@ title: 'Install and Run Prowler in AWS CloudShell'
 description: 'Install Prowler in AWS CloudShell on Amazon Linux 2023, run AWS security scans, and download output reports directly from the browser shell.'
 ---

-## Following the migration of AWS CloudShell from Amazon Linux 2 to Amazon Linux 2023
+## Following the Migration of AWS CloudShell from Amazon Linux 2 to Amazon Linux 2023

 AWS CloudShell has migrated from Amazon Linux 2 to Amazon Linux 2023 [[1]](https://aws.amazon.com/about-aws/whats-new/2023/12/aws-cloudshell-migrated-al2023/) [[2]](https://docs.aws.amazon.com/cloudshell/latest/userguide/cloudshell-AL2023-migration.html). With this transition, Python 3.9 is now included by default in AL2023, eliminating the need for manual compilation.

@@ -19,7 +19,7 @@ description: 'Onboard an AWS account to Prowler Cloud: locate your account ID, a

 ### Step 2: Access Prowler Cloud

-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
 2. Go to "Configuration" > "Providers"

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)
@@ -68,7 +68,7 @@ This method grants permanent access and is the recommended setup for production

 For detailed instructions on how to create the role, see [Authentication > Assume Role](/user-guide/providers/aws/authentication#assume-role-recommended).

-7. Once the role is created, go to the **IAM Console**, click on the "ProwlerScan" role to open its details:
+7. Once the role is created, go to the **IAM Console**, click the "ProwlerScan" role to open its details:

    ![ProwlerScan role info](/images/providers/prowler-scan-pre-info.png)

@@ -76,13 +76,13 @@ For detailed instructions on how to create the role, see [Authentication > Assum

    ![New Role Info](/images/providers/get-role-arn.png)

-9. Paste the ARN into the corresponding field in Prowler Cloud or Prowler App
+9. Paste the ARN into the corresponding field in Prowler Cloud or Prowler Local Server

    ![Input the Role ARN](/images/providers/paste-role-arn-prowler.png)

 10. Select the credential source Prowler should use to call `sts:AssumeRole`. The option label differs between deployments but both map to the same `aws-sdk-default` credential type:

-    - **"Prowler Cloud will assume your IAM role"** (default in Prowler Cloud) / **"AWS SDK Default"** (in self-hosted Prowler App): Prowler uses the credentials available in the API and worker environment through the [AWS SDK default credential chain](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html). In self-hosted Prowler App, these containers have no AWS credentials by default — see [Configuring AWS SDK Default for Self-Hosted Prowler App](/user-guide/providers/aws/authentication#configuring-aws-sdk-default-for-self-hosted-prowler-app) before choosing this option, or the connection test will fail with `InvalidClientTokenId`.
+    - **"Prowler Cloud will assume your IAM role"** (default in Prowler Cloud) / **"AWS SDK Default"** (in Prowler Local Server): Prowler uses the credentials available in the API and worker environment through the [AWS SDK default credential chain](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html). In Prowler Local Server, these containers have no AWS credentials by default — see [Configuring AWS SDK Default for Prowler Local Server](/user-guide/providers/aws/authentication#configuring-aws-sdk-default-for-prowler-local-server) before choosing this option, or the connection test will fail with `InvalidClientTokenId`.
    - **Access & Secret Key**: Paste an IAM user's `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` (and optional `AWS_SESSION_TOKEN`) into the form. The IAM principal must be allowed to assume the target role and must match the `IAMPrincipal` parameter of the scan role template (default: `role/prowler*`).

 11. Click "Next", then "Launch Scan"
@@ -111,7 +111,7 @@ AWS accounts can also be configured using static credentials (not recommended fo

 For detailed instructions on how to create the credentials, see [Authentication > Credentials](/user-guide/providers/aws/authentication#credentials).

-1. Complete the form in Prowler Cloud or Prowler App and click "Next"
+1. Complete the form in Prowler Cloud or Prowler Local Server and click "Next"

    ![Filled credentials page](/images/providers/prowler-cloud-credentials-next.png)

@@ -3,7 +3,7 @@ title: 'Scan Multiple AWS Accounts with Prowler'
 description: 'Run Prowler across many AWS accounts sequentially or in parallel using IAM assume role, ideal for auditing several accounts from one entry point.'
 ---

-Prowler enables security scanning across multiple AWS accounts by utilizing the  [Assume Role feature](/user-guide/providers/aws/role-assumption) and [integration with AWS Organizations feature](/user-guide/providers/aws/organizations).
+Prowler enables security scanning across multiple AWS accounts by utilizing the [Assume Role feature](/user-guide/providers/aws/role-assumption) and [integration with AWS Organizations feature](/user-guide/providers/aws/organizations).

 This approach allows execution from a single account with permissions to assume roles in the target accounts.

@@ -17,7 +17,7 @@ To scan specific accounts one at a time:
 ACCOUNTS_LIST='11111111111 2222222222 333333333'
 ```

- Run Prowler with an IAM role that exists in all target accounts: (replace the `<role_name>` with to yours, that is to be consistent throughout all accounts):
+- Run Prowler with an IAM role that exists in all target accounts: (replace the `<role_name>` with yours, that is to be consistent throughout all accounts):

 ```
 ROLE_TO_ASSUME=<role_name>
@@ -36,7 +36,7 @@ Define the AWS accounts to be scanned with a variable:
 ACCOUNTS_LIST='11111111111 2222222222 333333333'
 ```

- Run Prowler with an IAM role that exists in all target accounts: (replace the `<role_name>` with to yours, that is to be consistent throughout all accounts). The following example executes scanning across three accounts in parallel:
+- Run Prowler with an IAM role that exists in all target accounts: (replace the `<role_name>` with yours, that is to be consistent throughout all accounts). The following example executes scanning across three accounts in parallel:

 ```
 ROLE_TO_ASSUME=<role_name>
@@ -3,10 +3,12 @@ title: 'AWS Organizations Integration with Prowler'
 description: 'Integrate Prowler with AWS Organizations to auto-discover member accounts, enrich findings with account metadata, and deploy scan roles via StackSets.'
 ---

+import { VersionBadge } from "/snippets/version-badge.mdx"
+
 <Info>
 **Using Prowler Cloud?** You can onboard your entire AWS Organization through the UI with automatic account discovery, OU-aware tree selection, and bulk connection testing — no scripts or YAML files required.

-See [AWS Organizations in Prowler Cloud](/user-guide/tutorials/prowler-cloud-aws-organizations) for the full walkthrough.
+See [AWS Organizations](/user-guide/tutorials/prowler-cloud-aws-organizations) in Prowler Cloud for the full walkthrough.
 </Info>

 Prowler can integrate with AWS Organizations to manage the visibility and onboarding of accounts centrally.
@@ -72,11 +74,43 @@ The additional fields in CSV header output are as follows:

 ## Deploying Prowler IAM Roles Across AWS Organizations

+<VersionBadge version="5.35.0" />
+
 When onboarding multiple AWS accounts into Prowler Cloud, it is important to deploy the Prowler Scan IAM Role in each account. The most efficient way to do this across an AWS Organization is by leveraging AWS CloudFormation StackSets, which rolls out infrastructure—like IAM roles—to all accounts centrally from the Management or Delegated Admin account.

-When using Infrastructure as Code (IaC), Terraform is recommended to manage this deployment systematically.
+### Native CloudFormation StackSet Deployment (Recommended)

-### Recommended Approach
+The [Prowler Scan IAM Role CloudFormation template](https://github.com/prowler-cloud/prowler/blob/master/permissions/templates/cloudformation/prowler-scan-role.yml) can deploy the role across your entire AWS Organization on its own—no third-party modules required. When launched in the **Management Account** (or a **Delegated Administrator** account) with `DeployStackSet=true` and `EnableOrganizations=true`, it creates a service-managed CloudFormation StackSet that rolls the ProwlerScan role out to every account under the target Organizational Unit (or the organization root), and keeps new accounts covered automatically through auto-deployment.
+
+To deploy from the CloudFormation console: open **CloudFormation → Create stack → With new resources**, choose **Upload a template file** and select `prowler-scan-role.yml` (or paste its S3 URL), then set the parameters below on the **Specify stack details** step. Leave the **Configure stack options** step at its defaults.
+
+Deploy a single CloudFormation Stack in the Management Account with the following parameters:
+
+| Parameter | Description | Default |
+| --- | --- | --- |
+| `ExternalId` | External ID provided by Prowler Cloud to secure role assumption. | — |
+| `DeployLocalRole` | Create the ProwlerScan role in this (Management) account. | `true` |
+| `DeployStackSet` | Create a service-managed StackSet that deploys the role to member accounts. | `false` |
+| `AWSOrganizationalUnitId` | Target OU (`ou-xxxx-yyyyyyyy`) or organization root (`r-xxxx`) for the StackSet. Required when `DeployStackSet=true`. | `""` |
+| `DeployFromDelegatedAdmin` | Set to `true` when deploying from a Delegated Administrator account instead of the Management Account (uses `CallAs: DELEGATED_ADMIN`). | `false` |
+| `EnableOrganizations` | Add AWS Organizations permissions to the Management Account role: read-only account discovery plus the StackSet-management permissions the deployment needs. Set to `true` when deploying in the Management Account. | `false` |
+| `FailureTolerancePercentage` | Percentage of accounts in which the StackSet operation can fail before CloudFormation stops the operation. | `10` |
+| `RetainStacksOnAccountRemoval` | Keep the role in an account after it leaves the Organization or OU. | `false` |
+
+<Warning>
+On the review step, select **"I acknowledge that AWS CloudFormation might create IAM resources with custom names"** — the template provisions the named `ProwlerScan` IAM role, so the stack requires the `CAPABILITY_NAMED_IAM` capability and fails without this acknowledgment. (The quick-create link handles this for you.)
+</Warning>
+
+<Note>
+The service-managed StackSet does **not** deploy to the Management Account itself. Keeping `DeployLocalRole=true` ensures the role also exists there, so a single stack covers both the Management and member accounts.
+
+Trusted access for CloudFormation StackSets must be enabled in the Organization (see the note at the top of this page) before `DeployStackSet` will work.
+
+Deploying for the CLI or a self-hosted Prowler (not Prowler Cloud)? Also set `AccountId` to the account you assume the role from and `IAMPrincipal` to your identity — the defaults target Prowler Cloud. See [Aligning the trust policy with your identity](/user-guide/providers/aws/authentication#trust-policy-align-iamprincipal-with-your-identity).
+
+</Note>
+
+### Alternative: Deploy with Terraform

 - **Use StackSets** from the **Management Account** (or a Delegated Admin/Security Account).
 - **Use Terraform** to orchestrate the deployment.
@@ -65,7 +65,7 @@ When more than one source is set, precedence is:
 3. `aws.disallowed_regions` in `config.yaml`

 <Note>
-For self-hosted App or API-triggered scans, set `PROWLER_AWS_DISALLOWED_REGIONS` in the runtime environment of the backend scan containers such as `api` and `worker`. The `ui` container does not enforce AWS region selection.
+For Prowler Local Server or API-triggered scans, set `PROWLER_AWS_DISALLOWED_REGIONS` in the runtime environment of the backend scan containers such as `api` and `worker`. The `ui` container does not enforce AWS region selection.

 </Note>

@@ -78,6 +78,15 @@ The template requires the following parameters:
 - **AccountId:** *(Optional)* AWS Account ID that will assume the role (default: Prowler Cloud account)
 - **IAMPrincipal:** *(Optional)* The IAM principal allowed to assume the role (default: `role/prowler*`)

+<Warning>
+From the CLI you assume the role with **your own** identity, not from Prowler Cloud. The `AccountId` and `IAMPrincipal` defaults target Prowler Cloud, so set **`AccountId`** to the account you run Prowler from and **`IAMPrincipal`** to your identity (for example `role/<name>` or `user/<name>`). Otherwise `sts:AssumeRole` fails with `AccessDenied`. See [Aligning the trust policy with your identity](/user-guide/providers/aws/authentication#trust-policy-align-iamprincipal-with-your-identity).
+</Warning>
+
+<Note>
+To deploy the role across an entire AWS Organization from a single stack (Management Account role plus a service-managed StackSet for the member accounts), the template also accepts `DeployLocalRole`, `DeployStackSet`, `AWSOrganizationalUnitId`, `DeployFromDelegatedAdmin`, `EnableOrganizations`, `FailureTolerancePercentage`, and `RetainStacksOnAccountRemoval`. See [AWS Organizations in Prowler](/user-guide/providers/aws/organizations#native-cloudformation-stackset-deployment-recommended) for the full parameter reference.
+
+</Note>
+
 When running Prowler CLI, include the External ID using the `-I/--external-id` flag:

 ```sh
@@ -3,7 +3,7 @@ title: 'AWS Security Hub Integration with Prowler'
 description: 'Send Prowler findings to AWS Security Hub by enabling the integration per region, then push results into ASFF for centralized security posture.'
 ---

-Prowler natively supports **official integration** with [AWS Security Hub](https://aws.amazon.com/security-hub), allowing security findings to be sent directly.  This integration enables **Prowler** to import its findings into AWS Security Hub.
+Prowler natively supports **official integration** with [AWS Security Hub](https://aws.amazon.com/security-hub), allowing security findings to be sent directly. This integration enables **Prowler** to import its findings into AWS Security Hub.

 To activate the integration, follow these steps in at least one AWS region within your AWS account:

@@ -79,7 +79,7 @@ aws securityhub enable-import-findings-for-product --region eu-west-1 --product-
 ```

 <Note>
-Specify the AWS region where you want to enable the integration. Ensure the region is correctly set within the ARN value. This command requires the`securityhub:securityhub:EnableImportFindingsForProduct` permission.
+Specify the AWS region where you want to enable the integration. Ensure the region is correctly set within the ARN value. This command requires the `securityhub:EnableImportFindingsForProduct` permission.

 </Note>
 ## Sending Findings to AWS Security Hub
@@ -101,7 +101,7 @@ prowler --security-hub --region eu-west-1
 <Note>
 It is recommended to send only fails to Security Hub and that is possible adding `--status FAIL` to the command. You can use, instead of the `--status FAIL` argument, the `--send-sh-only-fails` argument to save all the findings in the Prowler outputs but just to send FAIL findings to AWS Security Hub.

-Since Prowler perform checks to all regions by default you may need to filter by region when running Security Hub integration, as shown in the example above. Remember to enable Security Hub in the region or regions you need by calling `aws securityhub enable-security-hub --region <region>` and run Prowler with the option `-f/--region <region>` (if no region is used it will try to push findings in all regions hubs). Prowler will send findings to the Security Hub on the region where the scanned resource is located.
+Since Prowler performs checks to all regions by default you may need to filter by region when running Security Hub integration, as shown in the example above. Remember to enable Security Hub in the region or regions you need by calling `aws securityhub enable-security-hub --region <region>` and run Prowler with the option `-f/--region <region>` (if no region is used it will try to push findings in all regions hubs). Prowler will send findings to the Security Hub on the region where the scanned resource is located.

 To have updated findings in Security Hub you have to run Prowler periodically. Once a day or every certain amount of hours.

@@ -20,7 +20,7 @@ checks_v4_v3_to_v2_mapping = {
    "apigateway_restapi_public": "extra745",
    "apigateway_restapi_logging_enabled": "extra722",
    "apigateway_restapi_waf_acl_attached": "extra744",
-    “apigatewayv2_api_access_logging_enabled": "extra7156",
+    "apigatewayv2_api_access_logging_enabled": "extra7156",
    "apigatewayv2_api_authorizers_enabled": "extra7157",
    "appstream_fleet_default_internet_access_disabled": "extra7193",
    "appstream_fleet_maximum_session_duration": "extra7190",
@@ -3,9 +3,9 @@ title: 'Azure Authentication in Prowler'
 description: 'Authenticate Prowler for Azure with a service principal, az CLI, browser login, or managed identity, and grant the required Entra and RBAC permissions.'
 ---

-Prowler for Azure supports multiple authentication types. Authentication methods vary between Prowler App and Prowler CLI:
+Prowler for Azure supports multiple authentication types. Authentication methods vary between Prowler Cloud and Prowler CLI:

-**Prowler App:**
+**Prowler Cloud:**

 - [**Service Principal Application**](#service-principal-application-authentication-recommended)

@@ -146,7 +146,7 @@ The checks requiring this `ProwlerRole` can be found in this [section](/user-gui
    1. To create a new custom role, open a terminal and execute the following command:

    ```console
-    az role definition create --role-definition '{                                                                                                                   640ms  lun 16 dic 17:04:17 2024
+    az role definition create --role-definition '{
                        "Name": "ProwlerRole",
                        "IsCustom": true,
                        "Description": "Role used for checks that require read-only access to Azure resources and are not covered by the Reader role.",
@@ -211,13 +211,15 @@ For more detailed guidance on subscription management and permissions:
 The following security checks require the `ProwlerRole` permissions for execution. Ensure the role is assigned to the identity assumed by Prowler before running these checks:

 - `app_function_access_keys_configured`
+- `app_function_application_insights_enabled`
 - `app_function_ftps_deployment_disabled`
+- `app_function_latest_runtime_version`

 ---

 ## Service Principal Application Authentication (Recommended)

-This method is required for Prowler App and recommended for Prowler CLI.
+This method is required for Prowler Cloud and recommended for Prowler CLI.

 ### Creating the Service Principal
 For more information, see [Creating Prowler Service Principal](/user-guide/providers/azure/create-prowler-service-principal).
@@ -17,7 +17,7 @@ Government cloud subscriptions (Azure Government) are not currently supported, b
 </Note>
 ### Prerequisites

-Before setting up Azure in Prowler App, you need to create a Service Principal with proper permissions.
+Before setting up Azure in Prowler Cloud, you need to create a Service Principal with proper permissions.

 For detailed instructions on how to create the Service Principal and configure permissions, see [Authentication > Service Principal](/user-guide/providers/azure/authentication#service-principal-application-authentication-recommended).

@@ -35,12 +35,12 @@ For detailed instructions on how to create the Service Principal and configure p

 ### Step 2: Access Prowler Cloud

-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
 2. Navigate to `Configuration` > `Providers`

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)

-3. Click on `Add Provider`
+3. Click `Add Provider`

    ![Add a Provider](/images/prowler-app/add-cloud-provider.png)

@@ -54,14 +54,14 @@ For detailed instructions on how to create the Service Principal and configure p

 ### Step 3: Add Credentials to Prowler Cloud

-For Azure, Prowler App uses a service principal application to authenticate. For more information about the process of creating and adding permissions to a service principal refer to this [section](/user-guide/providers/azure/authentication). When you finish creating and adding the [Entra](/user-guide/providers/azure/create-prowler-service-principal#assigning-proper-permissions) and [Subscription](/user-guide/providers/azure/subscriptions) scope permissions to the service principal, enter the `Tenant ID`, `Client ID` and `Client Secret` of the service principal application.
+For Azure, Prowler Cloud uses a service principal application to authenticate. For more information about the process of creating and adding permissions to a service principal refer to this [section](/user-guide/providers/azure/authentication). When you finish creating and adding the [Entra](/user-guide/providers/azure/create-prowler-service-principal#assigning-proper-permissions) and [Subscription](/user-guide/providers/azure/subscriptions) scope permissions to the service principal, enter the `Tenant ID`, `Client ID` and `Client Secret` of the service principal application.


 1. Go to your App Registration overview and copy the `Client ID` and `Tenant ID`

    ![App Overview](/images/providers/app-overview.png)

-2. Go to Prowler App and paste:
+2. Go to Prowler Cloud and paste:

    - `Client ID`
    - `Tenant ID`
@@ -18,7 +18,7 @@ prowler azure --az-cli-auth --subscription-ids <subscription ID 1> <subscription
 Prowler allows you to specify one or more subscriptions for scanning (up to N), enabling flexible audit configurations.

 <Warning>
-The multi-subscription feature is available only in the CLI. In Prowler App, each scan is limited to a single subscription.
+The multi-subscription feature is available only in the CLI. In Prowler Cloud, each scan is limited to a single subscription.

 </Warning>
 ## Assigning Permissions for Subscription Scans
@@ -57,8 +57,8 @@ Template URLs only pre-fill the token creation form. Review the permissions, con
 ### Step 1: Create a User API Token

 1. Log into the [Cloudflare Dashboard](https://dash.cloudflare.com).
-2. Click on the profile icon in the top right corner, then select "My Profile".
-3. Click on the **API Tokens** tab.
+2. Click the profile icon in the top right corner, then select "My Profile".
+3. Click the **API Tokens** tab.
 4. Click **Create Token**, then select **Create Custom Token** at the bottom of the page.
 5. Configure the token with the following settings:
   - **Token name:** A descriptive name (e.g., "Prowler Security Scanner")
@@ -103,8 +103,8 @@ API Keys provide full access to the Cloudflare account. While supported, this me
 ### Step 1: Get the Global API Key

 1. Log into the [Cloudflare Dashboard](https://dash.cloudflare.com).
-2. Click on the profile icon in the top right corner, then select "My Profile".
-3. Click on the **API Tokens** tab.
+2. Click the profile icon in the top right corner, then select "My Profile".
+3. Click the **API Tokens** tab.
 4. Scroll down to the **API Keys** section.
 5. Click **View** next to **Global API Key**.
 6. Enter the account password to reveal the key, then copy it.
@@ -51,7 +51,7 @@ The Account ID is a 32-character hexadecimal string (e.g., `372e67954025e0ba6aaa

 ### Step 2: Open Prowler Cloud

-1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
+1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
 2. Navigate to "Configuration" > "Providers".

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)
@@ -56,7 +56,7 @@ This method uses the Google Cloud CLI to authenticate and is suitable for develo

 ### Setup Application Default Credentials

-1. In the [GCP Console](https://console.cloud.google.com/), click on "Activate Cloud Shell"
+1. In the [GCP Console](https://console.cloud.google.com/), click "Activate Cloud Shell"

    ![Activate Cloud Shell](/images/providers/access-console.png)

@@ -90,7 +90,7 @@ This method uses the Google Cloud CLI to authenticate and is suitable for develo

    ![Get the FileName](/images/providers/get-temp-file-credentials.png)

-8. Extract the following values for Prowler Cloud/App:
+8. Extract the following values for Prowler Cloud or Prowler Local Server:

    - `client_id`
    - `client_secret`
@@ -14,7 +14,7 @@ description: 'Onboard a Google Cloud project to Prowler Cloud: retrieve the GCP

 ### Step 2: Access Prowler Cloud

-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
 2. Go to "Configuration" > "Providers"

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)
@@ -67,7 +67,7 @@ For Google Cloud, first enter your `GCP Project ID` and then select the authenti

    2. Once authenticated, get the `Client ID`, `Client Secret` and `Refresh Token` from `~/.config/gcloud/application_default_credentials`.

-    3. Paste the `Client ID`, `Client Secret` and `Refresh Token` into Prowler App.
+    3. Paste the `Client ID`, `Client Secret` and `Refresh Token` into Prowler Cloud.

    <img src="/images/gcp-credentials.png" alt="GCP Credentials" width="700" />

@@ -13,7 +13,7 @@ Prowler offers three authentication methods. Fine-Grained Personal Access Tokens

 | Method | Best For | Key Benefit |
 |--------|----------|-------------|
-| [**Fine-Grained Personal Access Token**](#fine-grained-personal-access-token-recommended) | Individual users, quick setup | Simple, user-scoped access |
+| [**Fine-Grained Personal Access Token**](#fine-grained-personal-access-token-recommended-for-individual-use) | Individual users, quick setup | Simple, user-scoped access |
 | [**GitHub App**](#github-app-credentials) | Organizations, automation, CI/CD | Organization-scoped, no personal account dependency |
 | [**OAuth App Token**](#oauth-app-token) | Delegated user authorization | User-consented access flows |

@@ -272,7 +272,7 @@ Store the `.pem` private key securely. Anyone with this key can authenticate as

 ## Prowler Cloud Authentication

-For step-by-step setup instructions for Prowler Cloud, see the [Getting Started Guide](/user-guide/providers/github/getting-started-github#prowler-cloudapp).
+For step-by-step setup instructions for Prowler Cloud, see the [Getting Started Guide](/user-guide/providers/github/getting-started-github#prowler-cloud-and-prowler-local-server).

 ### Using Personal Access Token

@@ -302,7 +302,7 @@ For step-by-step setup instructions for Prowler Cloud, see the [Getting Started

 3. Enter your GitHub App ID and upload the private key (`.pem` file).

-For complete step-by-step instructions, see the [Getting Started Guide](/user-guide/providers/github/getting-started-github#prowler-cloudapp).
+For complete step-by-step instructions, see the [Getting Started Guide](/user-guide/providers/github/getting-started-github#prowler-cloud-and-prowler-local-server).

 ---

@@ -17,7 +17,7 @@ Prowler can scan either:
 </Note>

 <CardGroup cols={2}>
-  <Card title="Prowler Cloud/App" icon="cloud" href="#prowler-cloudapp">
+  <Card title="Prowler Cloud & Local Server" icon="cloud" href="#prowler-cloud-and-prowler-local-server">
    Web-based interface with centralized management
  </Card>
  <Card title="Prowler CLI" icon="terminal" href="#prowler-cli">
@@ -27,7 +27,7 @@ Prowler can scan either:

 ---

-## Prowler Cloud/App
+## Prowler Cloud and Prowler Local Server

 <iframe width="560" height="380" src="https://www.youtube-nocookie.com/embed/9ETI84Xpu2g" title="Prowler Cloud Onboarding Github" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="1"></iframe>

@@ -35,7 +35,7 @@ Prowler can scan either:

 ### Prerequisites

-Before adding GitHub to Prowler Cloud/App, ensure you have:
+Before adding GitHub to Prowler Cloud or Prowler Local Server, ensure you have:

 1. **GitHub Account Access**
   - Personal GitHub account, OR
@@ -47,9 +47,9 @@ Before adding GitHub to Prowler Cloud/App, ensure you have:
     - OAuth App Token
     - GitHub App Credentials (Not Recommended - limited data access)

-### Step 1: Access Prowler Cloud/App
+### Step 1: Access Prowler Cloud or Prowler Local Server

-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
 2. Go to **Configuration** → **Providers**

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)
@@ -43,7 +43,7 @@ The Customer ID starts with the letter "C" followed by alphanumeric characters (

 ### Step 2: Open Prowler Cloud

-1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
+1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
 2. Navigate to "Configuration" > "Providers".

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)
@@ -0,0 +1,135 @@
+---
+title: "Huawei Cloud Authentication in Prowler"
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
+<VersionBadge version="5.37.0" />
+
+Prowler for Huawei Cloud authenticates against the Huawei Cloud APIs using an IAM user's **Access Key ID** and **Secret Access Key** (AK/SK). Credentials are read exclusively from environment variables to avoid exposing secrets in shell history or process listings; there are no credential CLI flags.
+
+## Required Credentials
+
+Prowler requires read access to the Huawei Cloud account. The following values are supported:
+
+| Credential | Environment Variable | Description |
+|------------|----------------------|-------------|
+| Access Key ID | `HUAWEICLOUD_ACCESS_KEY_ID` (or `HW_ACCESS_KEY`) | Permanent access key ID of the IAM user |
+| Secret Access Key | `HUAWEICLOUD_SECRET_ACCESS_KEY` (or `HW_SECRET_KEY`) | Secret access key paired with the access key ID |
+| Domain ID | `HUAWEICLOUD_DOMAIN_ID` (or `HW_DOMAIN_ID`) | Optional account (domain) ID |
+| Security Token | `HUAWEICLOUD_SECURITY_TOKEN` | Optional security token for temporary credentials |
+| Region | `HUAWEICLOUD_REGION` (or `HW_REGION`) | Default region(s) when `--region` is not passed (e.g. `eu-west-101`) |
+| Cloud | `HUAWEICLOUD_CLOUD` (or `HW_CLOUD`) | Scan every region of a cloud (`international`, `europe`, or `china`) when no region is set |
+
+<Note>
+The endpoint domain (`.eu` or `.com`) and the per-region project ID are resolved automatically from the region, so neither endpoint nor project configuration is needed. Multi-region scans work out of the box. For the region precedence rules and the full list of supported regions, see [Regions and Clouds](/user-guide/providers/huaweicloud/getting-started-huaweicloud#regions-and-clouds).
+</Note>
+
+<Warning>
+Huawei Cloud runs separate clouds: **International** and **China** (`.com` endpoints) and **Huawei Cloud Europe** (`.eu` endpoints). The region (or `--cloud` selector) determines the endpoint, so accounts outside China must select a region they can reach — for example `eu-west-101` for a Huawei Cloud Europe account. A single set of credentials belongs to one cloud, so it cannot authenticate against both `.com` and `.eu`; scan each account with its own credentials.
+</Warning>
+
+---
+
+## API Credentials
+
+### Step 1: Create an Access Key (AK/SK)
+
+1. Log in to the [Huawei Cloud console](https://console-intl.huaweicloud.com).
+2. Open **My Credentials** from the account menu, then select **Access Keys**.
+3. Click **Create Access Key** and complete the identity verification.
+4. Download the `credentials.csv` file — it contains the Access Key ID and Secret Access Key. The secret is not shown again.
+
+<Warning>
+Use an IAM user with read-only permissions (for example, the built-in `ReadOnly` policy) rather than the account root credentials.
+</Warning>
+
+### Step 2: Configure Authentication
+
+Export the credentials as environment variables:
+
+```bash
+export HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id"
+export HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key"
+```
+
+Then run Prowler:
+
+```bash
+prowler huaweicloud
+```
+
+---
+
+## Assuming an Agency (Cross-Account)
+
+To scan a different account, assume an [agency](https://support.huaweicloud.com/intl/en-us/usermanual-iam/iam_06_0002.html) delegated to your account. Set the agency name and the target account, and Prowler exchanges the base credentials for temporary credentials scoped to the agency:
+
+```bash
+export HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id"
+export HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key"
+export HUAWEICLOUD_AGENCY_NAME="your-agency-name"
+export HUAWEICLOUD_ASSUME_DOMAIN_ID="target-account-domain-id"   # or HUAWEICLOUD_ASSUME_DOMAIN_NAME
+prowler huaweicloud
+```
+
+| Environment Variable | Description |
+|----------------------|-------------|
+| `HUAWEICLOUD_AGENCY_NAME` | Name of the agency to assume in the target account |
+| `HUAWEICLOUD_ASSUME_DOMAIN_ID` | Domain ID of the target (delegating) account |
+| `HUAWEICLOUD_ASSUME_DOMAIN_NAME` | Domain name of the target account (alternative to the domain ID) |
+
+---
+
+## Verifying Authentication
+
+To confirm that Prowler can reach the account, run a scan against a single region the account can reach:
+
+```bash
+# China account
+prowler huaweicloud --region cn-north-4
+
+# International account
+prowler huaweicloud --region ap-southeast-1
+
+# Huawei Cloud Europe account
+prowler huaweicloud --region eu-west-101
+```
+
+To scan the account's entire cloud instead, use the `--cloud` selector:
+
+```bash
+prowler huaweicloud --cloud europe
+```
+
+A successful run reports findings for the discovered resources. A failed run displays an error message indicating the credential or connectivity issue.
+
+---
+
+## CI/CD Integration
+
+For automated pipelines, set the credentials as secret environment variables:
+
+**GitHub Actions:**
+
+```yaml
+env:
+  HUAWEICLOUD_ACCESS_KEY_ID: ${{ secrets.HUAWEICLOUD_ACCESS_KEY_ID }}
+  HUAWEICLOUD_SECRET_ACCESS_KEY: ${{ secrets.HUAWEICLOUD_SECRET_ACCESS_KEY }}
+
+steps:
+  - name: Run Prowler
+    run: prowler huaweicloud
+```
+
+**GitLab CI:**
+
+```yaml
+variables:
+  HUAWEICLOUD_ACCESS_KEY_ID: $HUAWEICLOUD_ACCESS_KEY_ID
+  HUAWEICLOUD_SECRET_ACCESS_KEY: $HUAWEICLOUD_SECRET_ACCESS_KEY
+
+prowler_scan:
+  script:
+    - prowler huaweicloud
+```
@@ -0,0 +1,177 @@
+---
+title: 'Getting Started With Huawei Cloud on Prowler'
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
+<VersionBadge version="5.37.0" />
+
+Prowler for Huawei Cloud scans your Huawei Cloud account for security misconfigurations across compute, storage, networking, identity, encryption, database, and logging services.
+
+<Note>
+Huawei Cloud support in Prowler is community-maintained. For commercial support or to request additional service coverage, [contact us](https://prowler.com/contact).
+</Note>
+
+## Prerequisites
+
+Set up authentication for Huawei Cloud with the [Huawei Cloud Authentication](/user-guide/providers/huaweicloud/authentication) guide before starting:
+
+- Create an Access Key ID and Secret Access Key (AK/SK) for an IAM user with read-only permissions.
+- Prowler reads the credentials exclusively from environment variables, so secrets are never passed on the command line.
+
+## Prowler CLI
+
+### Run Prowler for Huawei Cloud
+
+Once authenticated, export the credentials as environment variables and run Prowler for Huawei Cloud. Environment variables keep secrets out of shell history and process listings:
+
+```bash
+export HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id"
+export HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key"
+prowler huaweicloud
+```
+
+### Run Specific Checks
+
+```bash
+prowler huaweicloud --checks obs_bucket_public_access iam_user_mfa_enabled
+```
+
+### Run a Specific Service
+
+```bash
+prowler huaweicloud --services iam
+```
+
+## Regions and Clouds
+
+Huawei Cloud operates as three separate clouds, and every account belongs to exactly one of them:
+
+- **International** — served from the `.com` endpoints (for example `myhuaweicloud.com`).
+- **China** — also served from the `.com` endpoints, on the China regions (`cn-*`).
+- **Huawei Cloud Europe** — served from the `.eu` endpoints (for example `myhuaweicloud.eu`).
+
+The cloud is a property of the region: each region ID maps to exactly one endpoint domain. Prowler selects the correct endpoint automatically from the region, so no endpoint configuration is required.
+
+### Region Selection Precedence
+
+Prowler resolves the regions to scan from the first source that is set, in this order:
+
+1. **`--region` flag** (aliases `--filter-region`, `-f`) — one or more explicit region IDs.
+2. **`HUAWEICLOUD_REGION`** (or `HW_REGION`) environment variable — one or more region IDs, separated by spaces or commas.
+3. **`--cloud` selector** (or `HUAWEICLOUD_CLOUD` / `HW_CLOUD`) — expands to every region of the selected cloud.
+4. **Default** — when none is set, Prowler falls back to its built-in region list.
+
+A more specific source always wins: `--region` overrides `HUAWEICLOUD_REGION`, which overrides `--cloud`.
+
+### Select Specific Regions
+
+To scan a defined set of regions, pass the region IDs to `--region` or set `HUAWEICLOUD_REGION`. Accounts outside China must select a region they can reach — for example `eu-west-101` for Huawei Cloud Europe or `ap-southeast-1` for International.
+
+```bash
+# Flag (one or more regions)
+prowler huaweicloud --region eu-west-101 ap-southeast-1
+
+# Environment variable (space- or comma-separated)
+export HUAWEICLOUD_REGION="ap-southeast-1, ap-southeast-2"
+prowler huaweicloud
+```
+
+### Scan an Entire Cloud
+
+To scan every region of an account's cloud without listing regions, use the `--cloud` selector or the `HUAWEICLOUD_CLOUD` environment variable. Prowler expands it to that cloud's regions and selects the matching endpoint automatically:
+
+```bash
+# Scan all Huawei Cloud Europe regions (.eu endpoints)
+prowler huaweicloud --cloud europe
+
+# Scan all International regions (.com endpoints)
+prowler huaweicloud --cloud international
+
+# Scan all China regions (.com endpoints)
+prowler huaweicloud --cloud china
+```
+
+The `--cloud` flag accepts three values: `international`, `europe`, and `china`. The `HUAWEICLOUD_CLOUD` (or `HW_CLOUD`) environment variable additionally accepts the short aliases `intl`/`com` (International), `eu` (Europe), and `cn` (China).
+
+<Note>
+A single set of credentials belongs to one cloud, so `--cloud` selects which cloud to scan — it cannot authenticate against both `.com` and `.eu` at once. To scan accounts on different clouds, run Prowler once per account with that account's credentials.
+</Note>
+
+### How Prowler Handles Regions and Endpoints
+
+Prowler manages several Huawei Cloud specifics automatically during a scan:
+
+- **Endpoint selection:** The endpoint domain (`.eu` or `.com`) is derived from each region, so every service targets the right cloud. This corrects services whose bundled metadata still points Europe regions at `.com`.
+- **Project resolution:** The per-region project ID is resolved automatically, so multi-region scans work without any project configuration.
+- **Credential validation:** Credentials are validated against a region in the account's cloud that exposes IAM, so validation succeeds even when the requested regions do not all offer IAM.
+- **Unsupported regions:** Any region a given service does not offer is skipped and logged, so scanning an entire cloud never fails on regions where a service is unavailable.
+
+### Supported Regions
+
+Prowler recognizes the following region IDs, grouped by cloud.
+
+**International (`.com`)**
+
+| Region ID | Location |
+|-----------|----------|
+| `ae-ad-1` | UAE (Abu Dhabi) |
+| `af-north-1` | Egypt (Cairo) |
+| `af-south-1` | South Africa |
+| `ap-southeast-1` | Hong Kong |
+| `ap-southeast-2` | Singapore |
+| `ap-southeast-3` | Thailand |
+| `ap-southeast-4` | Malaysia |
+| `ap-southeast-5` | Indonesia (Jakarta) |
+| `eu-west-0` | Ireland |
+| `la-north-2` | Mexico |
+| `la-south-2` | Chile (Santiago) |
+| `me-east-1` | UAE (Dubai) |
+| `my-kualalumpur-1` | Malaysia (Kuala Lumpur) |
+| `na-mexico-1` | Mexico (Mexico City) |
+| `ru-moscow-1` | Russia (Moscow-1) |
+| `sa-brazil-1` | Brazil |
+| `tr-west-1` | Türkiye (Istanbul) |
+
+**Huawei Cloud Europe (`.eu`)**
+
+| Region ID | Location |
+|-----------|----------|
+| `eu-west-101` | Ireland (Dublin) |
+
+**China (`.com`)**
+
+| Region ID | Location |
+|-----------|----------|
+| `cn-north-1` | China (Beijing-1) |
+| `cn-north-2` | China (Beijing-2) |
+| `cn-north-4` | China (Beijing-4) |
+| `cn-north-9` | China (Ulanqab) |
+| `cn-north-11` | China (Ulanqab-11) |
+| `cn-north-12` | China (Ulanqab-12) |
+| `cn-east-2` | China (Shanghai-2) |
+| `cn-east-3` | China (Shanghai-1) |
+| `cn-east-4` | China (Shanghai-4) |
+| `cn-east-5` | China (Shanghai-5) |
+| `cn-south-1` | China (Guangzhou) |
+| `cn-south-2` | China (Guangzhou-2) |
+| `cn-south-4` | China (Guangzhou-4) |
+| `cn-southwest-2` | China (Guiyang) |
+| `cn-southwest-3` | China (Guiyang-3) |
+
+## Available Services
+
+Prowler for Huawei Cloud currently supports the following services:
+
+| Service | Description |
+|---------|-------------|
+| `cts` | Cloud Trace Service trackers that record account and API activity for audit logging |
+| `ecs` | Elastic Cloud Server compute instances and their key pair, public IP, and security group configuration |
+| `elb` | Elastic Load Balance load balancers and their public exposure |
+| `evs` | Elastic Volume Service block volumes and their encryption settings |
+| `iam` | Identity and Access Management users, MFA devices, password policy, and account operation protection |
+| `kms` | Key Management Service keys, their state, and rotation configuration |
+| `obs` | Object Storage Service buckets and their public-access configuration |
+| `rds` | Relational Database Service instances and their public access, backup, and disk-encryption settings |
+| `vpc` | Virtual Private Cloud security groups and their ingress rules |
+| `waf` | Web Application Firewall instances and their status |
@@ -25,7 +25,7 @@ Prowler IaC provider scans the following Infrastructure as Code configurations f

 ## How It Works

- Prowler App leverages [Trivy](https://trivy.dev/docs/latest/guide/coverage/iac/#scanner) to scan local directories (or specified paths) for supported IaC files, or scans remote repositories.
+- Prowler Cloud leverages [Trivy](https://trivy.dev/docs/latest/guide/coverage/iac/#scanner) to scan local directories (or specified paths) for supported IaC files, or scans remote repositories.
 - No cloud credentials or authentication are required for local scans.
 - For remote repository scans, authentication can be provided via [git URL](https://git-scm.com/docs/git-clone#_git_urls), CLI flags or environment variables.
  - Check the [IaC Authentication](/user-guide/providers/iac/authentication) page for more details.
@@ -38,11 +38,11 @@ Prowler IaC provider scans the following Infrastructure as Code configurations f

 ### Supported Scanners

-Scanner selection is not configurable in Prowler App. Default scanners, misconfig and secret, run automatically during each scan.
+Scanner selection is not configurable in Prowler Cloud. Default scanners, misconfig and secret, run automatically during each scan.

-### Step 1: Access Prowler Cloud/App
+### Step 1: Access Prowler Cloud or Prowler Local Server

-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
 2. Go to "Configuration" > "Providers"

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)
@@ -34,7 +34,7 @@ Prowler Cloud does not support scanner selection. The vulnerability, secret, and

 ### Step 1: Access Prowler Cloud

-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
 2. Navigate to "Configuration" > "Providers"

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)
@@ -5,9 +5,9 @@ description: 'Onboard Kubernetes clusters to Prowler and scan for security misco

 ## Prowler Cloud

-### Step 1: Access Prowler Cloud/App
+### Step 1: Access Prowler Cloud or Prowler Local Server

-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app)
 2. Go to "Configuration" > "Providers"

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)
@@ -22,10 +22,10 @@ description: 'Onboard Kubernetes clusters to Prowler and scan for security misco

 ### Step 2: Configure Kubernetes Authentication

-For Kubernetes, Prowler App uses a `kubeconfig` file to authenticate. Paste the contents of your `kubeconfig` file into the `Kubeconfig content` field.
+For Kubernetes, Prowler Cloud uses a `kubeconfig` file to authenticate. Paste the contents of your `kubeconfig` file into the `Kubeconfig content` field.

 <Note>
-Kubeconfigs that use `users[].user.exec` authentication are not supported in Prowler Cloud/App. For security reasons, Prowler Cloud does not run commands declared by uploaded kubeconfigs. Use kubeconfig credentials that do not rely on `exec` authentication, such as the ServiceAccount token flow documented below.
+Kubeconfigs that use `users[].user.exec` authentication are not supported in Prowler Cloud or Prowler Local Server. For security reasons, Prowler Cloud does not run commands declared by uploaded kubeconfigs. Use kubeconfig credentials that do not rely on `exec` authentication, such as the ServiceAccount token flow documented below.
 </Note>

 By default, the `kubeconfig` file is located at `~/.kube/config`.
@@ -30,7 +30,7 @@ Ensure the token has all required scopes. Missing permissions will cause some ch
 ### Step 1: Create a Personal Access Token

 1. Log into the [Linode Cloud Manager](https://cloud.linode.com).
-2. Click on your username in the top-right corner, then select **API Tokens** under the "My Profile" section.
+2. Click your username in the top-right corner, then select **API Tokens** under the "My Profile" section.
 3. Click **Create a Personal Access Token**.
 4. Configure the token:
   - **Label:** A descriptive name (e.g., "Prowler Security Scanner")
@@ -552,7 +552,7 @@ Installing PowerShell is different depending on your OS:

  </Tab>
  <Tab title="Docker">
-    [Docker](https://learn.microsoft.com/es-es/powershell/scripting/install/powershell-in-docker?view=powershell-7.5#use-powershell-in-a-container): The following command download the latest stable versions of PowerShell:
+    [Docker](https://learn.microsoft.com/es-es/powershell/scripting/install/powershell-in-docker?view=powershell-7.5#use-powershell-in-a-container): The following command downloads the latest stable versions of PowerShell:

    ```console
    docker pull mcr.microsoft.com/dotnet/sdk:9.0
@@ -42,7 +42,7 @@ Set up authentication for Microsoft 365 with the [Microsoft 365 Authentication](

 ### Step 2: Open Prowler Cloud

-1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
+1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
 2. Navigate to "Configuration" > "Providers".

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)
@@ -14,4 +14,4 @@ To learn more about how to install PowerShell and which versions are supported,
 ## Required Modules

 The necessary modules will not be installed automatically by Prowler. Nevertheless, if you want Prowler to install them for you, you can execute the provider with the flag `--init-modules`, which will run the script to install and import them.
-If you want to learn more about this process or you are running some issues with this, click [here](/user-guide/providers/microsoft365/authentication#required-powershell-modules).
+If you want to learn more about this process or you are running into some issues with this, click [here](/user-guide/providers/microsoft365/authentication#required-powershell-modules).
@@ -16,12 +16,12 @@ Before you begin, make sure you have:
 3. An **API Key pair** (public and private keys) with appropriate permissions:
   - **Organization Read Only**: Provides read-only access to everything in the organization, including all projects in the organization. This permission is sufficient for most security checks.
   - **Organization Owner**: Required to audit the [Auditing configuration](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/group/endpoint-auditing) for projects. Database auditing tracks database operations and security events, including authentication attempts, data definition language (DDL) changes, user and role modifications, and privilege grants. This configuration is essential for security monitoring, forensics, and compliance. Without **Organization Owner** permission, the `projects_auditing_enabled` check cannot retrieve the audit configuration status.
-4. Prowler App access (cloud or self-hosted) or the Prowler CLI (`pip install prowler`).
+4. Access to Prowler Cloud or Prowler Local Server, or Prowler CLI (`pip install prowler`).

 For detailed instructions on creating API keys, see the [MongoDB Atlas authentication guide](./authentication.mdx).

 <Warning>
-If **Require IP Access List for the Atlas Administration API** is enabled in your organization settings, you **must** add the IP address of the host running Prowler (or the public IP of Prowler Cloud) to the organization IP Access List or Atlas will reject every API call. You can manage this under **Settings → Organization Settings → Security**. See step 7 of the [authentication guide](./authentication.mdx) for detailed instructions, and refer to the [Prowler Cloud public IP list](../../tutorials/prowler-cloud-public-ips) when using Prowler Cloud.
+If **Require IP Access List for the Atlas Administration API** is enabled in the organization settings, add the IP address of the host running Prowler (or the public IP of Prowler Cloud) to the organization IP Access List or Atlas will reject every API call. Manage this under **Settings → Organization Settings → Security**. See step 7 of the [authentication guide](./authentication.mdx) for detailed instructions, and refer to the [Prowler Cloud egress IPs](/security/networking) when using Prowler Cloud.
 </Warning>

 <CardGroup cols={2}>
@@ -54,7 +54,7 @@ If **Require IP Access List for the Atlas Administration API** is enabled in you

 ### Step 3: Test the connection and start scanning

-1. Click **Test connection** to ensure Prowler App can reach the Atlas API.
+1. Click **Test connection** to ensure Prowler Cloud can reach the Atlas API.
 2. Save the credentials. The provider will appear in the list with its current connection status.
 3. Launch a scan from the provider row or from the **Scans** page.
   ![Launch scan](./img/launch-scan.png)
@@ -109,6 +109,6 @@ prowler mongodbatlas --atlas-project-id <project-id>

 - Combine flags (for example, `--checks` or `--services`) just like with other providers.
 - Use `--output-modes` to export findings in JSON, CSV, ASFF, etc.
- Rotate API keys regularly and update the stored credentials in Prowler App to maintain connectivity.
+- Rotate API keys regularly and update the stored credentials in Prowler Cloud to maintain connectivity.

 For more examples (filters, outputs, scheduling), refer back to the [MongoDB Atlas documentation hub](./authentication.mdx) and the main Prowler CLI usage guide.
@@ -56,7 +56,7 @@ After running `oci session authenticate`, you need to manually add your user OCI

 **Get your user OCID from the OCI Console:**

-Navigate to: **Identity & Security** → **Users** → Click on your username → Copy the OCID
+Navigate to: **Identity & Security** → **Users** → Click your username → Copy the OCID

 ![Get User OCID from OCI Console](./images/oci-user-ocid.png)

@@ -435,7 +435,7 @@ prowler oci --oci-config-file /path/to/config

 **Cause**: Insufficient IAM permissions

-**Solution**: Add required policies (see [Required Permissions](./getting-started-oci.md#required-permissions))
+**Solution**: Add required policies (see [Required Permissions](/user-guide/providers/oci/getting-started-oci#required-permissions))

 ### Configuration Validation

@@ -7,7 +7,7 @@ Prowler supports security scanning of Oracle Cloud Infrastructure (OCI) environm

 ## Prowler Cloud

-The following steps apply to Prowler Cloud and the self-hosted Prowler App.
+The following steps apply to Prowler Cloud and Prowler Local Server.

 ### Step 1: Collect OCI Identifiers
 1. Sign in to the [OCI Console](https://cloud.oracle.com/) and open **Tenancy Details** to copy the Tenancy OCID.
@@ -16,14 +16,14 @@ The following steps apply to Prowler Cloud and the self-hosted Prowler App.
 4. Note the **Region** identifier to scan (for example, `us-ashburn-1`).

 ### Step 2: Access Prowler Cloud
-1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
 2. Go to **Configuration** → **Providers** and click **Add Provider**.
 ![Add OCI Provider](./images/oci-add-cloud-provider.png)
 3. Select **Oracle Cloud** and enter the **Tenancy OCID** and an optional alias, then choose **Next**.
 ![Add OCI Cloud Tenancy](./images/oci-add-tenancy.png)

 ### Step 3: Add OCI API Key Credentials
-Prowler App connects to OCI with API key credentials. Provide:
+Prowler Cloud connects to OCI with API key credentials. Provide:

 - **User OCID** for the API key owner
 - **Fingerprint** of the API key
@@ -59,7 +59,7 @@ Before you begin, ensure you have:

 ### Authentication

-Prowler supports multiple authentication methods for OCI. For detailed authentication setup, see the [OCI Authentication Guide](./authentication).
+Prowler supports multiple authentication methods for OCI. For detailed authentication setup, see the [OCI Authentication Guide](/user-guide/providers/oci/authentication).

 **Note:** OCI Session Authentication and Config File Authentication both use the same `~/.oci/config` file. The difference is how the config file is generated - automatically via browser (session auth) or manually with API keys.

@@ -79,7 +79,7 @@ The easiest and most secure method is using OCI session authentication, which au

   **Get your user OCID from the OCI Console:**

-   Navigate to: **Identity & Security** → **Users** → Click on your username → Copy the OCID
+   Navigate to: **Identity & Security** → **Users** → Click your username → Copy the OCID

   ![Get User OCID from OCI Console](./images/oci-user-ocid.png)

@@ -108,7 +108,7 @@ The easiest and most secure method is using OCI session authentication, which au

 #### Alternative: Manual API Key Setup

-If you prefer to manually generate API keys instead of using browser-based session authentication, see the detailed instructions in the [Authentication Guide](./authentication#config-file-authentication-manual-api-key-setup).
+If you prefer to manually generate API keys instead of using browser-based session authentication, see the detailed instructions in the [Authentication Guide](/user-guide/providers/oci/authentication#config-file-authentication-manual-api-key-setup).

 **Note:** Both methods use the same `~/.oci/config` file - the difference is that manual setup uses static API keys while session authentication uses temporary session tokens.

@@ -21,7 +21,7 @@ Prowler authenticates to Okta as a **service application** using **OAuth 2.0 wit

 | Method | Status | Use Case |
 |---|---|---|
-| **OAuth 2.0 (private-key JWT)** | Supported | Production scans, CI/CD, Prowler App. |
+| **OAuth 2.0 (private-key JWT)** | Supported | Production scans, CI/CD, Prowler Cloud. |

 The private-key JWT flow is the only supported authentication method in the initial release. The service application proves possession of a private key on every token request; Okta returns a short-lived access token, refreshed automatically by the SDK.

@@ -31,7 +31,7 @@ Set up authentication for Okta with the [Okta Authentication](/user-guide/provid

 ### Step 1: Add the Provider

-1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
+1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
 2. Navigate to "Configuration" > "Providers".

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)
@@ -15,7 +15,7 @@ Prowler for Scaleway scans IAM resources in your Scaleway organization for secur

 Prowler authenticates to Scaleway with a Scaleway API key. See [Scaleway Authentication in Prowler](./authentication) for the full setup, environment variables, CLI flags, and required permissions.

-## Run a scan
+## Run a Scan

 ```bash
 export SCW_ACCESS_KEY="SCW..."
@@ -31,7 +31,7 @@ To run only the IAM root-key check:
 prowler scaleway --check iam_api_keys_no_root_owned
 ```

-## Checks shipped
+## Checks Shipped

 | Check ID | Severity | Description |
 |---|---|---|
@@ -29,7 +29,7 @@ Set up authentication for Vercel with the [Vercel Authentication](/user-guide/pr

 ### Step 1: Add the Provider

-1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
+1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
 2. Navigate to "Configuration" > "Providers".

    ![Providers Page](/images/prowler-app/cloud-providers-page.png)