docs: migrate to Mintlify (#8894)

2026-11-02 01:15:31 +00:00 · 2025-10-15 16:38:56 +02:00
1 parent 8773751779
commit c08c27e5c6
@@ -0,0 +1,123 @@
+---
+title: 'AWS Authentication in Prowler'
+---
+
+Prowler requires AWS credentials to function properly. Authentication is available through the following methods:
+
+- Static Credentials
+- Assumed Role
+
+## Required Permissions
+
+To ensure full functionality, attach the following AWS managed policies to the designated user or role:
+
+- `arn:aws:iam::aws:policy/SecurityAudit`
+- `arn:aws:iam::aws:policy/job-function/ViewOnlyAccess`
+
+### Additional Permissions
+
+For certain checks, additional read-only permissions are required. Attach the following custom policy to your role: [prowler-additions-policy.json](https://github.com/prowler-cloud/prowler/blob/master/permissions/prowler-additions-policy.json)
+
+
+## Assume Role (Recommended)
+
+This method grants permanent access and is the recommended setup for production environments.
+
+<Tabs>
+  <Tab title="CloudFormation">
+    1. Download the [Prowler Scan Role Template](https://raw.githubusercontent.com/prowler-cloud/prowler/refs/heads/master/permissions/templates/cloudformation/prowler-scan-role.yml)
+
+        ![Prowler Scan Role Template](/images/providers/prowler-scan-role-template.png)
+
+        ![Download Role Template](/images/providers/download-role-template.png)
+
+    2. Open the [AWS Console](https://console.aws.amazon.com), search for **CloudFormation**
+
+        ![CloudFormation Search](/images/providers/cloudformation-nav.png)
+
+    3. Go to **Stacks** and click "Create stack" > "With new resources (standard)"
+
+        ![Create Stack](/images/providers/create-stack.png)
+
+    4. In **Specify Template**, choose "Upload a template file" and select the downloaded file
+
+        ![Upload a template file](/images/providers/upload-template-file.png)
+        ![Upload file from downloads](/images/providers/upload-template-from-downloads.png)
+
+    5. Click "Next", provide a stack name and the **External ID** shown in the Prowler Cloud setup screen
+
+        ![External ID](/images/providers/prowler-cloud-external-id.png)
+        ![Stack Data](/images/providers/fill-stack-data.png)
+
+        !!! info
+            An **External ID** is required when assuming the *ProwlerScan* role to comply with AWS [confused deputy prevention](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html).
+
+    6. Acknowledge the IAM resource creation warning and proceed
+
+        ![Stack Creation Second Step](/images/providers/stack-creation-second-step.png)
+
+    7. Click "Submit" to deploy the stack
+
+        ![Click on submit](/images/providers/submit-third-page.png)
+  </Tab>
+  <Tab title="Terraform">
+    To provision the scan role using Terraform:
+
+    1. Run the following commands:
+
+        ```bash
+        terraform init
+        terraform plan
+        terraform apply
+        ```
+  </Tab>
+</Tabs>
+
+---
+
+## Credentials
+
+<Tabs>
+  <Tab title="Long term credentials">
+    1. Go to the [AWS Console](https://console.aws.amazon.com), open **CloudShell**
+
+        ![AWS CloudShell](/images/providers/aws-cloudshell.png)
+
+    2. Run:
+
+        ```bash
+        aws iam create-access-key
+        ```
+  </Tab>
+  <Tab title="Short term credentials (Recommended)">
+    Use the [AWS Access Portal](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtogetcredentials.html) or the CLI:
+
+    1. Retrieve short-term credentials for the IAM identity using this command:
+
+        ```bash
+        aws sts get-session-token --duration-seconds 900
+        ```
+
+        <Note>
+        Check the aws documentation [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/sts_example_sts_GetSessionToken_section.html)
+        </Note>
+
+    2. Copy the output containing:
+
+        - `AccessKeyId`
+        - `SecretAccessKey`
+        - `SessionToken`
+
+        > Sample output:
+        ```json
+        {
+            "Credentials": {
+                "AccessKeyId": "ASIAIOSFODNN7EXAMPLE",
+                "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY",
+                "SessionToken": "AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAE",
+                "Expiration": "2020-05-19T18:06:10+00:00"
+            }
+        }
+        ```
+  </Tab>
+</Tabs>
@@ -0,0 +1,54 @@
+---
+title: "Boto3 Retrier Configuration in Prowler"
+---
+
+Prowler's AWS Provider leverages Boto3's [Standard](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/retries.html) retry mode to automatically retry client calls to AWS services when encountering errors or exceptions.
+
+## Retry Behavior Overview
+
+Boto3's Standard retry mode includes the following mechanisms:
+
+- Maximum Retry Attempts: Default value set to 3, configurable via the `--aws-retries-max-attempts 5` argument.
+
+- Expanded Error Handling: Retries occur for a comprehensive set of errors.
+
+  ```
+  # *Transient Errors/Exceptions*
+  The retrier handles various temporary failures:
+  RequestTimeout
+  RequestTimeoutException
+  PriorRequestNotComplete
+  ConnectionError
+  HTTPClientError
+
+  # *Service-Side Throttling and Limit Errors*
+  Retries occur for service-imposed rate limits and resource constraints:
+  Throttling
+  ThrottlingException
+  ThrottledException
+  RequestThrottledException
+  TooManyRequestsException
+  ProvisionedThroughputExceededException
+  TransactionInProgressException
+  RequestLimitExceeded
+  BandwidthLimitExceeded
+  LimitExceededException
+  RequestThrottled
+  SlowDown
+  EC2ThrottledException
+  ```
+
+- Nondescriptive Transient Error Codes: The retrier applies retry logic to standard HTTP status codes signaling transient errors: 500, 502, 503, 504.
+
+- Exponential Backoff Strategy: Each retry attempt follows exponential backoff with a base factor of 2, ensuring progressive delay between retries. Maximum backoff time: 20 seconds
+
+## Validating Retry Attempts
+
+For testing or modifying Prowler's behavior, use the following steps to confirm whether requests are being retried or abandoned:
+
+* Run prowler with `--log-level DEBUG` and `--log-file debuglogs.txt`
+* Search for retry attempts using `grep -i 'Retry needed' debuglogs.txt`
+
+This approach follows the [AWS documentation](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/retries.html#checking-retry-attempts-in-your-client-logs), which states that if a retry is performed, a message starting with "Retry needed” will be prompted.
+
+It is possible to determine the total number of calls made using `grep -i 'Sending http request' debuglogs.txt | wc -l`
@@ -0,0 +1,53 @@
+---
+title: 'Installing Prowler in AWS CloudShell'
+---
+
+## Following the migration of AWS CloudShell from Amazon Linux 2 to Amazon Linux 2023
+
+AWS CloudShell has migrated from Amazon Linux 2 to Amazon Linux 2023 [[1]](https://aws.amazon.com/about-aws/whats-new/2023/12/aws-cloudshell-migrated-al2023/) [[2]](https://docs.aws.amazon.com/cloudshell/latest/userguide/cloudshell-AL2023-migration.html). With this transition, Python 3.9 is now included by default in AL2023, eliminating the need for manual compilation.
+
+To install Prowler v4 in AWS CloudShell, follow the standard installation method using pip:
+
+```shell
+sudo bash
+adduser prowler
+su prowler
+pip install prowler
+cd /tmp
+prowler aws
+```
+
+## Downloading Files from AWS CloudShell
+
+To download results from AWS CloudShell:
+
+- Select Actions → Download File.
+
+- Specify the full file path of each file you wish to download. For example, downloading a CSV file would require providing its complete path, as in: `/home/cloudshell-user/output/prowler-output-123456789012-20221220191331.csv`
+
+## Cloning Prowler from GitHub
+
+Due to the limited storage in AWS CloudShell's home directory, installing Poetry dependencies for running Prowler from GitHub can be problematic.
+
+The following workaround ensures successful installation:
+
+```shell
+sudo bash
+adduser prowler
+su prowler
+git clone https://github.com/prowler-cloud/prowler.git
+cd prowler
+pip install poetry
+mkdir /tmp/poetry
+poetry config cache-dir /tmp/poetry
+eval $(poetry env activate)
+poetry install
+python prowler-cli.py -v
+```
+
+<Warning>
+Starting from Poetry v2.0.0, `poetry shell` has been deprecated in favor of `poetry env activate`.
+
+If your Poetry version is below v2.0.0, continue using `poetry shell` to activate your environment. For further guidance, refer to the Poetry Environment Activation Guide https://python-poetry.org/docs/managing-environments/#activating-the-environment.
+
+</Warning>
@@ -0,0 +1,143 @@
+---
+title: 'Getting Started With AWS on Prowler'
+---
+
+## Prowler App
+
+<iframe width="560" height="380" src="https://www.youtube-nocookie.com/embed/RPgIWOCERzY" title="Prowler Cloud Onboarding AWS" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="1"></iframe>
+
+> Walkthrough video onboarding an AWS Account using Assumed Role.
+
+### Step 1: Get Your AWS Account ID
+
+1. Log in to the [AWS Console](https://console.aws.amazon.com)
+2. Locate your AWS account ID in the top-right dropdown menu
+
+![Account ID detail](/images/providers/aws-account-id.png)
+
+
+### Step 2: Access Prowler Cloud or Prowler App
+
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+2. Go to "Configuration" > "Cloud Providers"
+
+    ![Cloud Providers Page](/images/prowler-app/cloud-providers-page.png)
+
+3. Click "Add Cloud Provider"
+
+    ![Add a Cloud Provider](/images/prowler-app/add-cloud-provider.png)
+
+4. Select "Amazon Web Services"
+
+    ![Select AWS Provider](/images/providers/select-aws.png)
+
+5. Enter your AWS Account ID and optionally provide a friendly alias
+
+    ![Add account ID](/images/providers/add-account-id.png)
+
+6. Choose the preferred authentication method (next step)
+
+    ![Select auth method](/images/providers/select-auth-method.png)
+
+
+### Step 3: Set Up AWS Authentication
+
+Before proceeding, choose the preferred authentication mode:
+
+**Credentials**
+
+* Quick scan as current user
+* No extra setup
+* Credentials time out
+
+**Assumed Role**
+
+* Preferred Setup
+* Permanent Credentials
+* Requires access to create role
+
+
+---
+
+#### Assume Role (Recommended)
+
+This method grants permanent access and is the recommended setup for production environments.
+
+![Assume Role Overview](/images/providers/assume-role-overview.png)
+
+For detailed instructions on how to create the role, see [Authentication > Assume Role](/user-guide/providers/aws/authentication#assume-role-recommended).
+
+8. Once the role is created, go to the **IAM Console**, click on the "ProwlerScan" role to open its details:
+
+    ![ProwlerScan role info](/images/providers/prowler-scan-pre-info.png)
+
+9. Copy the **Role ARN**
+
+    ![New Role Info](/images/providers/get-role-arn.png)
+
+10. Paste the ARN into the corresponding field in Prowler Cloud or Prowler App
+
+    ![Input the Role ARN](/images/providers/paste-role-arn-prowler.png)
+
+11. Click "Next", then "Launch Scan"
+
+    ![Next button in Prowler Cloud](/images/providers/next-button-prowler-cloud.png)
+    ![Launch Scan](/images/providers/launch-scan-button-prowler-cloud.png)
+
+---
+
+#### Credentials (Static Access Keys)
+
+AWS accounts can also be configured using static credentials (not recommended for long-term use):
+
+![Connect via credentials](/images/providers/connect-via-credentials.png)
+
+For detailed instructions on how to create the credentials, see [Authentication > Credentials](/user-guide/providers/aws/authentication#credentials).
+
+1. Complete the form in Prowler Cloud or Prowler App and click "Next"
+
+    ![Filled credentials page](/images/providers/prowler-cloud-credentials-next.png)
+
+2. Click "Launch Scan"
+
+    ![Launch Scan](/images/providers/launch-scan-button-prowler-cloud.png)
+
+---
+
+## Prowler CLI
+
+### Configure AWS Credentials
+
+To authenticate with AWS, use one of the following methods:
+
+```console
+aws configure
+```
+
+or
+
+```console
+export AWS_ACCESS_KEY_ID="ASXXXXXXX"
+export AWS_SECRET_ACCESS_KEY="XXXXXXXXX"
+export AWS_SESSION_TOKEN="XXXXXXXXX"
+```
+
+These credentials must be associated with a user or role with the necessary permissions to perform security checks.
+
+More details on Assume Role settings from the CLI in [Assume Role](/user-guide/providers/aws/role-assumption) page.
+
+
+### AWS Profiles
+
+To use a custom AWS profile, specify it with the following command:
+
+```console
+prowler aws -p/--profile <profile_name>
+```
+
+### Multi-Factor Authentication (MFA)
+
+For IAM entities requiring Multi-Factor Authentication (MFA), use the `--mfa` flag. Prowler prompts for the following values to initiate a new session:
+
+- **ARN of your MFA device**
+- **TOTP (time-based one-time password)**
@@ -0,0 +1,82 @@
+---
+title: 'Scanning Multiple AWS Accounts with Prowler'
+---
+
+Prowler enables security scanning across multiple AWS accounts by utilizing the  [Assume Role feature](/user-guide/providers/aws/role-assumption) and [integration with AWS Organizations feature](/user-guide/providers/aws/organizations).
+
+This approach allows execution from a single account with permissions to assume roles in the target accounts.
+
+## Scanning Multiple Accounts Sequentially
+
+To scan specific accounts one at a time:
+
+- Define a variable containing the AWS account IDs to be scanned:
+
+```
+ACCOUNTS_LIST='11111111111 2222222222 333333333'
+```
+
+- Run Prowler with an IAM role that exists in all target accounts: (replace the `<role_name>` with to yours, that is to be consistent throughout all accounts):
+
+```
+ROLE_TO_ASSUME=<role_name>
+    for accountId in $ACCOUNTS_LIST; do
+    prowler aws --role arn:aws:iam::$accountId:role/$ROLE_TO_ASSUME
+done
+```
+
+## Scanning Multiple Accounts in Parallel
+
+- To scan multiple accounts simultaneously:
+
+Define the AWS accounts to be scanned with a variable:
+
+```
+ACCOUNTS_LIST='11111111111 2222222222 333333333'
+```
+
+- Run Prowler with an IAM role that exists in all target accounts: (replace the `<role_name>` with to yours, that is to be consistent throughout all accounts). The following example executes scanning across three accounts in parallel:
+
+```
+ROLE_TO_ASSUME=<role_name>
+PARALLEL_ACCOUNTS="3"
+for accountId in $ACCOUNTS_LIST; do
+    test "$(jobs | wc -l)" -ge $PARALLEL_ACCOUNTS && wait || true
+    {
+        prowler aws --role arn:aws:iam::$accountId:role/$ROLE_TO_ASSUME
+    } &
+done
+```
+
+## Scanning Multiple AWS Organization Accounts in Parallel
+
+Prowler enables parallel security scans across multiple AWS accounts within an AWS Organization.
+
+### Retrieve Active AWS Accounts
+
+To efficiently scan multiple accounts within an AWS Organization, follow these steps:
+
+- Step 1: Retrieve a List of Active Accounts
+
+First, declare a variable containing all active accounts in your AWS Organization. Run the following command in your AWS Organizations Management account, ensuring that you have the necessary permissions:
+
+```
+ACCOUNTS_IN_ORG=$(aws organizations list-accounts --query Accounts[?Status==`ACTIVE`].Id --output text)
+```
+
+- Step 2: Run Prowler with Assumed Roles
+
+Use Prowler to assume roles across accounts in parallel. Modify `<role_name>` to match the role that exists in all accounts and `<management_organizations_account_id>` to your AWS Organizations Management account ID.
+
+```
+ROLE_TO_ASSUME=<role_name>
+MGMT_ACCOUNT_ID=<management_organizations_account_id>
+PARALLEL_ACCOUNTS="3"
+for accountId in $ACCOUNTS_IN_ORG; do
+test "$(jobs | wc -l)" -ge $PARALLEL_ACCOUNTS && wait || true
+{
+    prowler aws --role arn:aws:iam::$accountId:role/$ROLE_TO_ASSUME \
+    --organizations-role arn:aws:iam::$MGMT_ACCOUNT_ID:role/$ROLE_TO_ASSUME
+} &
+done
+```
@@ -0,0 +1,155 @@
+---
+title: 'AWS Organizations in Prowler'
+---
+
+Prowler can integrate with AWS Organizations to manage the visibility and onboarding of accounts centrally.
+
+When trusted access is enabled with the Organization, Prowler can discover accounts as they are created and even automate deployment of the Prowler Scan IAM Role.
+
+> ℹ️ Trusted access can be enabled in the Management Account from the AWS Console under **AWS Organizations → Settings → Trusted access for AWS CloudFormation StackSets**.
+
+When not using StackSets or Prowler and only needing to scan AWS Organization accounts using the CLI, it is possible to assume a role in each account manually or automate that logic with custom scripts.
+
+## Retrieving AWS Account Details
+
+If AWS Organizations is enabled, Prowler can fetch detailed account information during scans, including:
+
+- Account Name
+- Email Address
+- ARN
+- Organization ID
+- Tags
+
+These details will be included alongside each security finding in the output.
+
+### Enabling AWS Organizations Data Retrieval
+
+To retrieve AWS Organizations account details, use the `-O`/`--organizations-role <organizations_role_arn>` argument. If this argument is not provided, Prowler will attempt to fetch the data automatically—provided the AWS account is a delegated administrator for the AWS Organization.
+
+<Note>
+For more information on AWS Organizations delegated administrator, refer to the official documentation [here](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_delegate_policies.html).
+
+</Note>
+The following command is an example:
+
+```shell
+prowler aws \
+  -O arn:aws:iam::<management_organizations_account_id>:role/<role_name>
+```
+
+<Note>
+Ensure the IAM role used in your AWS Organizations management account has the following permissions:`organizations:DescribeAccount` and `organizations:ListTagsForResource`.
+
+</Note>
+Prowler will scan the AWS account and get the account details from AWS Organizations.
+
+### Handling JSON Output
+
+In Prowler's JSON output, tags are encoded in Base64 to prevent formatting errors in CSV or JSON outputs. This ensures compatibility when exporting findings.
+
+```json
+  "Account Email": "my-prod-account@domain.com",
+  "Account Name": "my-prod-account",
+  "Account ARN": "arn:aws:organizations::222222222222:account/o-abcde1234/111111111111",
+  "Account Organization": "o-abcde1234",
+  "Account tags": "\"eyJUYWdzIjpasf0=\""
+```
+
+The additional fields in CSV header output are as follows:
+
+- ACCOUNT\_DETAILS\_EMAIL
+- ACCOUNT\_DETAILS\_NAME
+- ACCOUNT\_DETAILS\_ARN
+- ACCOUNT\_DETAILS\_ORG
+- ACCOUNT\_DETAILS\_TAGS
+
+## Deploying Prowler IAM Roles Across AWS Organizations
+
+When onboarding multiple AWS accounts into Prowler Cloud, it is important to deploy the Prowler Scan IAM Role in each account. The most efficient way to do this across an AWS Organization is by leveraging AWS CloudFormation StackSets, which rolls out infrastructure—like IAM roles—to all accounts centrally from the Management or Delegated Admin account.
+
+When using Infrastructure as Code (IaC), Terraform is recommended to manage this deployment systematically.
+
+### Recommended Approach
+
+- **Use StackSets** from the **Management Account** (or a Delegated Admin/Security Account).
+- **Use Terraform** to orchestrate the deployment.
+- **Use the official CloudFormation template** provided by Prowler.
+- Target specific Organizational Units (OUs) or the entire Organization.
+
+<Note>
+A detailed community article this implementation is based on is available here:
+[Deploy IAM Roles Across an AWS Organization as Code (Unicrons)](https://unicrons.cloud/en/2024/10/14/deploy-iam-roles-across-an-aws-organization-as-code/)
+This guide has been adapted with permission and aligned with Prowler’s IAM role requirements.
+
+</Note>
+---
+
+### Step-by-Step Guide Using Terraform
+
+Below is a ready Terraform snippet that deploys the [Prowler Scan IAM Role CloudFormation template](https://github.com/prowler-cloud/prowler/blob/master/permissions/templates/cloudformation/prowler-scan-role.yml) across the AWS Organization using StackSets:
+
+```hcl title="main.tf"
+data "aws_caller_identity" "this" {}
+
+data "aws_organizations_organization" "this" {}
+
+module "prowler-scan-role" {
+  source = "unicrons/organization-iam-role/aws"
+
+  stack_set_name        = "prowler-scan-role"
+  stack_set_description = "Deploy Prowler Scan IAM Role across all organization accounts"
+  template_path         = "${path.root}/prowler-scan-role.yaml"
+
+  template_parameters = {
+    ExternalId = "<< external ID >>"  # Replace with the External ID provided by Prowler Cloud
+  }
+
+  # Specific OU IDs can be specified instead of root
+  organizational_unit_ids = [data.aws_organizations_organization.this.roots[0].id]
+}
+```
+
+#### `prowler-scan-role.yaml`
+
+Download or reference the official CloudFormation template directly from GitHub:
+
+- [prowler-scan-role.yml](https://github.com/prowler-cloud/prowler/blob/master/permissions/templates/cloudformation/prowler-scan-role.yml)
+
+---
+
+### IAM Role: External ID Support
+
+Include the `ExternalId` parameter in the StackSet if required by the organization's Prowler Cloud setup. This ensures secure cross-account access for scanning.
+
+---
+
+When encountering issues during deployment or needing to target specific OUs or environments (e.g., dev/staging/prod), reach out to the Prowler team via [Slack Community](https://prowler.com/slack) or [Support](mailto:support@prowler.com).
+
+## Extra: Run Prowler across all accounts in AWS Organizations by assuming roles
+
+### Running Prowler Across All AWS Organization Accounts
+
+1. To run Prowler across all accounts in AWS Organizations, first retrieve a list of accounts that are not suspended:
+
+    ```shell
+    ACCOUNTS_IN_ORGS=$(aws organizations list-accounts \
+      --query "Accounts[?Status=='ACTIVE'].Id" \
+      --output text \
+    )
+    ```
+
+2. Then run Prowler to assume a role (same in all members) per each account:
+
+    ```shell
+    for accountId in $ACCOUNTS_IN_ORGS;
+    do
+      prowler aws \
+        -O arn:aws:iam::<management_organizations_account_id>:role/<role_name> \
+        -R arn:aws:iam::"${accountId}":role/<role_name>;
+    done
+    ```
+
+<Note>
+This same loop structure can be adapted to scan a predefined list of accounts using a variable like the following: `ACCOUNTS_LIST='11111111111 2222222222 333333333'`
+
+</Note>
@@ -0,0 +1,118 @@
+---
+title: 'AWS Regions and Partitions'
+---
+
+By default Prowler is able to scan the following AWS partitions:
+
+- Commercial: `aws`
+- China: `aws-cn`
+- GovCloud (US): `aws-us-gov`
+
+<Note>
+To check the available regions for each partition and service, refer to: [aws\_regions\_by\_service.json](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/aws/aws_regions_by_service.json)
+
+</Note>
+## Scanning AWS China and GovCloud Partitions in Prowler
+
+When scanning the China (`aws-cn`) or GovCloud (`aws-us-gov`), ensure one of the following:
+
+- Your AWS credentials include a valid region within the desired partition.
+
+- Specify the regions to audit within that partition using the `-f/--region` flag.
+
+<Note>
+Refer to: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html#configuring-credentials for more information about the AWS credential configuration.
+
+</Note>
+### Scanning Specific Regions
+
+To scan a particular AWS region with Prowler, use:
+
+```console
+prowler aws -f/--region eu-west-1 us-east-1
+```
+
+### AWS Credentials Configuration
+
+For details on configuring AWS credentials, refer to the following [Botocore](https://github.com/boto/botocore) [file](https://github.com/boto/botocore/blob/22a19ea7c4c2c4dd7df4ab8c32733cba0c7597a4/botocore/data/partitions.json).
+
+## Scanning AWS Partitions in Prowler
+
+### AWS China
+
+To scan an account in the AWS China partition (`aws-cn`):
+
+- By using the `-f/--region` flag:
+
+    ```
+    prowler aws --region cn-north-1 cn-northwest-1
+    ```
+
+- By using the region configured in your AWS profile at `~/.aws/credentials` or `~/.aws/config`:
+
+    ```
+    [default]
+    aws_access_key_id = XXXXXXXXXXXXXXXXXXX
+    aws_secret_access_key = XXXXXXXXXXXXXXXXXXX
+    region = cn-north-1
+    ```
+
+<Note>
+With this configuration, all partition regions will be scanned without needing the `-f/--region` flag
+
+</Note>
+### AWS GovCloud (US)
+
+To scan an account in the AWS GovCloud (US) partition (`aws-us-gov`):
+
+- By using the `-f/--region` flag:
+
+    ```
+    prowler aws --region us-gov-east-1 us-gov-west-1
+    ```
+
+- By using the region configured in your AWS profile at `~/.aws/credentials` or `~/.aws/config`:
+
+    ```
+    [default]
+    aws_access_key_id = XXXXXXXXXXXXXXXXXXX
+    aws_secret_access_key = XXXXXXXXXXXXXXXXXXX
+    region = us-gov-east-1
+    ```
+
+<Note>
+With this configuration, all partition regions will be scanned without needing the `-f/--region` flag
+
+</Note>
+### AWS ISO (US \& Europe)
+
+The AWS ISO partitions—commonly referred to as "secret partitions"—are air-gapped from the Internet, and Prowler does not have a built-in way to scan them. To audit an AWS ISO partition, manually update [aws\_regions\_by\_service.json](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/aws/aws_regions_by_service.json) to include the partition, region, and services. For example:
+
+```json
+"iam": {
+    "regions": {
+    "aws": [
+        "eu-west-1",
+        "us-east-1",
+    ],
+    "aws-cn": [
+        "cn-north-1",
+        "cn-northwest-1"
+    ],
+    "aws-us-gov": [
+        "us-gov-east-1",
+        "us-gov-west-1"
+    ],
+    "aws-iso": [
+        "aws-iso-global",
+        "us-iso-east-1",
+        "us-iso-west-1"
+    ],
+    "aws-iso-b": [
+        "aws-iso-b-global",
+        "us-isob-east-1"
+    ],
+    "aws-iso-e": [],
+    }
+},
+```
@@ -0,0 +1,15 @@
+---
+title: 'Resource ARN-based Scanning'
+---
+
+Prowler enables scanning of resources based on specific AWS Resource ARNs.
+
+## Resource ARN-Based Scanning
+
+Prowler enables scanning of resources based on specific AWS Resource [Amazon Resource Names (ARNs)](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html). To perform this scan, use the designated flag `--resource-arn` followed by one or more ARNs, separated by spaces.
+
+```
+prowler aws --resource-arn arn:aws:iam::012345678910:user/test arn:aws:ec2:us-east-1:123456789012:vpc/vpc-12345678
+```
+
+Example: This configuration scans only the specified two resources using their ARNs.
@@ -0,0 +1,79 @@
+---
+title: 'AWS Assume Role in Prowler (CLI)'
+---
+
+## Authentication Overview
+
+Prowler leverages the AWS SDK (Boto3) for authentication, following standard AWS authentication methods.
+
+### Running Prowler Against Multiple Accounts
+
+To execute Prowler across multiple AWS accounts using IAM Assume Role, choose one of the following approaches:
+
+1. Custom Profile Configuration
+
+    Set up a custom profile inside `~/.aws/config` with the necessary role information.
+
+    Then call the profile using `prowler aws -p/--profile your-custom-profile`.
+
+    - Role-Chaining Example Profile The `credential_source` parameter can be set to `Environment`, `Ec2InstanceMetadata`, or `EcsContainer`.
+
+    - Using an Alternative Named Profile
+
+        Instead of the `credential_source` parameter, `source_profile` can be used to specify a separate named profile.
+
+        This profile must contain IAM user credentials with permissions to assume the target role. For additional details, refer to the AWS Assume Role documentation: [here](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html).
+
+        ```
+        [profile crossaccountrole]
+        role_arn = arn:aws:iam::234567890123:role/SomeRole
+        credential_source = EcsContainer
+        ```
+
+2. Using IAM Role Assumption in Prowler
+
+    To allow Prowler to retrieve temporary credentials by using `Boto3` and run assessments on the specified account, use the `-R`/`--role <role_arn>` flag.
+
+    ```sh
+    prowler aws -R arn:aws:iam::<account_id>:role/<role_name>
+    ```
+
+    **Defining Session Duration and External ID**
+
+    Optionally, specify the session duration (in seconds, default: 3600) and the external ID for role assumption:
+
+    ```sh
+    prowler aws -T/--session-duration <seconds> -I/--external-id <external_id> -R arn:aws:iam::<account_id>:role/<role_name>
+    ```
+
+## Custom Role Session Name in Prowler
+
+### Setting a Custom Session Name
+
+Prowler allows you to specify a custom Role Session name using the following flag:
+
+```console
+prowler aws --role-session-name <role_session_name>
+```
+
+<Note>
+If not specified, it defaults to `ProwlerAssessmentSession`.
+
+</Note>
+## Role MFA Authentication
+
+If your IAM Role is configured with Multi-Factor Authentication (MFA), use `--mfa` along with `-R`/`--role <role_arn>`. Prowler will prompt you to input the following values to obtain a temporary session for the IAM Role provided:
+
+- ARN of your MFA device
+- TOTP (Time-Based One-Time Password)
+
+## Creating a Role for One or Multiple Accounts
+
+To create an IAM role that can be assumed in one or multiple AWS accounts, use either a CloudFormation Stack or StackSet and adapt the provided [template](https://github.com/prowler-cloud/prowler/blob/master/permissions/create_role_to_assume_cfn.yaml).
+
+<Note>
+**Session Duration Considerations**: Depending on the number of checks performed and the size of your infrastructure, Prowler may require more than 1 hour to complete. Use the `-T <seconds>` option to allow up to 12 hours (43,200 seconds). If you need more than 1 hour, modify the _“Maximum CLI/API session duration”_ setting for the role. Learn more [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session).
+
+⚠️ Important: If assuming roles via role chaining, there is a hard limit of 1 hour. Whenever possible, avoid role chaining to prevent session expiration issues. More details are available in footnote 1 below the table in the [AWS IAM guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html).
+
+</Note>
@@ -0,0 +1,37 @@
+---
+title: 'Sending Reports to an AWS S3 Bucket'
+---
+
+To save reports directly in an S3 bucket, use: `-B`/`--output-bucket`.
+
+```sh
+prowler aws -B my-bucket
+```
+
+### Custom Folder and Filename
+
+For a custom folder and/or filename, specify: `-o`/`--output-directory` and/or `-F`/`--output-filename`.
+
+```sh
+prowler aws \
+        -B my-bucket \
+        --output-directory test-folder \
+        --output-filename output-filename
+```
+
+### Custom Output Formats
+
+By default, Prowler sends HTML, JSON, and CSV output formats. To specify a single output format, use the `-M`/`--output-modes` flag.
+
+```sh
+prowler aws -M csv -B my-bucket
+```
+
+<Note>
+If you prefer using the initial credentials instead of the assumed role credentials for uploading reports, use `-D`/`--output-bucket-no-assume` instead of `-B`/`--output-bucket`.
+
+</Note>
+<Warning>
+Ensure the credentials used have write permissions for the `s3:PutObject` where reports will be uploaded.
+
+</Warning>
@@ -0,0 +1,166 @@
+---
+title: 'AWS Security Hub Integration with Prowler'
+---
+
+Prowler natively supports **official integration** with [AWS Security Hub](https://aws.amazon.com/security-hub), allowing security findings to be sent directly.  This integration enables **Prowler** to import its findings into AWS Security Hub.
+
+To activate the integration, follow these steps in at least one AWS region within your AWS account:
+
+## Enabling AWS Security Hub for Prowler Integration
+
+To enable the integration, follow these steps in **at least** one AWS region within your AWS account.
+
+Since **AWS Security Hub** is a region-based service, it must be activated in each region where security findings need to be collected.
+
+**Configuration Options**
+
+AWS Security Hub can be enabled using either of the following methods:
+
+<Note>
+Enabling this integration incurs costs in AWS Security Hub. Refer to [this information](https://aws.amazon.com/security-hub/pricing/) for details.
+
+</Note>
+### Using the AWS Management Console
+
+#### Enabling AWS Security Hub for Prowler Integration
+
+If AWS Security Hub is already enabled, you can proceed to the [next section](#enabling-prowler-integration-in-aws-security-hub).
+
+1. Enable AWS Security Hub via Console: Open the **AWS Security Hub** console: https://console.aws.amazon.com/securityhub/.
+
+2. Ensure you are in the correct AWS region, then select “**Go to Security Hub**”. ![](/images/providers/enable.png)
+
+3. In the “Security Standards” section, review the supported security standards. Select the checkbox for each standard you want to enable, or clear it to disable a standard.
+
+4. Choose “**Enable Security Hub**”. ![](/images/providers/enable-2.png)
+
+#### Enabling Prowler Integration in AWS Security Hub
+
+If the Prowler integration is already enabled in AWS Security Hub, you can proceed to the [next section](#sending-findings-to-aws-security-hub) and begin sending findings.
+
+Once **AWS Security Hub** is activated, **Prowler** must be enabled as partner integration to allow security findings to be sent to it.
+
+1. Enabling AWS Security Hub via Console
+Open the **AWS Security Hub** console: https://console.aws.amazon.com/securityhub/.
+
+2. Select the “**Integrations**” tab from the right-side menu bar. ![](/images/providers/enable-partner-integration.png)
+
+3. Search for “_Prowler_” in the text search box and the **Prowler** integration will appear.
+
+4. Click “**Accept Findings**” to authorize **AWS Security Hub** to receive findings from **Prowler**. ![](/images/providers/enable-partner-integration-2.png)
+
+5. A new modal will appear to confirm that the integration with **Prowler** is being enabled. ![](/images/providers/enable-partner-integration-3.png)
+
+6. Click “**Accept Findings**”, to authorize **AWS Security Hub** to receive findings from Prowler. ![](/images/providers/enable-partner-integration-4.png)
+
+### Using AWS CLI
+
+To enable **AWS Security Hub** and integrate **Prowler**, execute the following AWS CLI commands:
+
+**Step 1: Enable AWS Security Hub**
+
+Run the following command to activate AWS Security Hub in the desired region:
+
+```shell
+aws securityhub enable-security-hub --region <region>
+```
+
+<Note>
+This command requires the `securityhub:EnableSecurityHub` permission. Ensure you set the correct AWS region where you want to enable AWS Security Hub.
+
+</Note>
+**Step 2: Enable Prowler Integration**
+
+Once **AWS Security Hub** is activated, **Prowler** must be enabled as partner integration to allow security findings to be sent to it. Run the following AWS CLI commands:
+
+```shell
+aws securityhub enable-import-findings-for-product --region eu-west-1 --product-arn arn:aws:securityhub:<region>::product/prowler/prowler
+```
+
+<Note>
+Specify the AWS region where you want to enable the integration. Ensure the region is correctly set within the ARN value. This command requires the`securityhub:securityhub:EnableImportFindingsForProduct` permission.
+
+</Note>
+## Sending Findings to AWS Security Hub
+
+Once AWS Security Hub is enabled, findings can be sent using the following commands:
+
+For all regions:
+
+```sh
+prowler aws --security-hub
+```
+
+For a specific region (e.g., eu-west-1):
+
+```sh
+prowler --security-hub --region eu-west-1
+```
+
+<Note>
+It is recommended to send only fails to Security Hub and that is possible adding `--status FAIL` to the command. You can use, instead of the `--status FAIL` argument, the `--send-sh-only-fails` argument to save all the findings in the Prowler outputs but just to send FAIL findings to AWS Security Hub.
+
+Since Prowler perform checks to all regions by default you may need to filter by region when running Security Hub integration, as shown in the example above. Remember to enable Security Hub in the region or regions you need by calling `aws securityhub enable-security-hub --region <region>` and run Prowler with the option `-f/--region <region>` (if no region is used it will try to push findings in all regions hubs). Prowler will send findings to the Security Hub on the region where the scanned resource is located.
+
+To have updated findings in Security Hub you have to run Prowler periodically. Once a day or every certain amount of hours.
+
+</Note>
+### Viewing Prowler Findings in AWS Security Hub
+
+After enabling **AWS Security Hub**, findings from **Prowler** will be available in the configured AWS regions. Reviewing Prowler Findings in **AWS Security Hub**:
+
+1. Enabling AWS Security Hub via Console
+
+    Open the **AWS Security Hub** console: https://console.aws.amazon.com/securityhub/.
+
+2. Select the “**Findings**” tab from the right-side menu bar. ![](/images/providers/findings.png)
+
+3. Use the search box filters and apply the “**Product Name**” filter with the value _Prowler_ to display findings sent by **Prowler**.
+
+4. Click the check “**Title**” to access its detailed view, including its history and status. ![](/images/providers/finding-details.png)
+
+#### Compliance Information
+
+As outlined in the Requirements section, the detailed view includes compliance details for each finding reported by **Prowler**.
+
+## Sending Findings to Security Hub with IAM Role Assumption
+
+### Multi-Account AWS Auditing
+
+When auditing a multi-account AWS environment, Prowler allows you to send findings to a Security Hub in another account by assuming an IAM role from that target account.
+
+#### Using an IAM Role to Send Findings
+
+To send findings to Security Hub, use the `-R` flag in the Prowler command:
+
+```sh
+prowler --security-hub --role arn:aws:iam::123456789012:role/ProwlerExecutionRole
+```
+
+<Note>
+The specified IAM role must have the necessary permissions to send findings to Security Hub. For details on the required permissions, refer to the IAM policy: [prowler-additions-policy.json](https://github.com/prowler-cloud/prowler/blob/master/permissions/prowler-additions-policy.json)
+
+</Note>
+## Sending Only Failed Findings to AWS Security Hub
+
+When using **AWS Security Hub** integration, **Prowler** allows sending only failed findings (`FAIL`), helping reduce **AWS Security Hub** usage costs. To enable this, add the `--status FAIL` flag to the Prowler command:
+
+```sh
+prowler --security-hub --status FAIL
+```
+
+**Configuring Findings Output**
+
+Instead of using `--status FAIL`, the `--send-sh-only-fails` argument to store all findings in Prowler outputs while sending only FAIL findings to AWS Security:
+
+```sh
+prowler --security-hub --send-sh-only-fails
+```
+
+## Skipping Updates for Findings in Security Hub
+
+By default, Prowler archives any findings in Security Hub that were not detected in the latest scan. To prevent older findings from being archived, use the `--skip-sh-update` option:
+
+```sh
+prowler --security-hub --skip-sh-update
+```
@@ -0,0 +1,11 @@
+---
+title: 'Tag-based scan'
+---
+
+Prowler provides the capability to scan only resources containing specific tags. To execute this, use the designated flag `--resource-tags` followed by the tags `Key=Value`, separated by spaces.
+
+```
+prowler aws --resource-tags Environment=dev Project=prowler
+```
+
+This configuration scans only resources that contain both specified tags.
@@ -0,0 +1,35 @@
+---
+title: 'Threat Detection in AWS with Prowler'
+---
+
+Prowler enables threat detection in AWS by analyzing CloudTrail log records. To execute threat detection checks, use the following command:
+
+```
+prowler aws --category threat-detection
+```
+
+This command runs checks to detect:
+
+* `cloudtrail_threat_detection_privilege_escalation`: Privilege escalation attacks
+* `cloudtrail_threat_detection_enumeration`: Enumeration attacks
+* `cloudtrail_threat_detection_llm_jacking`: LLM Jacking attacks
+
+<Note>
+Threat detection checks are executed only when the `--category threat-detection` flag is used, due to performance considerations.
+
+</Note>
+## Config File for Threat Detection
+
+To manage the behavior of threat detection checks, edit the configuration file located in `config.yaml` file from `/prowler/config`. The following attributes can be modified, all related to threat detection:
+
+* `threat_detection_privilege_escalation_threshold`: Defines the percentage of actions required to classify an event as a privilege escalation attack. Default: 0.2 (20%)
+* `threat_detection_privilege_escalation_minutes`: Specifies the time window (in minutes) to search for privilege escalation attack patterns. Default: 1440 minutes (24 hours).
+* `threat_detection_privilege_escalation_actions`: Lists the default actions associated with privilege escalation attacks.
+* `threat_detection_enumeration_threshold`: Defines the percentage of actions required to classify an event as an enumeration attack. Default: 0.3 (30%)
+* `threat_detection_enumeration_minutes`: Specifies the time window (in minutes) to search for enumeration attack patterns. Default: 1440 minutes (24 hours).
+* `threat_detection_enumeration_actions`: Lists the default actions associated with enumeration attacks.
+* `threat_detection_llm_jacking_threshold`: Defines the percentage of actions required to classify an event as LLM jacking attack. Default: 0.4 (40%)
+* `threat_detection_llm_jacking_minutes`: Specifies the time window (in minutes) to search for LLM jacking attack patterns. Default: 1440 minutes (24 hours).
+* `threat_detection_llm_jacking_actions`: Lists the default actions associated with LLM jacking attacks.
+
+Modify these attributes in the configuration file to fine-tune threat detection checks based on your security requirements.
@@ -0,0 +1,258 @@
+---
+title: 'Check Mapping Prowler v4/v3 to v2'
+---
+
+Prowler v3 and v4 introduce distinct identifiers while preserving the checks originally implemented in v2. This change was made because, in previous versions, check names were primarily derived from the CIS Benchmark for AWS. Starting with v3 and v4, all checks are independent of any security framework and have unique names and IDs.
+
+For more details on the updated compliance implementation in Prowler v4 and v3, refer to the [Compliance](/user-guide/cli/tutorials/compliance) section.
+
+```
+checks_v4_v3_to_v2_mapping = {
+    "accessanalyzer_enabled_without_findings": "extra769",
+    "account_maintain_current_contact_details": "check117",
+    "account_security_contact_information_is_registered": "check118",
+    "account_security_questions_are_registered_in_the_aws_account": "check115",
+    "acm_certificates_expiration_check": "extra730",
+    "acm_certificates_transparency_logs_enabled": "extra724",
+    "apigateway_restapi_authorizers_enabled": "extra746",
+    "apigateway_restapi_client_certificate_enabled": "extra743",
+    "apigateway_restapi_public": "extra745",
+    "apigateway_restapi_logging_enabled": "extra722",
+    "apigateway_restapi_waf_acl_attached": "extra744",
+    “apigatewayv2_api_access_logging_enabled": "extra7156",
+    "apigatewayv2_api_authorizers_enabled": "extra7157",
+    "appstream_fleet_default_internet_access_disabled": "extra7193",
+    "appstream_fleet_maximum_session_duration": "extra7190",
+    "appstream_fleet_session_disconnect_timeout": "extra7191",
+    "appstream_fleet_session_idle_disconnect_timeout": "extra7192",
+    "autoscaling_find_secrets_ec2_launch_configuration": "extra775",
+    "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled": "extra720",
+    "awslambda_function_no_secrets_in_code": "extra760",
+    "awslambda_function_no_secrets_in_variables": "extra759",
+    "awslambda_function_not_publicly_accessible": "extra798",
+    "awslambda_function_url_cors_policy": "extra7180",
+    "awslambda_function_url_public": "extra7179",
+    "awslambda_function_using_supported_runtimes": "extra762",
+    "cloudformation_stack_outputs_find_secrets": "extra742",
+    "cloudformation_stacks_termination_protection_enabled": "extra7154",
+    "cloudfront_distributions_field_level_encryption_enabled": "extra767",
+    "cloudfront_distributions_geo_restrictions_enabled": "extra732",
+    "cloudfront_distributions_https_enabled": "extra738",
+    "cloudfront_distributions_logging_enabled": "extra714",
+    "cloudfront_distributions_using_deprecated_ssl_protocols": "extra791",
+    "cloudfront_distributions_using_waf": "extra773",
+    "cloudtrail_cloudwatch_logging_enabled": "check24",
+    "cloudtrail_kms_encryption_enabled": "check27",
+    "cloudtrail_log_file_validation_enabled": "check22",
+    "cloudtrail_logs_s3_bucket_access_logging_enabled": "check26",
+    "cloudtrail_logs_s3_bucket_is_not_publicly_accessible": "check23",
+    "cloudtrail_multi_region_enabled": "check21",
+    "cloudtrail_s3_dataevents_read_enabled": "extra7196",
+    "cloudtrail_s3_dataevents_write_enabled": "extra725",
+    "cloudwatch_changes_to_network_acls_alarm_configured": "check311",
+    "cloudwatch_changes_to_network_gateways_alarm_configured": "check312",
+    "cloudwatch_changes_to_network_route_tables_alarm_configured": "check313",
+    "cloudwatch_changes_to_vpcs_alarm_configured": "check314",
+    "cloudwatch_cross_account_sharing_disabled": "extra7144",
+    "cloudwatch_log_group_kms_encryption_enabled": "extra7164",
+    "cloudwatch_log_group_retention_policy_specific_days_enabled": "extra7162",
+    "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled": "check39",
+    "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled": "check35",
+    "cloudwatch_log_metric_filter_authentication_failures": "check36",
+    "cloudwatch_log_metric_filter_aws_organizations_changes": "extra7197",
+    "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk": "check37",
+    "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes": "check38",
+    "cloudwatch_log_metric_filter_policy_changes": "check34",
+    "cloudwatch_log_metric_filter_root_usage": "check33",
+    "cloudwatch_log_metric_filter_security_group_changes": "check310",
+    "cloudwatch_log_metric_filter_sign_in_without_mfa": "check32",
+    "cloudwatch_log_metric_filter_unauthorized_api_calls": "check31",
+    "codeartifact_packages_external_public_publishing_disabled": "extra7195",
+    "codebuild_project_older_90_days": "extra7174",
+    "codebuild_project_user_controlled_buildspec": "extra7175",
+    "config_recorder_all_regions_enabled": "check25",
+    "directoryservice_directory_log_forwarding_enabled": "extra7181",
+    "directoryservice_directory_monitor_notifications": "extra7182",
+    "directoryservice_directory_snapshots_limit": "extra7184",
+    "directoryservice_ldap_certificate_expiration": "extra7183",
+    "directoryservice_radius_server_security_protocol": "extra7188",
+    "directoryservice_supported_mfa_radius_enabled": "extra7189",
+    "dynamodb_accelerator_cluster_encryption_enabled": "extra7165",
+    "dynamodb_tables_kms_cmk_encryption_enabled": "extra7128",
+    "dynamodb_tables_pitr_enabled": "extra7151",
+    "ec2_ami_public": "extra76",
+    "ec2_ebs_default_encryption": "extra761",
+    "ec2_ebs_public_snapshot": "extra72",
+    "ec2_ebs_snapshots_encrypted": "extra740",
+    "ec2_ebs_volume_encryption": "extra729",
+    "ec2_elastic_ip_shodan": "extra7102",
+    "ec2_elastic_ip_unassigned": "extra7146",
+    "ec2_instance_imdsv2_enabled": "extra786",
+    "ec2_instance_internet_facing_with_instance_profile": "extra770",
+    "ec2_instance_managed_by_ssm": "extra7124",
+    "ec2_instance_older_than_specific_days": "extra758",
+    "ec2_instance_profile_attached": "check119",
+    "ec2_instance_public_ip": "extra710",
+    "ec2_instance_secrets_user_data": "extra741",
+    "ec2_networkacl_allow_ingress_any_port": "extra7138",
+    "ec2_networkacl_allow_ingress_tcp_port_22": "check45",
+    "ec2_networkacl_allow_ingress_tcp_port_3389": "check46",
+    "ec2_securitygroup_allow_ingress_from_internet_to_all_ports": "extra748",
+    "ec2_securitygroup_allow_ingress_from_internet_to_any_port": "extra74",
+    "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018": "extra753",
+    "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21": "extra7134",
+    "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22": "check41",
+    "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389": "check42",
+    "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888": "extra754",
+    "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601": "extra779",
+    "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092": "extra7135",
+    "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211": "extra755",
+    "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306": "extra750",
+    "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483": "extra749",
+    "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432": "extra751",
+    "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379": "extra752",
+    "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434": "extra7137",
+    "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23": "extra7136",
+    "ec2_securitygroup_allow_wide_open_public_ipv4": "extra778",
+    "ec2_securitygroup_default_restrict_traffic": "check43",
+    "ec2_securitygroup_from_launch_wizard": "extra7173",
+    "ec2_securitygroup_not_used": "extra75",
+    "ec2_securitygroup_with_many_ingress_egress_rules": "extra777",
+    "ecr_repositories_lifecycle_policy_enabled": "extra7194",
+    "ecr_repositories_not_publicly_accessible": "extra77",
+    "ecr_repositories_scan_images_on_push_enabled": "extra765",
+    "ecr_repositories_scan_vulnerabilities_in_latest_image": "extra776",
+    "ecs_task_definitions_no_environment_secrets": "extra768",
+    "efs_encryption_at_rest_enabled": "extra7161",
+    "efs_have_backup_enabled": "extra7148",
+    "efs_not_publicly_accessible": "extra7143",
+    "eks_cluster_kms_cmk_encryption_in_secrets_enabled": "extra797",
+    "eks_control_plane_endpoint_access_restricted": "extra796",
+    "eks_control_plane_logging_all_types_enabled": "extra794",
+    "eks_endpoints_not_publicly_accessible": "extra795",
+    "elb_insecure_ssl_ciphers": "extra792",
+    "elb_internet_facing": "extra79",
+    "elb_logging_enabled": "extra717",
+    "elb_ssl_listeners": "extra793",
+    "elbv2_deletion_protection": "extra7150",
+    "elbv2_desync_mitigation_mode": "extra7155",
+    "elbv2_insecure_ssl_ciphers": "extra792",
+    "elbv2_internet_facing": "extra79",
+    "elbv2_listeners_underneath": "extra7158",
+    "elbv2_logging_enabled": "extra717",
+    "elbv2_ssl_listeners": "extra793",
+    "elbv2_waf_acl_attached": "extra7129",
+    "emr_cluster_account_public_block_enabled": "extra7178",
+    "emr_cluster_master_nodes_no_public_ip": "extra7176",
+    "emr_cluster_publicly_accesible": "extra7177",
+    "glacier_vaults_policy_public_access": "extra7147",
+    "glue_data_catalogs_connection_passwords_encryption_enabled": "extra7117",
+    "glue_data_catalogs_metadata_encryption_enabled": "extra7116",
+    "glue_database_connections_ssl_enabled": "extra7115",
+    "glue_development_endpoints_cloudwatch_logs_encryption_enabled": "extra7119",
+    "glue_development_endpoints_job_bookmark_encryption_enabled": "extra7121",
+    "glue_development_endpoints_s3_encryption_enabled": "extra7114",
+    "glue_etl_jobs_amazon_s3_encryption_enabled": "extra7118",
+    "glue_etl_jobs_cloudwatch_logs_encryption_enabled": "extra7120",
+    "glue_etl_jobs_job_bookmark_encryption_enabled": "extra7122",
+    "guardduty_is_enabled": "extra713",
+    "guardduty_no_high_severity_findings": "extra7139",
+    "iam_administrator_access_with_mfa": "extra71",
+    "iam_avoid_root_usage": "check11",
+    "iam_check_saml_providers_sts": "extra733",
+    "iam_customer_attached_policy_no_administrative_privileges": "subset of check122",
+    "iam_customer_unattached_policy_no_administrative_privileges": "subset of check122",
+    "iam_no_custom_policy_permissive_role_assumption": "extra7100",
+    "iam_no_expired_server_certificates_stored": "extra7199",
+    "iam_no_root_access_key": "check112",
+    "iam_password_policy_expires_passwords_within_90_days_or_less": "check111",
+    "iam_password_policy_lowercase": "check16",
+    "iam_password_policy_minimum_length_14": "check19",
+    "iam_password_policy_number": "check18",
+    "iam_password_policy_reuse_24": "check110",
+    "iam_password_policy_symbol": "check17",
+    "iam_password_policy_uppercase": "check15",
+    "iam_policy_allows_privilege_escalation": "extra7185",
+    "iam_policy_attached_only_to_group_or_roles": "check116",
+    "iam_root_hardware_mfa_enabled": "check114",
+    "iam_root_mfa_enabled": "check113",
+    "iam_rotate_access_key_90_days": "check14",
+    "iam_support_role_created": "check120",
+    "iam_user_accesskey_unused": "subset of check13,extra774,extra7198",
+    "iam_user_console_access_unused": "subset of check13,extra774,extra7198",
+    "iam_user_hardware_mfa_enabled": "extra7125",
+    "iam_user_mfa_enabled_console_access": "check12",
+    "iam_user_no_setup_initial_access_key": "check121",
+    "iam_user_two_active_access_key": "extra7123",
+    "iam_role_cross_service_confused_deputy_prevention": "extra7201",
+    "kms_cmk_are_used": "extra7126",
+    "kms_cmk_rotation_enabled": "check28",
+    "kms_key_not_publicly_accessible": "extra736",
+    "macie_is_enabled": "extra712",
+    "opensearch_service_domains_audit_logging_enabled": "extra7101",
+    "opensearch_service_domains_cloudwatch_logging_enabled": "extra715",
+    "opensearch_service_domains_encryption_at_rest_enabled": "extra781",
+    "opensearch_service_domains_https_communications_enforced": "extra783",
+    "opensearch_service_domains_internal_user_database_enabled": "extra784",
+    "opensearch_service_domains_node_to_node_encryption_enabled": "extra782",
+    "opensearch_service_domains_not_publicly_accessible": "extra716",
+    "opensearch_service_domains_updated_to_the_latest_service_software_version": "extra785",
+    "opensearch_service_domains_use_cognito_authentication_for_kibana": "extra780",
+    "rds_instance_backup_enabled": "extra739",
+    "rds_instance_deletion_protection": "extra7113",
+    "rds_instance_enhanced_monitoring_enabled": "extra7132",
+    "rds_instance_integration_cloudwatch_logs": "extra747",
+    "rds_instance_minor_version_upgrade_enabled": "extra7131",
+    "rds_instance_multi_az": "extra7133",
+    "rds_instance_no_public_access": "extra78",
+    "rds_instance_storage_encrypted": "extra735",
+    "rds_snapshots_public_access": "extra723",
+    "redshift_cluster_audit_logging": "extra721",
+    "redshift_cluster_automated_snapshot": "extra7149",
+    "redshift_cluster_automatic_upgrades": "extra7160",
+    "redshift_cluster_public_access": "extra711",
+    "route53_domains_privacy_protection_enabled": "extra7152",
+    "route53_domains_transferlock_enabled": "extra7153",
+    "route53_public_hosted_zones_cloudwatch_logging_enabled": "extra719",
+    "s3_account_level_public_access_blocks": "extra7186",
+    "s3_bucket_acl_prohibited": "extra7172",
+    "s3_bucket_default_encryption": "extra734",
+    "s3_bucket_no_mfa_delete": "extra7200",
+    "s3_bucket_object_versioning": "extra763",
+    "s3_bucket_policy_public_write_access": "extra771",
+    "s3_bucket_public_access": "extra73",
+    "s3_bucket_secure_transport_policy": "extra764",
+    "s3_bucket_server_access_logging_enabled": "extra718",
+    "sagemaker_models_network_isolation_enabled": "extra7105",
+    "sagemaker_models_vpc_settings_configured": "extra7106",
+    "sagemaker_notebook_instance_encryption_enabled": "extra7112",
+    "sagemaker_notebook_instance_root_access_disabled": "extra7103",
+    "sagemaker_notebook_instance_vpc_settings_configured": "extra7104",
+    "sagemaker_notebook_instance_without_direct_internet_access_configured": "extra7111",
+    "sagemaker_training_jobs_intercontainer_encryption_enabled": "extra7107",
+    "sagemaker_training_jobs_network_isolation_enabled": "extra7109",
+    "sagemaker_training_jobs_volume_and_output_encryption_enabled": "extra7108",
+    "sagemaker_training_jobs_vpc_settings_configured": "extra7110",
+    "secretsmanager_automatic_rotation_enabled": "extra7163",
+    "securityhub_enabled": "extra799",
+    "shield_advanced_protection_in_associated_elastic_ips": "extra7166",
+    "shield_advanced_protection_in_classic_load_balancers": "extra7171",
+    "shield_advanced_protection_in_cloudfront_distributions": "extra7167",
+    "shield_advanced_protection_in_global_accelerators": "extra7169",
+    "shield_advanced_protection_in_internet_facing_load_balancers": "extra7170",
+    "shield_advanced_protection_in_route53_hosted_zones": "extra7168",
+    "sns_topics_kms_encryption_at_rest_enabled": "extra7130",
+    "sns_topics_not_publicly_accessible": "extra731",
+    "sqs_queues_not_publicly_accessible": "extra727",
+    "sqs_queues_server_side_encryption_enabled": "extra728",
+    "ssm_document_secrets": "extra7141",
+    "ssm_documents_set_as_public": "extra7140",
+    "ssm_managed_compliant_patching": "extra7127",
+    "trustedadvisor_errors_and_warnings": "extra726",
+    "vpc_endpoint_connections_trust_boundaries": "extra789",
+    "vpc_endpoint_services_allowed_principals_trust_boundaries": "extra790",
+    "vpc_flow_logs_enabled": "check29",
+    "vpc_peering_routing_tables_with_least_privilege": "check44",
+    "workspaces_volume_encryption_enabled": "extra7187",
+}
+```
@@ -0,0 +1,265 @@
+---
+title: 'Azure Authentication in Prowler'
+---
+
+Prowler for Azure supports multiple authentication types. Authentication methods vary between Prowler App and Prowler CLI:
+
+**Prowler App:**
+
+- [**Service Principal Application**](#service-principal-application-authentication-recommended)
+
+**Prowler CLI:**
+
+- [**Service Principal Application**](#service-principal-application-authentication-recommended) (**Recommended**)
+- [**AZ CLI credentials**](#az-cli-authentication)
+- [**Interactive browser authentication**](#browser-authentication)
+- [**Managed Identity Authentication**](#managed-identity-authentication)
+
+## Required Permissions
+
+Prowler for Azure requires two types of permission scopes:
+
+### Microsoft Entra ID Permissions
+
+These permissions allow Prowler to retrieve metadata from the assumed identity and perform specific Entra checks. While not mandatory for execution, they enhance functionality.
+
+#### Assigning Required API Permissions
+
+Assign the following Microsoft Graph permissions:
+
+- `Directory.Read.All`
+- `Policy.Read.All`
+- `UserAuthenticationMethod.Read.All` (optional, for multifactor authentication (MFA) checks)
+
+<Note>
+Replace `Directory.Read.All` with `Domain.Read.All` for more restrictive permissions. Note that Entra checks related to DirectoryRoles and GetUsers will not run with this permission.
+
+</Note>
+<Tabs>
+  <Tab title="Azure Portal">
+    1. Go to your App Registration > "API permissions"
+
+        ![API Permission Page](/images/providers/api-permissions-page.png)
+
+    2. Click "+ Add a permission" > "Microsoft Graph" > "Application permissions"
+
+        ![Add API Permission](/images/providers/add-api-permission.png)
+        ![Microsoft Graph Detail](/images/providers/microsoft-graph-detail.png)
+
+    3. Search and select:
+
+        - `Directory.Read.All`
+        - `Policy.Read.All`
+        - `UserAuthenticationMethod.Read.All`
+
+        ![Permission Screenshots](/images/providers/domain-permission.png)
+
+    4. Click "Add permissions", then grant admin consent
+
+        ![Grant Admin Consent](/images/providers/grant-admin-consent.png)
+  </Tab>
+  <Tab title="Azure CLI">
+    1. To grant permissions to a Service Principal, execute the following command in a terminal:
+
+        ```console
+        az ad app permission add --id {appId} --api 00000003-0000-0000-c000-000000000000 --api-permissions 7ab1d382-f21e-4acd-a863-ba3e13f7da61=Role 246dd0d5-5bd0-4def-940b-0421030a5b68=Role 38d9df27-64da-44fd-b7c5-a6fbac20248f=Role
+        ```
+  </Tab>
+</Tabs>
+### Subscription Scope Permissions
+
+These permissions are required to perform security checks against Azure resources. The following **RBAC roles** must be assigned per subscription to the entity used by Prowler:
+
+- `Reader` – Grants read-only access to Azure resources.
+- `ProwlerRole` – A custom role with minimal permissions needed for some specific checks, defined in the [prowler-azure-custom-role](https://github.com/prowler-cloud/prowler/blob/master/permissions/prowler-azure-custom-role.json).
+
+
+#### Assigning "Reader" Role at the Subscription Level
+By default, Prowler scans all accessible subscriptions. If you need to audit specific subscriptions, you must assign the necessary role `Reader` for each one. For streamlined and less repetitive role assignments in multi-subscription environments, refer to the [following section](/user-guide/providers/azure/subscriptions#recommendation-for-managing-multiple-subscriptions).
+
+<Tabs>
+  <Tab title="Azure Portal">
+    1. To grant Prowler access to scan a specific Azure subscription, follow these steps in Azure Portal:
+    Navigate to the subscription you want to audit with Prowler.
+
+    1. In the left menu, select "Access control (IAM)".
+
+    2. Click "+ Add" and select "Add role assignment".
+
+    3. In the search bar, enter `Reader`, select it and click "Next".
+
+    4. In the "Members" tab, click "+ Select members", then add the accounts to assign this role.
+
+    5. Click "Review + assign" to finalize and apply the role assignment.
+
+    ![Adding the Reader Role to a Subscription](/images/providers/add-reader-role.gif)
+  </Tab>
+  <Tab title="Azure CLI">
+    1. Open a terminal and execute the following command to assign the `Reader` role to the identity that is going to be assumed by Prowler:
+
+        ```console
+        az role assignment create --role "Reader" --assignee <user, group, or service principal> --scope /subscriptions/<subscription-id>
+        ```
+  </Tab>
+</Tabs>
+#### Assigning "ProwlerRole" Permissions at the Subscription Level
+
+Some read-only permissions required for specific security checks are not included in the built-in Reader role. To support these checks, Prowler utilizes a custom role, defined in [prowler-azure-custom-role](https://github.com/prowler-cloud/prowler/blob/master/permissions/prowler-azure-custom-role.json). Once created, this role can be assigned following the same process as the `Reader` role.
+
+The checks requiring this `ProwlerRole` can be found in this [section](/user-guide/providers/azure/authentication#checks-requiring-prowlerrole).
+
+<Tabs>
+  <Tab title="Azure Portal">
+    1. Download the [Prowler Azure Custom Role](https://github.com/prowler-cloud/prowler/blob/master/permissions/prowler-azure-custom-role.json)
+
+        ![Azure Custom Role](/images/providers/download-prowler-role.png)
+
+    2. Modify `assignableScopes` to match your Subscription ID (e.g. `/subscriptions/xxxx-xxxx-xxxx-xxxx`)
+
+    3. Go to your Azure Subscription > "Access control (IAM)"
+
+        ![IAM Page](/images/providers/iam-azure-page.png)
+
+    4. Click "+ Add" > "Add custom role", choose "Start from JSON" and upload the modified file
+
+        ![Add custom role via JSON](/images/providers/add-custom-role-json.png)
+
+    5. Click "Review + Create" to finish
+
+        ![Select review and create](/images/providers/review-and-create.png)
+
+    6. Return to "Access control (IAM)" > "+ Add" > "Add role assignment"
+
+        - Assign the `Reader` role to the Application created in the previous step
+        - Then repeat the same process assigning the custom `ProwlerRole`
+
+        ![Role Assignment](/images/providers/add-role-assigment.png)
+
+    <Note>
+        The `assignableScopes` field in the JSON custom role file must be updated to reflect the correct subscription or management group. Use one of the following formats: `/subscriptions/<subscription-id>` or `/providers/Microsoft.Management/managementGroups/<management-group-id>`.
+
+    </Note>
+  </Tab>
+  <Tab title="Azure CLI">
+    1. To create a new custom role, open a terminal and execute the following command:
+
+    ```console
+    az role definition create --role-definition '{                                                                                                                   640ms  lun 16 dic 17:04:17 2024
+                        "Name": "ProwlerRole",
+                        "IsCustom": true,
+                        "Description": "Role used for checks that require read-only access to Azure resources and are not covered by the Reader role.",
+                        "AssignableScopes": [
+                        "/subscriptions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" // USE YOUR SUBSCRIPTION ID
+                        ],
+                        "Actions": [
+                        "Microsoft.Web/sites/host/listkeys/action",
+                        "Microsoft.Web/sites/config/list/Action"
+                        ]
+                    }'
+    ```
+
+2. If the command is executed successfully, the output is going to be similar to the following:
+
+    ```json
+    {
+        "assignableScopes": [
+            "/subscriptions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
+        ],
+        "createdBy": null,
+        "createdOn": "YYYY-MM-DDTHH:MM:SS.SSSSSS+00:00",
+        "description": "Role used for checks that require read-only access to Azure resources and are not covered by the Reader role.",
+        "id": "/subscriptions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/providers/Microsoft.Authorization/roleDefinitions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
+        "name": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
+        "permissions": [
+            {
+                "actions": [
+                    "Microsoft.Web/sites/host/listkeys/action",
+                    "Microsoft.Web/sites/config/list/Action"
+                ],
+                "condition": null,
+                "conditionVersion": null,
+                "dataActions": [],
+                "notActions": [],
+                "notDataActions": []
+            }
+        ],
+        "roleName": "ProwlerRole",
+        "roleType": "CustomRole",
+        "type": "Microsoft.Authorization/roleDefinitions",
+        "updatedBy": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
+        "updatedOn": "YYYY-MM-DDTHH:MM:SS.SSSSSS+00:00"
+    }
+    ```
+  </Tab>
+</Tabs>
+
+### Additional Resources
+
+For more detailed guidance on subscription management and permissions:
+
+- [Azure subscription permissions](/user-guide/providers/azure/subscriptions)
+- [Create Prowler Service Principal](/user-guide/providers/azure/create-prowler-service-principal)
+
+<Warning>
+ Some permissions in `ProwlerRole` involve **write access**. If a `ReadOnly` lock is attached to certain resources, you may encounter errors, and findings for those checks will not be available.
+
+</Warning>
+#### Checks Requiring `ProwlerRole`
+
+The following security checks require the `ProwlerRole` permissions for execution. Ensure the role is assigned to the identity assumed by Prowler before running these checks:
+
+- `app_function_access_keys_configured`
+- `app_function_ftps_deployment_disabled`
+
+---
+
+## Service Principal Application Authentication (Recommended)
+
+This method is required for Prowler App and recommended for Prowler CLI.
+
+### Creating the Service Principal
+For more information, see [Creating Prowler Service Principal](/user-guide/providers/azure/create-prowler-service-principal).
+
+### Environment Variables (CLI)
+
+For Prowler CLI, set up the following environment variables:
+
+```console
+export AZURE_CLIENT_ID="XXXXXXXXX"
+export AZURE_TENANT_ID="XXXXXXXXX"
+export AZURE_CLIENT_SECRET="XXXXXXX"
+```
+
+Execution with the `--sp-env-auth` flag fails if these variables are not set or exported.
+
+## AZ CLI Authentication
+
+*Available only for Prowler CLI*
+
+Use stored Azure CLI credentials:
+
+```console
+prowler azure --az-cli-auth
+```
+
+## Managed Identity Authentication
+
+*Available only for Prowler CLI*
+
+Authenticate via Azure Managed Identity (when running on Azure resources):
+
+```console
+prowler azure --managed-identity-auth
+```
+
+## Browser Authentication
+
+*Available only for Prowler CLI*
+
+Authenticate using the default browser:
+
+```console
+prowler azure --browser-auth --tenant-id <tenant-id>
+```
+
+> **Note:** The `tenant-id` parameter is mandatory for browser authentication.
@@ -0,0 +1,64 @@
+---
+title: 'Creating a Prowler Service Principal Application'
+---
+
+To enable Prowler to assume an identity for scanning with the required privileges, a Service Principal must be created. This Service Principal authenticates against Azure and retrieves necessary metadata for checks.
+
+Service Principal Applications can be created using either the Azure Portal or the Azure CLI.
+
+![Registering an Application in Azure CLI for Prowler](/images/prowler-app/create-sp.gif)
+
+## Creating a Service Principal via Azure Portal / Entra Admin Center
+
+1. Access **Microsoft Entra ID** in the [Azure Portal](https://portal.azure.com)
+
+    ![Search Microsoft Entra ID](/images/providers/search-microsoft-entra-id.png)
+
+2. Navigate to "Manage" > "App registrations"
+
+    ![App Registration nav](/images/providers/app-registration-menu.png)
+
+3. Click "+ New registration", complete the form, and click "Register"
+
+    ![New Registration](/images/providers/new-registration.png)
+
+4. Go to "Certificates & secrets" > "+ New client secret"
+
+    ![Certificate & Secrets nav](/images/providers/certificates-and-secrets.png)
+    ![New Client Secret](/images/providers/new-client-secret.png)
+
+5. Fill in the required fields and click "Add", then copy the generated value
+
+| Value | Description |
+|-------|-----------|
+| Client ID | Application ID |
+| Client Secret | Secret to Connect to the App |
+| Tenant ID | Microsoft Entra Tenant ID |
+
+
+## Creating a Service Principal from Azure CLI
+
+To create a Service Principal using the Azure CLI, follow these steps:
+
+1. Open a terminal and execute the following command:
+
+      ```console
+      az ad sp create-for-rbac --name "ProwlerApp"
+      ```
+
+2. The output will be similar to:
+
+      ```json
+      {
+      "appId": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
+      "displayName": "ProwlerApp",
+      "password": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
+      "tenant": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
+      }
+      ```
+
+3. Save the values of `appId`, `password` and `tenant`, as they will be used as credentials in Prowler.
+
+## Assigning Proper Permissions
+
+Go to [Assigning Proper Permissions](/user-guide/providers/azure/authentication#required-permissions) to learn how to assign the necessary permissions to the Service Principal.
@@ -0,0 +1,140 @@
+---
+title: 'Getting Started With Azure on Prowler'
+---
+
+## Prowler App
+
+<iframe width="560" height="380" src="https://www.youtube-nocookie.com/embed/v1as8vTFlMg" title="Prowler Cloud Onboarding Azure" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="1"></iframe>
+> Walkthrough video onboarding an Azure Subscription using Service Principal.
+
+
+<Note>
+**Government Cloud Support**
+
+Government cloud subscriptions (Azure Government) are not currently supported, but we expect to add support for them in the near future.
+
+</Note>
+### Prerequisites
+
+Before setting up Azure in Prowler App, you need to create a Service Principal with proper permissions.
+
+For detailed instructions on how to create the Service Principal and configure permissions, see [Authentication > Service Principal](/user-guide/providers/azure/authentication#service-principal-application-authentication-recommended).
+
+---
+
+### Step 1: Get the Subscription ID
+
+1. Go to the [Azure Portal](https://portal.azure.com/#home) and search for `Subscriptions`
+2. Locate and copy your Subscription ID
+
+    ![Search Subscription](/images/providers/search-subscriptions.png)
+    ![Subscriptions Page](/images/providers/get-subscription-id.png)
+
+---
+
+### Step 2: Access Prowler App
+
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+2. Navigate to `Configuration` > `Cloud Providers`
+
+    ![Cloud Providers Page](/images/prowler-app/cloud-providers-page.png)
+
+3. Click on `Add Cloud Provider`
+
+    ![Add a Cloud Provider](/images/prowler-app/add-cloud-provider.png)
+
+4. Select `Microsoft Azure`
+
+    ![Select Microsoft Azure](/images/providers/select-azure-prowler-cloud.png)
+
+5. Add the Subscription ID and an optional alias, then click `Next`
+
+    ![Add Subscription ID](/images/providers/add-subscription-id.png)
+
+### Step 3: Add Credentials to Prowler App
+
+Having completed the [Service Principal setup from the Authentication guide](/user-guide/providers/azure/authentication#service-principal-application-authentication-recommended):
+
+1. Go to your App Registration overview and copy the `Client ID` and `Tenant ID`
+
+    ![App Overview](/images/providers/app-overview.png)
+
+2. Go to Prowler App and paste:
+
+    - `Client ID`
+    - `Tenant ID`
+    - `Client Secret` from [earlier](/user-guide/providers/azure/authentication#service-principal-application-authentication-recommended)
+
+    ![Prowler Cloud Azure Credentials](/images/providers/add-credentials-azure-prowler-cloud.png)
+
+3. Click `Next`
+
+    ![Next Detail](/images/providers/click-next-azure.png)
+
+4. Click "Launch Scan"
+
+    ![Launch Scan Azure](/images/providers/launch-scan.png)
+
+---
+
+## Prowler CLI
+
+### Configure Azure Credentials
+
+To authenticate with Azure, Prowler CLI supports multiple authentication methods. Choose the method that best suits your environment.
+
+For detailed authentication setup instructions, see [Authentication](/user-guide/providers/azure/authentication).
+
+**Service Principal (Recommended)**
+
+Set up environment variables:
+
+```console
+export AZURE_CLIENT_ID="XXXXXXXXX"
+export AZURE_TENANT_ID="XXXXXXXXX"
+export AZURE_CLIENT_SECRET="XXXXXXX"
+```
+
+Then run:
+
+```console
+prowler azure --sp-env-auth
+```
+
+**Azure CLI Credentials**
+
+Use stored Azure CLI credentials:
+
+```console
+prowler azure --az-cli-auth
+```
+
+**Browser Authentication**
+
+Authenticate using your default browser:
+
+```console
+prowler azure --browser-auth --tenant-id <tenant-id>
+```
+
+**Managed Identity**
+
+When running on Azure resources:
+
+```console
+prowler azure --managed-identity-auth
+```
+
+### Subscription Selection
+
+To scan a specific Azure subscription:
+
+```console
+prowler azure --subscription-ids <subscription-id>
+```
+
+To scan multiple Azure subscriptions:
+
+```console
+prowler azure --subscription-ids <subscription-id1> <subscription-id2> <subscription-id3>
+```
@@ -0,0 +1,38 @@
+---
+title: 'Azure Subscription Scope'
+---
+
+Prowler performs security scans within the subscription scope in Azure. To execute checks, it requires appropriate permissions to access the subscription and retrieve necessary metadata.
+
+By default, Prowler operates multi-subscription, scanning all subscriptions it has permission to list. If permissions are granted for only a single subscription, Prowler will limit scans to that subscription.
+
+## Configuring Specific Subscription Scans in Prowler
+
+Additionally, Prowler supports restricting scans to specific subscriptions by passing a set of subscription IDs as an input argument. To configure this limitation, use the appropriate command options:
+
+```console
+prowler azure --az-cli-auth --subscription-ids <subscription ID 1> <subscription ID 2> ... <subscription ID N>
+```
+
+Prowler allows you to specify one or more subscriptions for scanning (up to N), enabling flexible audit configurations.
+
+<Warning>
+The multi-subscription feature is available only in the CLI. In Prowler App, each scan is limited to a single subscription.
+
+</Warning>
+## Assigning Permissions for Subscription Scans
+Check the [Authentication > Subscription Scope Permissions](/user-guide/providers/azure/authentication#subscription-scope-permissions) guide for more information on how to assign permissions for subscription scans.
+
+## Recommendation for Managing Multiple Subscriptions
+
+Scanning multiple subscriptions requires creating and assigning roles for each, which can be a time-consuming process. To streamline subscription management and auditing, use management groups in Azure. This approach allows Prowler to efficiently organize and audit multiple subscriptions collectively.
+
+1. **Create a Management Group**: Follow the [official guide](https://learn.microsoft.com/en-us/azure/governance/management-groups/create-management-group-portal) to create a new management group.
+
+    ![Create management group](/images/create-management-group.gif)
+
+2. **Assign Roles**: Assign necessary roles to the management group, similar to the [role assignment process](#assigning-permissions-for-subscription-scans).
+
+    Role assignment should be done at the management group level instead of per subscription.
+
+3. **Add Subscriptions**: Add all subscriptions you want to audit to the newly created management group. ![Add Subscription to Management Group](/images/add-sub-to-management-group.gif)
@@ -0,0 +1,17 @@
+---
+title: 'Using Non-Default Azure Regions'
+---
+
+Microsoft offers cloud environments that comply with regional regulations. These clouds are available for use based on your requirements. By default, Prowler utilizes the commercial `AzureCloud` environment. (To list all available Azure clouds, use `az cloud list --output table`).
+
+As of this documentation's publication, the following Azure clouds are available:
+
+- AzureCloud
+- AzureChinaCloud
+- AzureUSGovernment
+
+To change the default cloud, include the flag `--azure-region`. For example:
+
+```console
+prowler azure --az-cli-auth --azure-region AzureChinaCloud
+```
@@ -0,0 +1,165 @@
+---
+title: 'GCP Authentication in Prowler'
+---
+
+Prowler for Google Cloud supports multiple authentication methods. To use a specific method, configure the appropriate credentials during execution:
+
+- [**User Credentials** (Application Default Credentials)](#application-default-credentials-user-credentials)
+- [**Service Account Key File**](#service-account-key-file)
+- [**Access Token**](#access-token)
+- [**Service Account Impersonation**](#service-account-impersonation)
+
+## Required Permissions
+
+Prowler for Google Cloud requires the following permissions:
+
+### IAM Roles
+- **Reader (`roles/reader`)** – Must be granted at the **project, folder, or organization** level to allow scanning of target projects.
+
+### Project-Level Settings
+
+At least one project must have the following configurations:
+
+- **Identity and Access Management (IAM) API (`iam.googleapis.com`)** – Must be enabled via:
+
+    - The [Google Cloud API UI](https://console.cloud.google.com/apis/api/iam.googleapis.com/metrics), or
+    - The `gcloud` CLI:
+    ```sh
+    gcloud services enable iam.googleapis.com --project <your-project-id>
+    ```
+
+- **Service Usage Consumer (`roles/serviceusage.serviceUsageConsumer`)** IAM Role – Required for resource scanning.
+
+- **Quota Project Setting** – Define a quota project using either:
+
+    - The `gcloud` CLI:
+    ```sh
+    gcloud auth application-default set-quota-project <project-id>
+    ```
+    - Setting an environment variable:
+    ```sh
+    export GOOGLE_CLOUD_QUOTA_PROJECT=<project-id>
+    ```
+
+<Note>
+Prowler will scan the GCP project associated with the credentials.
+
+
+</Note>
+## Application Default Credentials (User Credentials)
+
+This method uses the Google Cloud CLI to authenticate and is suitable for development and testing environments.
+
+### Setup Application Default Credentials
+
+1. In the [GCP Console](https://console.cloud.google.com/), click on "Activate Cloud Shell"
+
+    ![Activate Cloud Shell](/images/providers/access-console.png)
+
+2. Click "Authorize Cloud Shell"
+
+    ![Authorize Cloud Shell](/images/providers/authorize-cloud-shell.png)
+
+3. Run the following command:
+
+    ```bash
+    gcloud auth application-default login
+    ```
+
+    - Type `Y` when prompted
+
+    ![Run Gcloud Auth](/images/providers/run-gcloud-auth.png)
+
+4. Open the authentication URL provided in a browser and select your Google account
+
+    ![Choose the account](/images/providers/take-account-email.png)
+
+5. Follow the steps to obtain the authentication code
+
+    ![Copy auth code](/images/providers/copy-auth-code.png)
+
+6. Paste the authentication code back in Cloud Shell
+
+    ![Enter Auth Code](/images/providers/enter-auth-code.png)
+
+7. Use `cat <file_name>` to view the temporary credentials file
+
+    ![Get the FileName](/images/providers/get-temp-file-credentials.png)
+
+8. Extract the following values for Prowler Cloud/App:
+
+    - `client_id`
+    - `client_secret`
+    - `refresh_token`
+
+    ![Get the values](/images/providers/get-needed-values-auth.png)
+
+### Using with Prowler CLI
+
+Once application default credentials are set up, run Prowler directly:
+
+```console
+prowler gcp --project-ids <project-id>
+```
+
+## Service Account Key File
+
+This method uses a service account with a downloaded key file for authentication.
+
+### Create Service Account and Key
+
+1. Go to the [Service Accounts page](https://console.cloud.google.com/iam-admin/serviceaccounts) in the GCP Console
+2. Click "Create Service Account"
+3. Fill in the service account details and click "Create and Continue"
+4. Grant the service account the "Reader" role
+5. Click "Done"
+6. Find your service account in the list and click on it
+7. Go to the "Keys" tab
+8. Click "Add Key" > "Create new key"
+9. Select "JSON" and click "Create"
+10. Save the downloaded key file securely
+
+### Using with Prowler CLI
+
+Set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable:
+
+```console
+export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account-key.json"
+prowler gcp --project-ids <project-id>
+```
+
+## Access Token
+
+For existing access tokens (e.g., generated with `gcloud auth print-access-token`), run Prowler with:
+
+```bash
+export CLOUDSDK_AUTH_ACCESS_TOKEN=$(gcloud auth print-access-token)
+prowler gcp --project-ids <project-id>
+```
+
+<Note>
+When using this method, also set the default project explicitly:
+```bash
+export GOOGLE_CLOUD_PROJECT=<project-id>
+```
+
+</Note>
+## Service Account Impersonation
+
+To impersonate a GCP service account, use the `--impersonate-service-account` argument followed by the service account email:
+
+```console
+prowler gcp --impersonate-service-account <service-account-email>
+```
+
+This command leverages the default credentials to impersonate the specified service account.
+
+### Prerequisites for Impersonation
+
+The identity running Prowler must have the following permission on the target service account:
+
+- `roles/iam.serviceAccountTokenCreator`
+
+Or the more specific permission:
+
+- `iam.serviceAccounts.generateAccessToken`
@@ -0,0 +1,125 @@
+---
+title: 'Getting Started With GCP on Prowler'
+---
+
+## Prowler App
+
+### Step 1: Get the GCP Project ID
+
+1. Go to the [GCP Console](https://console.cloud.google.com/)
+2. Locate the Project ID on the welcome screen
+
+![Get the Project ID](/images/providers/project-id-console.png)
+
+### Step 2: Access Prowler Cloud or Prowler App
+
+1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
+2. Go to "Configuration" > "Cloud Providers"
+
+    ![Cloud Providers Page](/images/prowler-app/cloud-providers-page.png)
+
+3. Click "Add Cloud Provider"
+
+    ![Add a Cloud Provider](/images/prowler-app/add-cloud-provider.png)
+
+4. Select "Google Cloud Platform"
+
+    ![Select GCP](/images/providers/select-gcp.png)
+
+5. Add the Project ID and optionally provide a provider alias, then click "Next"
+
+    ![Add Project ID](/images/providers/add-project-id.png)
+
+### Step 3: Set Up GCP Authentication
+
+Choose the preferred authentication mode before proceeding:
+
+**User Credentials (Application Default Credentials)**
+
+* Quick scan as current user
+* Uses Google Cloud CLI authentication
+* Credentials may time out
+
+**Service Account Key File**
+
+* Authenticates as a service identity
+* Stable and auditable
+* Recommended for production
+
+For detailed instructions on how to set up authentication, see [Authentication](/user-guide/providers/gcp/authentication).
+
+6. Once credentials are configured, return to Prowler App and enter the required values:
+
+    For "Service Account Key":
+
+    - `Service Account Key JSON`
+
+    For "Application Default Credentials":
+
+    - `client_id`
+    - `client_secret`
+    - `refresh_token`
+
+    ![Enter the Credentials](/images/providers/enter-credentials-prowler-cloud.png)
+
+7. Click "Next", then "Launch Scan"
+
+    ![Launch Scan GCP](/images/providers/launch-scan.png)
+
+---
+
+## Prowler CLI
+
+### Credentials Lookup Order
+
+Prowler follows the same credential search process as [Google authentication libraries](https://cloud.google.com/docs/authentication/application-default-credentials#search_order), checking credentials in this order:
+
+1. [`GOOGLE_APPLICATION_CREDENTIALS` environment variable](https://cloud.google.com/docs/authentication/application-default-credentials#GAC)
+2. [`CLOUDSDK_AUTH_ACCESS_TOKEN` + optional `GOOGLE_CLOUD_PROJECT`](https://cloud.google.com/sdk/gcloud/reference/auth/print-access-token)
+3. [User credentials set up by using the Google Cloud CLI](https://cloud.google.com/docs/authentication/application-default-credentials#personal)
+4. [Attached service account (e.g., Cloud Run, GCE, Cloud Functions)](https://cloud.google.com/docs/authentication/application-default-credentials#attached-sa)
+
+<Note>
+The credentials must belong to a user or service account with the necessary permissions.
+For detailed instructions on how to set the permissions, see [Authentication > Required Permissions](/user-guide/providers/gcp/authentication#required-permissions).
+
+</Note>
+<Note>
+Prowler will use the enabled Google Cloud APIs to get the information needed to perform the checks.
+
+</Note>
+### Configure GCP Credentials
+
+To authenticate with GCP, use one of the following methods:
+
+```console
+gcloud auth application-default login
+```
+
+or set the credentials file path:
+
+```console
+export GOOGLE_APPLICATION_CREDENTIALS="/path/to/credentials.json"
+```
+
+These credentials must belong to a user or service account with the necessary permissions to perform security checks.
+
+For more authentication details, see the [Authentication](/user-guide/providers/gcp/authentication) page.
+
+### Project Specification
+
+To scan specific projects, specify them with the following command:
+
+```console
+prowler gcp --project-ids <project-id-1> <project-id-2>
+```
+
+### Service Account Impersonation
+
+For service account impersonation, use the `--impersonate-service-account` flag:
+
+```console
+prowler gcp --impersonate-service-account <service-account-email>
+```
+
+More details on authentication methods in the [Authentication](/user-guide/providers/gcp/authentication) page.