+
## Key Concepts
@@ -47,8 +47,8 @@ Prowler requires **two separate IAM roles** deployed in different places, each w
| Role | Where it lives | What it does | How to deploy it |
|------|---------------|--------------|------------------|
-| **ProwlerScan** (management account) | Your management (root) account only | Discovers the Organization structure **and** scans the management account. Has additional Organizations discovery permissions. | Via **Quick Create** link or **manually** in the IAM Console ([Step 1](#step-1-create-the-management-account-role)). Cannot be deployed via StackSet. |
-| **ProwlerScan** (member accounts) | Every member account | Scans the account for security findings. | Via **CloudFormation StackSet** ([Step 2](#step-2-deploy-the-cloudformation-stackset)). Automated across all accounts. |
+| **ProwlerScan** (management account) | Your management (root) account only | Discovers the Organization structure **and** scans the management account. Has additional Organizations discovery permissions. | By the wizard's **single stack** ([Step 4](#step-4-authenticate-with-your-management-account)), or on its own via **Quick Create** link or **manually** in the IAM Console ([Step 1](#step-1-create-the-management-account-role)). Cannot be deployed via StackSet. |
+| **ProwlerScan** (member accounts) | Every member account | Scans the account for security findings. | By the wizard's **single stack** ([Step 4](#step-4-authenticate-with-your-management-account)), or on its own via a **CloudFormation StackSet** ([Step 2](#step-2-deploy-the-cloudformation-stackset)). Automated across all accounts. |
@@ -77,7 +77,7 @@ Your AWS environment must have [AWS Organizations](https://docs.aws.amazon.com/o
The first role you need to create is the **management account role**. This role allows Prowler to discover your Organization structure — listing accounts, OUs, and hierarchy.
+
-### Enter the Management Account Role ARN
+### Enter the Deployment Account Role ARN
-Paste the **Role ARN** of the management account role you created in [Step 1](#step-1-create-the-management-account-role) into the **Management Account Role ARN** field.
+Paste the **Role ARN** created by the single stack above into the **Management Account Role ARN** field or, when delegated administrator mode is selected, the **Delegated Administrator Account Role ARN** field. If you deployed the management account role beforehand, use the role created in [Step 1](#step-1-create-the-management-account-role).
The ARN follows this format:
```
@@ -312,12 +331,12 @@ arn:aws:iam::
+
### Confirm and Discover
-1. Check the box: **"The Stack and StackSet have been successfully deployed in AWS"**.
+1. Check the box: **"The Stack has been successfully deployed in AWS"**.
2. Click **Authenticate**.
Here's what happens behind the scenes:
diff --git a/ui/actions/organizations/organizations.adapter.test.ts b/ui/actions/organizations/organizations.adapter.test.ts
index 07cff60c0c..41e0b8d89f 100644
--- a/ui/actions/organizations/organizations.adapter.test.ts
+++ b/ui/actions/organizations/organizations.adapter.test.ts
@@ -11,6 +11,7 @@ import {
buildOrgTreeData,
getOuIdsForSelectedAccounts,
getSelectableAccountIds,
+ getSelectableAccountIdsForTarget,
} from "./organizations.adapter";
const discoveryFixture: DiscoveryResult = {
@@ -164,6 +165,68 @@ describe("buildAccountLookup", () => {
});
});
+describe("getSelectableAccountIdsForTarget", () => {
+ it("scopes selection to accounts under a target OU, including nested OUs", () => {
+ // ou-parent contains ou-child (holds 111...) and the blocked 222...
+ const scoped = getSelectableAccountIdsForTarget(
+ discoveryFixture,
+ "ou-parent",
+ );
+
+ // Only the selectable descendant is returned; blocked 222... is excluded,
+ // and 333... (under the root, outside the OU) is not included.
+ expect(scoped).toEqual(["111111111111"]);
+ });
+
+ it("scopes selection to a leaf OU", () => {
+ const scoped = getSelectableAccountIdsForTarget(
+ discoveryFixture,
+ "ou-child",
+ );
+
+ expect(scoped).toEqual(["111111111111"]);
+ });
+
+ it("includes the deployment account even when it lives outside the target OU", () => {
+ // Deployment (management) account 333... sits under the root, but gets the
+ // role via DeployLocalRole, so it must be pre-selected alongside the OU.
+ const scoped = getSelectableAccountIdsForTarget(
+ discoveryFixture,
+ "ou-child",
+ "333333333333",
+ );
+
+ expect(scoped).toEqual(["111111111111", "333333333333"]);
+ });
+
+ it("does not include a deployment account that is not selectable", () => {
+ // 222... is blocked, so even as the deployment account it stays unselected.
+ const scoped = getSelectableAccountIdsForTarget(
+ discoveryFixture,
+ "ou-child",
+ "222222222222",
+ );
+
+ expect(scoped).toEqual(["111111111111"]);
+ });
+
+ it("returns every selectable account for a root target (whole organization)", () => {
+ const scoped = getSelectableAccountIdsForTarget(discoveryFixture, "r-root");
+
+ expect(scoped).toEqual(["111111111111", "333333333333"]);
+ });
+
+ it("falls back to all selectable accounts for an empty or unknown target", () => {
+ expect(getSelectableAccountIdsForTarget(discoveryFixture, "")).toEqual([
+ "111111111111",
+ "333333333333",
+ ]);
+ expect(
+ getSelectableAccountIdsForTarget(discoveryFixture, "ou-does-not-exist"),
+ ).toEqual(["111111111111", "333333333333"]);
+ });
+});
+
describe("getOuIdsForSelectedAccounts", () => {
it("collects all ancestor OUs for selected accounts without duplicates", () => {
const ouIds = getOuIdsForSelectedAccounts(discoveryFixture, [
diff --git a/ui/actions/organizations/organizations.adapter.ts b/ui/actions/organizations/organizations.adapter.ts
index e120a1a3dc..2b0c7b5a0b 100644
--- a/ui/actions/organizations/organizations.adapter.ts
+++ b/ui/actions/organizations/organizations.adapter.ts
@@ -109,6 +109,71 @@ export function buildAccountLookup(
return map;
}
+/**
+ * Returns the selectable account IDs that fall under a deployment target
+ * (an OU or root ID), optionally including the deployment account itself.
+ *
+ * The StackSet only rolls the role out to member accounts beneath the chosen
+ * target, and the deployment (management or delegated administrator) account
+ * gets the role via DeployLocalRole even though it usually lives outside that
+ * target. Pre-selecting exactly those accounts keeps the confirmation step in
+ * sync with what was actually deployed.
+ *
+ * Falls back to every selectable account when the target is empty or is not
+ * part of this discovery (e.g. a root ID), preserving the whole-organization
+ * default.
+ */
+export function getSelectableAccountIdsForTarget(
+ result: DiscoveryResult,
+ targetId: string,
+ deploymentAccountId?: string,
+): string[] {
+ const selectableAccountIds = getSelectableAccountIds(result);
+ const normalizedTarget = targetId.trim();
+
+ if (!normalizedTarget) {
+ return selectableAccountIds;
+ }
+
+ const isKnownOu = result.organizational_units.some(
+ (ou) => ou.id === normalizedTarget,
+ );
+
+ // Only a specific OU narrows the selection. A root ID (whole org) or an
+ // unknown target keeps the whole-organization default.
+ if (!isKnownOu) {
+ return selectableAccountIds;
+ }
+
+ // Collect the target OU plus all of its nested descendant OUs.
+ const scopeIds = new Set
+
+ );
+
const renderStepContent = () => {
// If editing credentials, show only credentials form
if (isEditingCredentials || currentStep === 1) {
@@ -265,17 +336,21 @@ export const S3IntegrationForm = ({
externalId,
bucketName,
"amazon_s3",
+ resolvedBucketAccountId,
);
return (
- + {derivedBucketAccountId + ? `Leave empty to use selected AWS account ${derivedBucketAccountId}, or enter another bucket owner account ID.` + : "Required because the selected provider does not identify the AWS account that owns the bucket."} +
+
+ {isEditingCredentials && renderBucketAccountIdField()}
+ }
+ setValue={form.setValue as any}
+ externalId={externalId}
+ templateLinks={templateLinks}
+ type="integrations"
+ integrationType="amazon_s3"
+ />
+
);
}
@@ -346,6 +421,8 @@ export const S3IntegrationForm = ({
variant="bordered"
isRequired
/>
+
+ {!isEditingConfig && renderBucketAccountIdField()}
);
diff --git a/ui/components/providers/organizations/hooks/use-org-setup-submission.ts b/ui/components/providers/organizations/hooks/use-org-setup-submission.ts
index b11903b48f..3d77ceff7a 100644
--- a/ui/components/providers/organizations/hooks/use-org-setup-submission.ts
+++ b/ui/components/providers/organizations/hooks/use-org-setup-submission.ts
@@ -11,7 +11,7 @@ import {
triggerDiscovery,
updateOrganizationSecret,
} from "@/actions/organizations/organizations";
-import { getSelectableAccountIds } from "@/actions/organizations/organizations.adapter";
+import { getSelectableAccountIdsForTarget } from "@/actions/organizations/organizations.adapter";
import { useOrgSetupStore } from "@/store/organizations/store";
import { DISCOVERY_STATUS, DiscoveryResult } from "@/types/organizations";
@@ -43,6 +43,9 @@ interface OrgSetupSubmissionData {
organizationName?: string;
awsOrgId: string;
roleArn: string;
+ // OU or root ID the StackSet was deployed to. Used to scope the default
+ // account selection to what was actually rolled out.
+ organizationalUnitId?: string;
}
interface UseOrgSetupSubmissionProps {
@@ -295,8 +298,15 @@ export function useOrgSetupSubmission({
return;
}
- const selectableAccountIds = getSelectableAccountIds(
+ // The deployment (management/delegated admin) account is where the local
+ // role is created; its ID is the one embedded in the Role ARN.
+ const deploymentAccountId = data.roleArn.match(
+ /^arn:aws:iam::(\d{12}):role\//,
+ )?.[1];
+ const selectableAccountIds = getSelectableAccountIdsForTarget(
resolvedDiscoveryResult,
+ data.organizationalUnitId ?? "",
+ deploymentAccountId,
);
setDiscovery(discoveryId, resolvedDiscoveryResult);
setSelectedAccountIds(selectableAccountIds);
diff --git a/ui/components/providers/organizations/org-setup-form.test.tsx b/ui/components/providers/organizations/org-setup-form.test.tsx
new file mode 100644
index 0000000000..329d6fe05c
--- /dev/null
+++ b/ui/components/providers/organizations/org-setup-form.test.tsx
@@ -0,0 +1,121 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { useOrgSetupStore } from "@/store/organizations/store";
+import { ORG_SETUP_PHASE } from "@/types/organizations";
+
+import { OrgSetupForm } from "./org-setup-form";
+
+const {
+ setApiErrorMock,
+ submitOrganizationSetupMock,
+ updateOrganizationNameMock,
+} = vi.hoisted(() => ({
+ setApiErrorMock: vi.fn(),
+ submitOrganizationSetupMock: vi.fn(),
+ updateOrganizationNameMock: vi.fn(),
+}));
+
+vi.mock("@/actions/organizations/organizations", () => ({
+ updateOrganizationName: updateOrganizationNameMock,
+}));
+
+vi.mock("@/lib", () => ({
+ getAWSOrgDeploymentQuickLink: ({
+ deployFromDelegatedAdmin,
+ }: {
+ deployFromDelegatedAdmin?: boolean;
+ }) => {
+ const params = new URLSearchParams();
+ if (deployFromDelegatedAdmin) {
+ params.set("param_DeployFromDelegatedAdmin", "true");
+ }
+ return `https://console.aws.amazon.com/#/quick-create?${params.toString()}`;
+ },
+}));
+
+vi.mock("next-auth/react", () => ({
+ useSession: () => ({
+ data: {
+ tenantId: "tenant&id",
+ },
+ }),
+}));
+
+vi.mock("./hooks/use-org-setup-submission", () => ({
+ useOrgSetupSubmission: () => ({
+ apiError: null,
+ setApiError: setApiErrorMock,
+ submitOrganizationSetup: submitOrganizationSetupMock,
+ }),
+}));
+
+function renderOrgSetupForm() {
+ return render(
+ - 1) Deploy the ProwlerScan role in your{" "} - management account using a CloudFormation - Stack. + 1) Choose the AWS Organizational Unit (or root) + to deploy to. Prowler creates the role in your deployment + account and rolls it out to every member account under this + target.
- +
+ Find this in the AWS Organizations console. Use your{" "}
+ root ID (starts with r-) to deploy
+ to the whole organization, or an OU ID (starts
+ with ou-) to target a specific unit.
+
+ (
+ <>
+
+ field.onChange(Boolean(checked))
+ }
+ />
+
+
+ )}
+ />
+
- 2) Deploy the ProwlerScan role to{" "} - member accounts using a CloudFormation - StackSet. + 2) Create the CloudFormation Stack in your{" "} + {deploymentAccountName}. It deploys the + ProwlerScan role and a service-managed StackSet that rolls the + role out to your member accounts in one step.
-- Open the StackSets console, select{" "} - Service-managed permissions, and paste the - template URL below. Set the ExternalId{" "} - parameter to the value shown above. -
-
-
- {PROWLER_CF_TEMPLATE_URL}
-
-
-
+ ) : (
+
+ {`Create Stack in ${deploymentAccountLabel}`}
+
+ )}
+ {!isOrgUnitIdValid && (
+ + Enter a valid Organizational Unit or Root ID above to enable + deployment. +
+ )}- 3) Paste the management account Role ARN and confirm both - deployments are complete. + 3) Paste the {deploymentAccountName} Role ARN and confirm the + deployment is complete.