mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-23 20:42:02 +00:00
Pepe Fagoaga
188 lines
6.7 KiB
Plaintext
188 lines
6.7 KiB
Plaintext
---
|
|
title: 'Getting Started With Cloudflare on Prowler'
|
|
---
|
|
|
|
import { VersionBadge } from "/snippets/version-badge.mdx"
|
|
|
|
Prowler for Cloudflare scans zones for security misconfigurations, including SSL/TLS settings, DNSSEC, HSTS, WAF rules, DNS records, and more.
|
|
|
|
## Prerequisites
|
|
|
|
Set up authentication for Cloudflare with the [Cloudflare Authentication](/user-guide/providers/cloudflare/authentication) guide before starting either path:
|
|
|
|
- Create a Cloudflare User API Token (recommended) or locate the Global API Key
|
|
- Grant the required read-only permissions (`Account Settings:Read`, `Zone:Read`, `Zone Settings:Read`, `DNS:Read`)
|
|
- Identify the Cloudflare Account ID to use as the provider identifier
|
|
|
|
<Note>
|
|
**Quick Setup:** Use these pre-configured links to create a token with the required permissions already selected:
|
|
|
|
- [Create User API Token](https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner) — creates a User API Token (recommended).
|
|
- [Create Account-Owned API Token](https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&name=Prowler%20Security%20Scanner) — creates an [account-owned token](https://developers.cloudflare.com/fundamentals/api/how-to/account-owned-token-template/), better suited for automation and CI/CD.
|
|
|
|
Both links open the Cloudflare Dashboard with the four required read-only scopes (`Account Settings`, `Zone`, `Zone Settings`, `DNS`) and the name `Prowler Security Scanner` prefilled. See [Cloudflare Authentication](/user-guide/providers/cloudflare/authentication#api-token-recommended) for the equivalent manual steps.
|
|
</Note>
|
|
|
|
<CardGroup cols={2}>
|
|
<Card title="Prowler Cloud" icon="cloud" href="#prowler-cloud">
|
|
Onboard Cloudflare using Prowler Cloud
|
|
</Card>
|
|
<Card title="Prowler CLI" icon="terminal" href="#prowler-cli">
|
|
Onboard Cloudflare using Prowler CLI
|
|
</Card>
|
|
</CardGroup>
|
|
|
|
## Prowler Cloud
|
|
|
|
<VersionBadge version="5.19.0" />
|
|
|
|
### Step 1: Locate the Account ID
|
|
|
|
1. Log into the [Cloudflare Dashboard](https://dash.cloudflare.com).
|
|
2. Select any zone in the target account.
|
|
3. On the zone overview page, find the **Account ID** in the right sidebar under the "API" section.
|
|
|
|
|
|
|
|
<Note>
|
|
The Account ID is a 32-character hexadecimal string (e.g., `372e67954025e0ba6aaa6d586b9e0b59`). This value acts as the unique identifier for the Cloudflare account in Prowler Cloud.
|
|
</Note>
|
|
|
|
### Step 2: Open Prowler Cloud
|
|
|
|
1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
|
|
2. Navigate to "Configuration" > "Providers".
|
|
|
|
|
|
|
|
3. Click "Add Provider".
|
|
|
|
|
|
|
|
4. Select "Cloudflare".
|
|
|
|
|
|
|
|
5. Add the **Account ID** and an optional alias, then click "Next".
|
|
|
|
|
|
|
|
### Step 3: Choose and Provide Authentication
|
|
|
|
After the Account ID is in place, select the authentication method that matches the Cloudflare setup:
|
|
|
|
|
|
|
|
#### User API Token Authentication (Recommended)
|
|
|
|
1. Select **API Token**.
|
|
2. Enter the **User API Token** created in the Cloudflare Dashboard.
|
|
|
|
|
|
|
|
Use this method for scoped, least-privilege access. Full setup steps are in the [Authentication guide](/user-guide/providers/cloudflare/authentication#api-token-recommended).
|
|
|
|
#### API Key and Email Authentication (Legacy)
|
|
|
|
1. Select **API Key + Email**.
|
|
2. Enter the **Global API Key**.
|
|
3. Enter the **email address** associated with the Cloudflare account.
|
|
|
|
|
|
|
|
For the complete setup workflow, follow the [Authentication guide](/user-guide/providers/cloudflare/authentication#api-key-and-email-legacy).
|
|
|
|
### Step 4: Launch the Scan
|
|
|
|
1. Review the summary.
|
|
2. Click **Launch Scan** to start auditing Cloudflare.
|
|
|
|
|
|
|
|
---
|
|
|
|
## Prowler CLI
|
|
|
|
<VersionBadge version="5.17.0" />
|
|
|
|
### Step 1: Set Up Authentication
|
|
|
|
Choose the matching method from the [Cloudflare Authentication](/user-guide/providers/cloudflare/authentication) guide:
|
|
|
|
- **User API Token** (recommended): Set `CLOUDFLARE_API_TOKEN`
|
|
- **API Key + Email** (legacy): Set `CLOUDFLARE_API_KEY` and `CLOUDFLARE_API_EMAIL`
|
|
|
|
### Step 2: Run the First Scan
|
|
|
|
Run a baseline scan after credentials are configured:
|
|
|
|
```console
|
|
prowler cloudflare
|
|
```
|
|
|
|
Prowler automatically discovers all zones accessible with the provided credentials and runs security checks against them.
|
|
|
|
### Step 3: Filter the Scan Scope (Optional)
|
|
|
|
#### Filter by Zone
|
|
|
|
To scan only specific zones, use the `-f`, `--region`, or `--filter-region` argument:
|
|
|
|
```console
|
|
prowler cloudflare -f example.com
|
|
```
|
|
|
|
Multiple zones can be specified:
|
|
|
|
```console
|
|
prowler cloudflare -f example.com example.org
|
|
```
|
|
|
|
Zone IDs are also supported:
|
|
|
|
```console
|
|
prowler cloudflare -f 023e105f4ecef8ad9ca31a8372d0c353
|
|
```
|
|
|
|
#### Filter by Account
|
|
|
|
To restrict the scan to specific accounts, use the `--account-id` argument:
|
|
|
|
```console
|
|
prowler cloudflare --account-id 372e67954025e0ba6aaa6d586b9e0b59
|
|
```
|
|
|
|
Multiple account IDs can be specified:
|
|
|
|
```console
|
|
prowler cloudflare --account-id 372e67954025e0ba6aaa6d586b9e0b59 9a7806061c88ada191ed06f989cc3dac
|
|
```
|
|
|
|
<Note>
|
|
If any of the provided account IDs are not accessible with the current credentials, Prowler raises an error and stops execution.
|
|
</Note>
|
|
|
|
Account and zone filtering can be combined to narrow the scan scope further:
|
|
|
|
```console
|
|
prowler cloudflare --account-id 372e67954025e0ba6aaa6d586b9e0b59 -f example.com
|
|
```
|
|
|
|
### Step 4: Use a Custom Configuration (Optional)
|
|
|
|
Prowler uses a configuration file to customize provider behavior. The Cloudflare configuration includes:
|
|
|
|
```yaml
|
|
cloudflare:
|
|
# Maximum number of retries for API requests (default is 2)
|
|
max_retries: 2
|
|
```
|
|
|
|
To use a custom configuration:
|
|
|
|
```console
|
|
prowler cloudflare --config-file /path/to/config.yaml
|
|
```
|
|
|
|
---
|