mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-10-14 07:24:15 +00:00
39 lines
2.6 KiB
Plaintext
39 lines
2.6 KiB
Plaintext
---
|
|
title: "IaC Authentication in Prowler"
|
|
---
|
|
|
|
Prowler's Infrastructure as Code (IaC) provider enables you to scan local or remote infrastructure code for security and compliance issues using [Trivy](https://trivy.dev/). This provider supports a wide range of IaC frameworks and requires no cloud authentication for local scans.
|
|
|
|
### Authentication
|
|
|
|
- For local scans, no authentication is required.
|
|
- For remote repository scans, authentication can be provided via:
|
|
- [**GitHub Username and Personal Access Token (PAT)**](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic)
|
|
- [**GitHub OAuth App Token**](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token)
|
|
- [**Git URL**](https://git-scm.com/docs/git-clone#_git_urls)
|
|
|
|
### Private Repository Hosts
|
|
|
|
**Prowler CLI scans a repository on an internal network with no extra configuration.** On the CLI the operator supplies the repository URL themselves, so there is nothing to defend against and the check below does not apply.
|
|
|
|
**Prowler App rejects a repository URL that resolves to a non-public address**, as an SSRF defense. There the URL arrives from a tenant and the worker must not be used to reach the internal network it runs in. The check covers both the connection test and the scan clone. To scan a self-hosted GitLab, Gitea or Bitbucket from Prowler App, declare the trusted ranges:
|
|
|
|
```console
|
|
PROWLER_ALLOWED_PRIVATE_NETWORKS="10.20.0.0/16,192.168.65.254/32"
|
|
```
|
|
|
|
The value is a comma-separated list of IPs and CIDRs. A resolved address inside an allowlisted range is permitted; every other non-public address stays blocked, so link-local (`169.254.169.254`), loopback and the rest of the internal network remain protected. Malformed entries are rejected, and a non-empty allowlist is logged as a relaxed security control.
|
|
|
|
The scan runs in the worker, not the API, so the variable has to reach the worker:
|
|
|
|
- **Docker Compose**: set it in the root `.env`; it reaches the worker through the shared environment file.
|
|
- **Helm**: add it under `api.djangoConfig`, which is rendered into the API ConfigMap that the worker inherits through `envFrom`.
|
|
|
|
```yaml
|
|
api:
|
|
djangoConfig:
|
|
PROWLER_ALLOWED_PRIVATE_NETWORKS: "10.20.0.0/16"
|
|
```
|
|
|
|
Setting it only on the API container has no effect. The same variable applies to the Kubernetes and OpenStack providers. The Image provider has its own, `PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS`.
|