mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-03-22 03:08:23 +00:00
147 lines
4.8 KiB
Plaintext
147 lines
4.8 KiB
Plaintext
---
|
|
title: 'Cloudflare Authentication in Prowler'
|
|
---
|
|
|
|
Prowler for Cloudflare supports the following authentication methods:
|
|
|
|
- [**API Token**](#api-token-recommended) (**Recommended**)
|
|
- [**API Key and Email (Legacy)**](#api-key-and-email-legacy)
|
|
|
|
## Required Permissions
|
|
|
|
Prowler requires read-only access to your Cloudflare zones and their settings. The following permissions are needed:
|
|
|
|
| Permission | Description |
|
|
|------------|-------------|
|
|
| `Zone:Read` | Read access to zone settings and configurations |
|
|
| `Zone Settings:Read` | Read access to zone security settings (SSL/TLS, HSTS, etc.) |
|
|
| `DNS:Read` | Read access to DNS records (for DNSSEC checks) |
|
|
|
|
<Warning>
|
|
Ensure your API Token or API Key has access to all zones you want to scan. If permissions are missing, some checks may fail or return incomplete results.
|
|
</Warning>
|
|
|
|
## API Token (Recommended)
|
|
|
|
API Tokens are the recommended authentication method because they:
|
|
- Can be scoped to specific permissions and zones
|
|
- Are more secure than global API keys
|
|
- Can be easily rotated without affecting other integrations
|
|
|
|
### Step 1: Create an API Token
|
|
|
|
1. **Log into Cloudflare Dashboard**
|
|
- Go to [https://dash.cloudflare.com](https://dash.cloudflare.com) and sign in
|
|
|
|
2. **Navigate to API Tokens**
|
|
- Click on your profile icon in the top right corner
|
|
- Select **My Profile**
|
|
- Click on the **API Tokens** tab
|
|
|
|
3. **Create a Custom Token**
|
|
- Click **Create Token**
|
|
- Select **Create Custom Token** (at the bottom)
|
|
|
|
4. **Configure Token Permissions**
|
|
|
|
Give your token a descriptive name (e.g., "Prowler Security Scanner") and add the [required permissions](#required-permissions) listed above.
|
|
|
|
5. **Set Zone Resources**
|
|
- Under **Zone Resources**, select either:
|
|
- **Include → All zones** (to scan all zones in your account)
|
|
- **Include → Specific zone** (to limit access to specific zones)
|
|
|
|
6. **Create and Copy Token**
|
|
- Click **Continue to summary**
|
|
- Review the permissions and click **Create Token**
|
|
- **Copy the token immediately** - Cloudflare will only show it once
|
|
|
|
### Step 2: Store the Token Securely
|
|
|
|
Store your API token as an environment variable:
|
|
|
|
```bash
|
|
export CLOUDFLARE_API_TOKEN="your-api-token-here"
|
|
```
|
|
|
|
<Warning>
|
|
Never commit API tokens to version control or share them in plain text. Use environment variables or a secrets manager.
|
|
</Warning>
|
|
|
|
## API Key and Email (Legacy)
|
|
|
|
API Keys provide full access to your Cloudflare account. While supported, this method is less secure than API Tokens because it grants broader permissions.
|
|
|
|
### Step 1: Get Your API Key
|
|
|
|
1. **Log into Cloudflare Dashboard**
|
|
- Go to [https://dash.cloudflare.com](https://dash.cloudflare.com) and sign in
|
|
|
|
2. **Navigate to API Tokens**
|
|
- Click on your profile icon in the top right corner
|
|
- Select **My Profile**
|
|
- Click on the **API Tokens** tab
|
|
|
|
3. **View Global API Key**
|
|
- Scroll down to the **API Keys** section
|
|
- Click **View** next to **Global API Key**
|
|
- Enter your password to reveal the key
|
|
- Copy the API key
|
|
|
|
### Step 2: Store Credentials Securely
|
|
|
|
Store both your API key and email as environment variables:
|
|
|
|
```bash
|
|
export CLOUDFLARE_API_KEY="your-api-key-here"
|
|
export CLOUDFLARE_API_EMAIL="your-email@example.com"
|
|
```
|
|
|
|
<Note>
|
|
The email must be the same email address used to log into your Cloudflare account.
|
|
</Note>
|
|
|
|
## Best Practices
|
|
|
|
### Security Recommendations
|
|
|
|
- **Use API Tokens instead of API Keys** - Tokens can be scoped to specific permissions
|
|
- **Use environment variables** - Never hardcode credentials in scripts or commands
|
|
- **Rotate credentials regularly** - Create new tokens periodically and revoke old ones
|
|
- **Use least privilege** - Only grant the minimum permissions needed
|
|
- **Monitor token usage** - Review the Cloudflare audit log for suspicious activity
|
|
|
|
<Warning>
|
|
**Use only one authentication method at a time.** If both API Token and API Key + Email are set, Prowler will use the API Token and log an error message.
|
|
</Warning>
|
|
|
|
## Troubleshooting
|
|
|
|
### "Missing X-Auth-Email header" Error
|
|
|
|
This error occurs when using API Key authentication without providing the email address. Ensure both `CLOUDFLARE_API_KEY` and `CLOUDFLARE_API_EMAIL` are set.
|
|
|
|
### "Authentication error" or "Permission denied"
|
|
|
|
- Verify your API Token or API Key is correct and not expired
|
|
- Check that your token has the [required permissions](#required-permissions)
|
|
- Ensure your token has access to the zones you're trying to scan
|
|
|
|
### "Both API Token and API Key and Email credentials are set"
|
|
|
|
This warning appears when all three environment variables are set:
|
|
- `CLOUDFLARE_API_TOKEN`
|
|
- `CLOUDFLARE_API_KEY`
|
|
- `CLOUDFLARE_API_EMAIL`
|
|
|
|
To resolve, unset the credentials you don't want to use:
|
|
|
|
```bash
|
|
# To use API Token only (recommended)
|
|
unset CLOUDFLARE_API_KEY
|
|
unset CLOUDFLARE_API_EMAIL
|
|
|
|
# Or to use API Key and Email only
|
|
unset CLOUDFLARE_API_TOKEN
|
|
```
|