mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-01-25 02:08:11 +00:00
146 lines
4.0 KiB
Plaintext
146 lines
4.0 KiB
Plaintext
---
|
|
title: 'AWS Regions and Partitions'
|
|
---
|
|
|
|
By default Prowler is able to scan the following AWS partitions:
|
|
|
|
- Commercial: `aws`
|
|
- China: `aws-cn`
|
|
- European Sovereign Cloud: `aws-eusc`
|
|
- GovCloud (US): `aws-us-gov`
|
|
|
|
<Note>
|
|
To check the available regions for each partition and service, refer to: [aws\_regions\_by\_service.json](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/aws/aws_regions_by_service.json)
|
|
|
|
</Note>
|
|
## Scanning AWS China, European Sovereign Cloud and GovCloud Partitions in Prowler
|
|
|
|
When scanning the China (`aws-cn`), European Sovereign Cloud (`aws-eusc`) or GovCloud (`aws-us-gov`) partitions, ensure one of the following:
|
|
|
|
- Your AWS credentials include a valid region within the desired partition.
|
|
|
|
- Specify the regions to audit within that partition using the `-f/--region` flag.
|
|
|
|
<Note>
|
|
Refer to: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html#configuring-credentials for more information about the AWS credential configuration.
|
|
|
|
</Note>
|
|
### Scanning Specific Regions
|
|
|
|
To scan a particular AWS region with Prowler, use:
|
|
|
|
```console
|
|
prowler aws -f/--region eu-west-1 us-east-1
|
|
```
|
|
|
|
### AWS Credentials Configuration
|
|
|
|
For details on configuring AWS credentials, refer to the following [Botocore](https://github.com/boto/botocore) [file](https://github.com/boto/botocore/blob/22a19ea7c4c2c4dd7df4ab8c32733cba0c7597a4/botocore/data/partitions.json).
|
|
|
|
## Scanning AWS Partitions in Prowler
|
|
|
|
### AWS China
|
|
|
|
To scan an account in the AWS China partition (`aws-cn`):
|
|
|
|
- By using the `-f/--region` flag:
|
|
|
|
```
|
|
prowler aws --region cn-north-1 cn-northwest-1
|
|
```
|
|
|
|
- By using the region configured in your AWS profile at `~/.aws/credentials` or `~/.aws/config`:
|
|
|
|
```
|
|
[default]
|
|
aws_access_key_id = XXXXXXXXXXXXXXXXXXX
|
|
aws_secret_access_key = XXXXXXXXXXXXXXXXXXX
|
|
region = cn-north-1
|
|
```
|
|
|
|
<Note>
|
|
With this configuration, all partition regions will be scanned without needing the `-f/--region` flag
|
|
|
|
</Note>
|
|
### AWS GovCloud (US)
|
|
|
|
To scan an account in the AWS GovCloud (US) partition (`aws-us-gov`):
|
|
|
|
- By using the `-f/--region` flag:
|
|
|
|
```
|
|
prowler aws --region us-gov-east-1 us-gov-west-1
|
|
```
|
|
|
|
- By using the region configured in your AWS profile at `~/.aws/credentials` or `~/.aws/config`:
|
|
|
|
```
|
|
[default]
|
|
aws_access_key_id = XXXXXXXXXXXXXXXXXXX
|
|
aws_secret_access_key = XXXXXXXXXXXXXXXXXXX
|
|
region = us-gov-east-1
|
|
```
|
|
|
|
<Note>
|
|
With this configuration, all partition regions will be scanned without needing the `-f/--region` flag
|
|
|
|
</Note>
|
|
### AWS European Sovereign Cloud
|
|
|
|
To scan an account in the AWS European Sovereign Cloud partition (`aws-eusc`):
|
|
|
|
- By using the `-f/--region` flag:
|
|
|
|
```
|
|
prowler aws --region eusc-de-east-1
|
|
```
|
|
|
|
- By using the region configured in your AWS profile at `~/.aws/credentials` or `~/.aws/config`:
|
|
|
|
```
|
|
[default]
|
|
aws_access_key_id = XXXXXXXXXXXXXXXXXXX
|
|
aws_secret_access_key = XXXXXXXXXXXXXXXXXXX
|
|
region = eusc-de-east-1
|
|
```
|
|
|
|
<Note>
|
|
With this configuration, all partition regions will be scanned without needing the `-f/--region` flag
|
|
|
|
</Note>
|
|
### AWS ISO (US \& Europe)
|
|
|
|
The AWS ISO partitions—commonly referred to as "secret partitions"—are air-gapped from the Internet, and Prowler does not have a built-in way to scan them. To audit an AWS ISO partition, manually update [aws\_regions\_by\_service.json](https://github.com/prowler-cloud/prowler/blob/master/prowler/providers/aws/aws_regions_by_service.json) to include the partition, region, and services. For example:
|
|
|
|
```json
|
|
"iam": {
|
|
"regions": {
|
|
"aws": [
|
|
"eu-west-1",
|
|
"us-east-1",
|
|
],
|
|
"aws-cn": [
|
|
"cn-north-1",
|
|
"cn-northwest-1"
|
|
],
|
|
"aws-eusc": [
|
|
"eusc-de-east-1"
|
|
],
|
|
"aws-us-gov": [
|
|
"us-gov-east-1",
|
|
"us-gov-west-1"
|
|
],
|
|
"aws-iso": [
|
|
"aws-iso-global",
|
|
"us-iso-east-1",
|
|
"us-iso-west-1"
|
|
],
|
|
"aws-iso-b": [
|
|
"aws-iso-b-global",
|
|
"us-isob-east-1"
|
|
],
|
|
"aws-iso-e": [],
|
|
}
|
|
},
|
|
```
|