Prowler is a command line tool available on GitHub that was created to perform assessments that compare your AWS environment to AWS security best practices and industry standards. Using Prowler, you can evaluate your AWS security specifically against the CIS Amazon Web Services Foundations Benchmark. It can be a powerful tool to learn about guidance on IAM, logging, monitoring, and networking configurations. To use Prowler, though, you must provision EC2 instances with the necessary security permissions. In this demonstration, we will walk through how to attach the appropriate IAM role to an EC2 instance. 

For a visual guide on the value of Prowler and how to enable EC2 instances with the permissions to use it, watch the full demo.   

Prowler is a command line tool available on GitHub that was created to perform assessments that compare your AWS environment to AWS security best practices and industry standards. There is a wealth of information on that GitHub page. The creator of Prowler has implemented these AWS CIS Benchmarks in groups 1, 2, 3, and 4 and has integrated that into his toolset. Prowler also provides several additional checks to gather some additional information. At KirkpatrickPrice, we use this tool heavily in our audits, especially in AWS environments, to determine whether good practices are being followed in securing this set of resources. 

Let’s go down to “Troubleshooting” here because there is a piece of information, specifically, that we’re going to need and that is to make all of the tool's advanced checks work. The basic checks should work with just the “SecurityAudit” profile in the “SecurityAudit” policy in AWS but for some of his more advanced checks, we will need some additional JSON policy. So, we’re just going to grab all of this information here and put that in our clipboard. Then, we’re going to head over to Amazon Web Services and our IAM console. We’re going to create a new policy. We’re just going to take that code and we’re going to paste it all in here. We’re going to review that policy and give it a name, “ProwlerSecurityAuditPolicy” or something like that. Then we’ll create the policy and should be good to go. 

Next, we want to make a role, specifically for our EC2 instance where we’re going to run this from. If we use an EC2 instance role, then we won’t need to put those AWS access keys and create a security hole for bad guys to come in and take over our stuff. So, we will use a role because that is much more secure. We’re going to create an EC2 role, specifically. Let’s grab the “SecurityAudit” policy and let’s also grab our freshly made “ProwlerSecurityAuditPolicy” and add those both to the role, click next, and review. We’re going to call this “ec2_prowler_role.” Here’s our EC2 Prowler role that we just created. Apply that. We have success! Now, we have provisioned our EC2 instance with the necessary roles, here. Now, we have properly provisioned our EC2 instance with the necessary security permissions in AWS in order for Prowler to work correctly. 

Next, we’re just going to install Prowler. That’s just done with a simple git clone operation against the GitHub site that we saw earlier. That is done. Finally, just a couple of other requirements we need for this to work are to install the AWS CLI as well as the JSON Query tool, JQ. When we install those, our EC2 instance will work. That’s actually already been done prior to setting up this particular demonstration, but that was the command to install those two things. Now, all of the dependencies, as well as the tool itself, have been installed. Sure enough, if we take a look, we have a directory called Prowler. We will just run in here, quickly, run Prowler like that, and sure enough we now see that Prowler is running its checks. We’re also starting to get the results back. As you can see, my demo account is not very secure. We’re getting a lot of fails on here. Now, there is also the ability to create a CSV file. Take a look at the tool’s help page to get that information on how to create a CSV file that can then be taken down offline. Certainly, when you’re working on an audit with KirkpatrickPrice, we’re going to provide that command line to you, as well, to make sure that we get information in a way that is useful to use during our audits.