Skip to content

Releases: prowler-cloud/prowler

Prowler 3.0.2 - Piece of Mind

05 Jan 13:01
@jfagoagas jfagoagas
3.0.2
efa83e0
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
Prowler 3.0.2 - Piece of Mind

Features

  • feat(regions_update): changes in regions for AWS services. by @github-actions in #1629 and #1646
  • feat(aws-regions): update refresh regions action by @sergargar in #1641
  • feat(ec2): add ResourceArn by @gabrielsoltz in #1649
  • feat(ecs_task_definitions_no_environment_secrets): update recommendation by @Fennerr in #1658
  • feat(ecs_task_definitions_no_environment_secrets): add ECS task revision number by @Fennerr in #1657

Fixes

Docs

New Contributors

Full Changelog: 3.0.1...3.0.2

Contributors

PeterDaveHello, cclauss, and 7 other contributors
Assets 2
Loading

Prowler 3.0.1 - Piece of Mind

23 Dec 13:12
@toniblyx toniblyx
3.0.1
f05cb28
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
Prowler 3.0.1 - Piece of Mind

Fixes

New Contributors

Full Changelog: 3.0.0...3.0.1

Contributors

JonoB, jfagoagas, and 3 other contributors
Assets 2
Loading

Prowler 3.0.0 - Piece of Mind

21 Dec 16:08
@toniblyx toniblyx
3.0.0
bb5ba8c
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
Prowler 3.0.0 - Piece of Mind

Today we are releasing a new major version of Prowler 🎉🥳🎊🍾, the Version 3 aka Piece of Mind.

Take Prowler v3 as our 🎄Christmas gift 🎁 for the Cloud Security Community.

Screenshot 2022-12-19 at 22 53 47
Artwork property of Iron Maiden

Piece of Mind was the fourth studio album of Iron Maiden. Its meaning fits perfectly with what we do with Prowler in both senses: being protected and at the same time, this is the software I would have wanted to write when I started Prowler back in 2016 (this is now, more than ever, a piece of my mind). Now this has been possible thanks to my awesome team at Verica.

No doubt that 2022 has been a pretty interesting year for us, we launched ProwlerPro and released many minor versions of Prowler. Now enjoy Sun and Steel while you keep reading these release notes.

If you are an Iron Maiden fan as I am, you have noticed the latest minor release of Prowler (2.12) was a song from this very same album, just a clue of what was coming! In Piece of Mind you can find one of the most popular heavy metal songs of all times, The Trooper, which will be a Prowler version to be released during 2023.

Prowler v3 is more than a new version of Prowler, it is a whole new piece of software, we have fully rewritten it in Python and we have made it multi-cloud adding Azure as our second supported Cloud Provider. Prowler v3 is also way faster, being able to scan an entire AWS account across all regions 37 times faster than before, yes! you read it correctly, what before took hours now it takes literally few minutes or even seconds.

Toni de la Fuente.

New documentation site:

We are also releasing today our brand new documentation site for Prowler at https://docs.prowler.cloud and it is also stored in the docs folder in the repo.

What's Changed:

Here is a list of the most important changes in Prowler v3:

  • 🐍 Python: we got rid of all bash and it is now all in Python. pip install prowler then run prowler that’s all.
  • 🚀 Faster: huge performance improvements.
    Scanning the same account takes from 2.5 hours to 4 minutes.
  • 💻 Developers and Community: we have made it easier to contribute with new checks and new compliance frameworks. We also included unit tests and native logging features. And now the CLI supports long arguments and options.
  • ☁️ Multi-cloud: in addition to AWS, we have added Azure.
  • ✅ Checks and Groups: all checks are now more comprehensive and we provide resolution actions in most of them. Their ID is no longer tight to CIS but they are self-explanatory. Groups now are dynamically generated based on checks metadata like services, categories, severity and more).
  • ⚖️ Compliance: we are including full support for CIS 1.4, CIS 1.5 and the new Spanish ENS in this release, more to come soon! Compliance also has its own output file with their own metadata and to create your own is easier than ever before making more comprehensive reports.
  • 🧩 Compatibility with v2: most of the options are the same in this version in order to support backward compatibility however some options like assume role or AWS Organizations query are now different and easier to use.
  • 🔄 Consolidated output formats: now both CSV and JSON reports come with the same attributes and compared to v2, they come with more than 40 values per finding. HTML, CSV and JSON are created every time you run prowler.
  • 📊 Quick Inventory: introduced in v2, we have fine tuned the Quick Inventory feature and now you can get a list of all resources in your AWS accounts within seconds.

Prowler new default overview:

prowler-3-output

Prowler updated HTML report:

html-output

Prowler compliance overview:

compliance-cis-sample

Prowler list of Azure checks:

azure-checks

What is coming next?

  • More Cloud Providers and more checks: in addition to keep adding new checks to AWS and Azure, we plan to include GCP and OCI soon, let us know if you want to contribute!
  • XML-JUNIT support: we didn’t add that to v3, if you miss it, let us know in https://github.com/prowler-cloud/prowler/discussions
  • Compliance: we will add more compliance frameworks to have as many as in Prowler v2, we appreciate help though!
  • Tags based audit: you will be able to scan only those resources with specific tags.

New Contributors

In addition to the Prowler rock stars @jfagoagas @n4ch04 @sergargar we have a couple of new contributors in this release:

For more information and a detailed list of changes see below:

Full Changelog: 2.10.0...3.0.0

Contributors

jfagoagas, sergargar, and 3 other contributors
Assets 2
Loading

Prowler 2.12.1

19 Dec 16:59
@toniblyx toniblyx
2.12.1
e9b0979
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
Prowler 2.12.1

Fixes

  • fix(extra7195): Update title by @Fennerr in #1440
  • fix(extra71): Modified wrong remediation by @n4ch04 in #1445
  • fix(README): include more details about db connector by @n4ch04 in #1507
  • fix(extra723): corrected some typos for check_extra723 by @kagahd in #1511
  • fix(CloudTrail): Fix CloudTrail trail S3 logging public bucket false positive result when trail bucket doesn't exist by @acknosyn in #1505

New Contributors

Full Changelog: 2.12.0...2.12.1

Contributors

acknosyn, kagahd, and 2 other contributors
Assets 2
Loading

Prowler 2.12.0 - Where Eagles Dare

27 Oct 10:18
@toniblyx toniblyx
2.12.0
8818f47
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
Prowler 2.12.0 - Where Eagles Dare

It's snowing outside, the rumbling sound
Of engines roar in the night
The mission is near, the confident men
Are waiting to drop from the sky

Where Eagles Dare is the song that opens the Piece of Mind album of Iron Maiden, released back in 1983, the first one with Nicko McBrain as drummer after Clive Burr left the band, note his first seconds on this piece, it is like Nicko saying "here I go!". This song relates the adventure of a team of soldiers raiding a castle in Germany during the WWII, that is related in the movie with the same name starred by Clint Eastwood and Richard Burton.

For all of you that have contributed to this version (see list below), thank you ❤️!!! And reach out to me on Twitter (@toniblyx - DMs are open) if you want some laptop stickers.

🔥Important changes in this version (read this!)🔥:

New checks:

7.195 [check7195] Ensure CodeArtifact internal packages do not allow external public source publishing. - codeartifact [Critical]

Other changes:

  • CloudTrail checks check21, check22, check23, check24, check26, check27 now include shadow trails in the results (those trails used for multi-region and AWS organizations)
  • New group called cisig2 for CIS Critical Security Controls v8 by @artfulbodger
  • We have deprecated Discord and now we only use Slack, join us here!

New features:

  • feat(checks): Adding commands for checks 117 and 118 by @belialboy in #1289
  • feat(extra780): Check for Cognito or SAML authentication on OpenSearch by @kagahd in #1291
  • feat(extra7195): Added check for dependency confusion in codeartifact by @congon4tor in #1329
  • feat(group): CIS Critical Security Controls v8 by @artfulbodger in #1347
  • feat(audit_id): add optional audit_id field to postgres connector by @sergargar in #1362
  • feat(db-connector): Include UUID for findings ID by @n4ch04 in #1368
  • feat(slack): add Slack badge to README instead of deprecated Discord by @sergargar in #1401
  • feat(extra7111): Exception handling by @n4ch04 in #1408
  • feat(stable tag): Inclusion of stable tag point to last release by @n4ch04 in #1419
  • docs(spelling): Typo corrections by @olivier987654 in #1394

Enhancements:

  • chore(issues): Link Q&A by @jfagoagas in #1305
  • docs(outputs): added CVS and JSON details by @jfagoagas in #1313
  • docs(dockerfile): Dockerfile build instructions by @walkerab in #1370
  • chore(actions): Bump Trufflehog to v3.13.0 by @gliptak in #1382
  • delete(shortcut.sh): Remove ScoutSuite by @jfagoagas in #1388
  • fix(checks): CloudTrail checks 2.X now include shadow trails in the results (those trails used for multi-region and AWS organizations)

Fixes:

  • fix(check12): Improve remediation by @jfagoagas in #1281
  • fix(extra712): changed Macie service detection by @williambrady in #1286
  • fix(permissions): Include missing appstream:DescribeFleets permission by @jfagoagas in #1278
  • fix(appstream): Handle timeout errors by @jfagoagas in #1296
  • fix(security-groups): Include TCP as the IpProtocol by @jfagoagas in #1323
  • fix(credential_report): Do not generate for 117 and 118 by @jfagoagas in #1322
  • fix(inventory): Variable assigning syntax in inventory mode by @JArmandoG in #1283
  • fix(check120): correct AWS support policy name by @JArmandoG in #1328
  • fix(postgresql): Connector field by @jfagoagas in #1372
  • fix(postgresql): Missing space by @jfagoagas in #1374
  • fix(checks): Include missing output in checks by @n4ch04 in #1380
  • fix(checks): Handle checks not returning result by @n4ch04 in #1383
  • fix(inventory): quick inventory input fixed by @sergargar in #1397
  • fix(check_extra77): Add missing check_resource_id to the report by @kagahd in #1402
  • fix(missing permissions): add missing permissions of checks by @sergargar in #1403
  • fix(region_bugs): Remove duplicate outputs by @sergargar in #1390
  • fix(extra740): remove additional info and fix max_items by @sergargar in #1405
  • fix(extra77): Deleted resource id from exception results by @n4ch04 in #1409
  • fix(extra7183): Exception handling error UnsupportedOperationException by @n4ch04 in #1410
  • fix(extra7184): Error handling GetSnapshotLimits api call by @n4ch04 in #1411

New Contributors:

Full Changelog: 2.11.0...2.12.0

Contributors

gliptak, walkerab, and 11 other contributors
Assets 2
Loading

Prowler 2.11.0 - Blood Brothers

21 Jul 09:20
@toniblyx toniblyx
2.11.0
f70cf8d
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
Prowler 2.11.0 - Blood Brothers

And if you're taking a walk through the garden of life
What do you think you'd expect you would see?
Just like a mirror reflecting the moves of your life
And in the river reflections of me

Steve Harris, founder and bass guitar of Iron Maiden 🤘🏽 wrote this song when he lost his father, lyrics and music is beautiful. This release is for those that always look forward and only look back to be thankful and learn. Also this song and version is to thanks my Prowler brothers @jfagoagas, @n4ch04, @sergargar and @drewkerrigan, they are working as beasts every day to make this piece of software better and building something awesome with Prowler underneath called Prowler Pro.

For all of you that have contributed to this version (see list below), thank you ❤️!!! And reach out to me on Twitter (@toniblyx - DMs are open) if you want some laptop stickers.

🔥Important changes in this version (read this!):

  • 14 New checks covering Directory Service, IAM, S3, Workspaces, AppStream and ECR:
7.181 [extra7181] Directory Service monitoring with CloudWatch logs - ds [Medium]
7.182 [extra7182] Directory Service SNS Notifications - ds [Medium]
7.183 [extra7183] Directory Service LDAP Certificates expiration - ds [Medium]
7.184 [extra7184] Directory Service Manual Snapshot Limit - ds [Low]
7.185 [extra7185] Ensure no Customer Managed IAM policies allow actions that may lead into Privilege Escalation - iam [High]
7.186 [extra7186] Check S3 Account Level Public Access Block - s3 [High]
7.187 [extra7187] Ensure that your Amazon WorkSpaces storage volumes are encrypted in order to meet security and compliance requirements - workspaces [High]
7.188 [extra7188] Ensure Radius server in DS is using the recommended security protocol - ds [Medium]
7.189 [extra7189] Ensure Multi-Factor Authentication (MFA) using Radius Server is enabled in DS - ds [Medium]
7.190 [extra7190] Ensure user maximum session duration is no longer than 10 hours. - appstream [Medium]
7.191 [extra7191] Ensure session disconnect timeout is set to 5 minutes or less. - appstream [Medium]
7.192 [extra7192] Ensure session idle disconnect timeout is set to 10 minutes or less. - appstream [Medium]
7.193 [extra7193] Ensure default Internet Access from your Amazon AppStream fleet streaming instances should remain unchecked. - appstream [Medium]
7.194 [extra7194] Check if ECR repositories have lifecycle policies enabled - ecr [Low]

New features:

  • feat(check) Directory Service by @lemelop in #1164
  • feat(check): PublicAccessBlockConfiguration by @jfagoagas in #1167
  • feat(check): Amazon WorkSpaces storage volumes are encrypted by @rajarshidas in #1166
  • feat(inventory): Prowler quick inventory including IAM resources by @toniblyx in #1258
  • feat(ecr_lifecycle): Check Lifecycle policy by @massyn in #1260
  • feat(checks): New IAM privilege escalation check by @jfagoagas in #1168
  • feat(codebuild_timeout): Increase codebuild timeout to maximum. by @sergargar in #1192
  • feat(db) Create a PostgreSQL connector for Prowler by @n4ch04 in #1171
  • feat(checks): Amazon AppStream checks by @rajarshidas in #1216
  • feat(check): Ensure default internet access from Amazon AppStream fleet should be disabled. by @rajarshidas in #1233
  • feat(dockerfile): Include psql client in the Prowler scanner image by @jfagoagas in #1238
  • feat(db-connector): Support environment variables by @jfagoagas in #1236
  • feat(inventory): Prowler quick inventory by @toniblyx in #1245

Enhancements:

  • feat(output): Consolidate prowler output functions by @n4ch04 in #1180
  • refactor(Prowler): Main logic refactor by @jfagoagas in #1189
  • feat(extra7185): Update severity of check extra7185 by @sergargar in #1178
  • feat(actions): Trigger by @jfagoagas in #1209
  • feat(check): Directory Service - Ensure Radius server is using the recommended security protocol by @rajarshidas in #1203
  • docs(readme): Update inventory and checks by @jfagoagas in #1257
  • feat(check7164): 365 days or more in a Cloudwatch log retention should be consider PASS by @bcarranza in #1240

Fixes:

  • fix(extra767): Remove false positive for check_extra767 by @zsecducna in #1198
  • fix(update_deprecate_runtimes): Deprecated runtimes for lambda were updated. by @sergargar in #1170
  • fix(runtimes_extra762): Detect nodejs versions correctly. by @sergargar in #1177
  • fix(SQS_encryption_type): Add SQS encryption types to extra728. by @sergargar in #1175
  • fix(typo): Max session duration error message by @jfagoagas in #1179
  • fix(apigateway_iam): Error handling and permissions for extra745. by @sergargar in #1176
  • fix(assume_role): Use date instead of jq by @jfagoagas in #1181
  • fix(check119_remediation): Update check remediation text. by @sergargar in #1185
  • fix(codebuild_update): AWS CLI and permissions update. by @sergargar in #1183
  • fix(extra7187): Remove commas from the metadata by @jfagoagas in #1187
  • fix(outputs): Replace each comma occurrence before sending to csv file by @n4ch04 in #1188
  • fix(shellcheck): Main variables by @jfagoagas in #1194
  • fix(session_duration): Use jq with TZ=UTC by @jfagoagas in #1195
  • fix(instance-metadata): Credentials recovering by @sergargar in #1207
  • fix(actions): Dockerfile path by @jfagoagas in #1208
  • fix(junit_xml output): Fix xml output integration. by @sergargar in #1210
  • fix(instance metadata): missing raw flag in jq parser by @n4ch04 in #1214
  • fix(shub_fails): Treat failed findings as failed in SHub. by @sergargar in #1219
  • fix(extra7162): Query AWS log groups using LOG_GROUP_RETENTION_PERIOD_DAYS by @jfagoagas in #1232
  • fix(backupInitialAWSCredentials): Do nothing if no initial creds by @jfagoagas in #1239
  • fix(postgres): Fix postgres connector issues. by @sergargar in #1244
  • fix(add-checks-regions): Missing regions in checks by @sergargar in #1247
  • fix(Dockerfile): Prowler path by @jfagoagas in #1254
  • fix(apigatewayv2): handle BadRequestException by @sergargar in #1261
  • fix(codebuild): expired token error by @sergargar in #1262
  • fix(extra7173): Correct check and alternative name by @vigah in #1270
  • docs(readme): Fix spelling by @r8bhavneet in #1271
  • docs(readme): Fix spelling errors by @andsiu #1274
  • fix(ci): Remove yum check-update by @jfagoagas #1275

New Contributors

Read more

Contributors

drewkerrigan, toniblyx, and 11 other contributors
Assets 2
Loading

Prowler 2.10.0 - Flight Of Icarus

25 May 10:26
@toniblyx toniblyx
2.10.0
432416d
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
Prowler 2.10.0 - Flight Of Icarus

Fly on your way, like an eagle
Fly as high as the sun
On your way, like an eagle
Fly, touch the sun

Flight of Icarus is a song of Iron Maiden released in 1983 as part of their Piece of Mind album. There are some amazing guitar solos in this song and it is so good, watch the video and enjoy it like this new version here:
https://www.youtube.com/watch?v=p4w2BZXL6Ss:

imicarus

Image copyright by Iron Maiden

Important changes in this version (read this!):

  • Now you can manage the Allow list feature using DynamoDB instead of just a text plain file.
  • 7 new checks available for CodeBuild, EMR and Lambda:
7.174 [extra7174] CodeBuild Project last invoked greater than 90 days - codebuild [High]
7.175 [extra7175] CodeBuild Project with an user controlled buildspec - codebuild [High]
7.176 [extra7176] EMR Cluster without Public IP - emr [Medium]
7.177 [extra7177] Publicly accessible EMR Cluster - emr [High]
7.178 [extra7178] EMR Account Public Access Block enabled - emr [High]
7.179 [extra7179] Check Public Lambda Function URL - lambda [High]
7.180 [extra7180] Check Lambda Function URL CORS configuration - lambda [Medium]

New features:

Enhancements:

  • Update CloudFormation template for CodeBuild by @jplock in #1114
  • Updated multi-org ProwlerRole.yaml to match current Prowler additions policy by @ChrisGoKim in #1123
  • docs(k8s-integration): Beautify README by @1vicente in #1153

Fixes:

  • fix(checks): Handle AWS Gov Cloud regions #1160
  • fix(check): check_extra7113: Fix wrong listing of RDS instances in regions without databases by @Sinnohd in #1124
  • fix(custom-file-in-bucket): Custom file names are also support for S3 output. by @sergargar in #1129
  • fix(copyToS3): Upload to S3 only when indicated. by @sergargar in #1134
  • fix(actions): tag and push by @jfagoagas in #1142
  • fix(readme): Fix correct permissions for DynamoDB allowlist. by @sergargar in #1147
  • fix(actions): Ignore changes on Readme by @jfagoagas in #1149
  • fix(timestamp): Timestamp to date casting issues solved by @n4ch04 in #1154
  • fix(IllegalLocationConstraintException): Recover bucket policy using the right region endpoint by @jfagoagas in #1155
  • fix(BucketLocation): Recover bucket policy using the right region endpoint by @jfagoagas in #1156
  • fix(remediation): Fix empty remediation fields for checks 7164, 7144 and 7163 by @jfagoagas in #1157

New Contributors

Full Changelog: 2.9.0...2.10.0

Contributors

jplock, Sinnohd, and 10 other contributors
Assets 2
Loading

Prowler 2.9.0 - Run to the Hills

13 Apr 09:44
@jfagoagas jfagoagas
2.9.0
432632d
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
Prowler 2.9.0 - Run to the Hills

In 1982, Iron Maiden released The Number of the Beast, their third studio album and the first with Bruce Dickinson as their lead vocalist. The song Run to the Hills gives me very good memories, as the time we are living will do the same in the future. That song is one of the greatest metal songs in music history. Enjoy it as we do while releasing this new version of Prowler!
https://www.youtube.com/watch?v=86URGgqONvA

number-of-the-beast

Image copyright by Iron Maiden

Important changes in this version (read this!):

Now, if you want to use your allowlist or custom checks you can retrieve it from a S3 Bucket using -w option along with a S3 URI like s3://bucket/prefix/allowlist_sample.txt

Also, we have enriched some IAM checks to provide more information about resources when the check status is PASS.

New Features

Enhancements

  • Update example code for terraform-quickstart by @spazm in #1086
  • Replace comma from csv input info to prevent breaking csv format by @n4ch04 in #1102
  • IAM check116 and check122 now logs more detailed information with PASS results by @n4ch04 in #1107

Fixes

  • Fix(secrets_library): Verify if detect-secrets library is missing by @sergargar in #1080
  • Fix(extra729,extra740): Typo by @mourackb in #1083
  • Fix(extra736): Missing $PROFILE_OPT by @soffensive in #1084
  • Fix(extra792): TLS1.3 policies added as secure and TLS1.1/1.0 as insecure by @sergargar in #1091
  • Fix(extra7172): IllegalLocationConstraintException properly handled by @sergargar in #1093
  • Fix(extra764): NoSuchBucket error properly handled by @sergargar in #1094
  • Fix(extra764): Deleted temporary file references by @n4ch04 in #1089
  • Fix(extra7147): Handle unsupported AWS regions for Glacier by @jfagoagas in #1101
  • Fix(extra79): Typo publiccly -> publicly by @carterjones in #1106
  • Fix(extra75): Empty array check in SECURITYGROUPS object by @nealalan in #1099

New Contributors

Full Changelog: 2.8.1...2.9.0

Contributors

spazm, carterjones, and 7 other contributors
Assets 2
Loading

Prowler 2.8.1

25 Mar 11:59
@sergargar sergargar
2.8.1
1e87ef1
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
Prowler 2.8.1

What's Changed

  • fix(bucket_region): check extra764 doesn't handle bucket region properly by @sergargar in #1077
  • fix(detect-secrets): Include missing colon to link values by @jfagoagas in #1078

Full Changelog: 2.8.0...2.8.1

Contributors

jfagoagas and sergargar
Assets 2
Loading

Prowler 2.8.0 - The Ides of March

16 Mar 17:41
@toniblyx toniblyx
2.8.0
8105e63
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
Prowler 2.8.0 - The Ides of March

The Ides of March is an instrumental song that opens the second studio album of Iron Maiden called Killers. This song is great as an opening, March is the month when spring starts in my side of the world, is always time for optimism. Ides of March also means 15 of March in the Roman calendar (and the day of the assassination of Julius Caesar). Enjoy the song here.

We have put our best to make this release and with important help of the Prowler community of cloud security engineers around the world, thank you all! Special thanks to the Prowler full time engineers @jfagoagas, @n4ch04 and @sergargar! (and Bruce, my dog) ❤️

prowler-team-pic

Important changes in this version (read this!):

Now, if you have AWS Organizations and are scanning multiple accounts using the assume role functionality, Prowler can get your account details like Account Name, Email, ARN, Organization ID and Tags and add them to CSV and JSON output formats. More information and usage here.

New Features

  • 1 New check for S3 buckets have ACLs enabled by @jeffmaley in #1023 :
    7.172 [extra7172] Check if S3 buckets have ACLs enabled - s3 [Medium]
  • feat(metadata): Include account metadata in Prowler assessments by @toniblyx in #1049

Enhancements

Fixes

  • Fix issue extra75 reports default SecurityGroups as unused #1001 by @jansepke in #1006
  • Fix issue extra793 filtering out network LBs #1002 by @jansepke in #1007
  • Fix formatting by @lorchda in #1012
  • Fix docker references by @mike-stewart in #1018
  • Fix(check32): filterName base64encoded to avoid space problems in filter names by @n4ch04 in #1020
  • Fix: when prowler exits with a non-zero status, the remainder of the block is not executed by @lorchda in #1015
  • Fix(extra7148): Error handling and include missing policy by @toniblyx in #1021
  • Fix(extra760): Error handling by @lazize in #1025
  • Fix(CODEOWNERS): Rename team by @jfagoagas in #1027
  • Fix(include/outputs): Whitelist logic reformulated to exactly match input by @n4ch04 in #1029
  • Fix CFN CodeBuild example by @mmuller88 in #1030
  • Fix typo CodeBuild template by @dlorch in #1010
  • Fix(extra736): Recover only Customer Managed KMS keys by @jfagoagas in #1036
  • Fix(extra7141): Error handling and include missing policy by @lazize in #1024
  • Fix(extra730): Handle invalid date formats checking ACM certificates by @jfagoagas in #1033
  • Fix(check41/42): Added tcp protocol filter to query by @n4ch04 in #1035
  • Fix(include/outputs):Rolling back whitelist checking to RE check by @n4ch04 in #1037
  • Fix(extra758): Reduce API calls. Print correct instance state. by @lazize in #1057
  • Fix: extra7167 Advanced Shield and CloudFront bug parsing None output without distributions by @NMuee in #1062
  • Fix(extra776): Handle image tag commas and json output by @jfagoagas in #1063
  • Fix(whitelist): Whitelist logic reformulated again by @n4ch04 in #1061
  • Fix: Change lower case from bash variable expansion to tr by @lazize in #1064
  • Fix(check_extra7161): fixed check title by @n4ch04 in #1068
  • Fix(extra760): Improve error handling by @lazize in #1055
  • Fix(check122): Error when policy name contains commas by @plarso in #1067
  • Fix: Remove automatic PR labels by @jfagoagas in #1044
  • Fix(ES): Improve AWS CLI query and add error handling for ElasticSearch/OpenSearch checks by @lazize in #1032
  • Fix(extra771): jq fail when policy action is an array by @lazize in #1031
  • Fix(extra765/776): Add right region to CSV if access is denied by @roman-mueller in #1045
  • Fix: extra7167 Advanced Shield and CloudFront bug parsing None output without distributions by @NMuee in #1053

New Contributors

Full Changelog: 2.7.0...2.8.0

Contributors

dlorch, jansepke, and 14 other contributors
Assets 2
Loading