Skip to main content

Prowler Implementation Handoff

Overview​

This document outlines the implementation plan for integrating Prowler into our security scanning workflow. Prowler will be used to perform AWS infrastructure security assessments as part of our weekly security scanning process.

Current State​

  • Security scanning workflow is documented in security-scanning.md
  • IAM policy for security auditing is created in security-audit-iam-policy.json
  • Weekly security scans are configured to run via GitHub Actions

Implementation Requirements​

1. Prowler Setup​

  1. Installation:

    • Set up Prowler in a dedicated security scanning environment
    • Configure Prowler to use the security audit IAM role with the policy from security-audit-iam-policy.json

  2. Configuration:

    • Configure Prowler to focus on critical AWS services we use:
      • S3 buckets
      • Lambda functions
      • CloudFront distributions
      • IAM configurations
      • Secrets Manager
      • Systems Manager Parameter Store
      • CloudWatch Logs
      • AWS Config

2. Integration with Existing Workflow​

  1. GitHub Actions Integration:

    • Add Prowler scanning step to the weekly security scan workflow
    • Configure results to be uploaded as artifacts
    • Set up appropriate notifications for critical findings

  2. Results Processing:

    • Implement parsing of Prowler results
    • Categorize findings by severity
    • Generate summary reports
    • Integrate with existing security findings documentation

3. Reporting and Alerting​

  1. Report Format:

    • Create standardized report template
    • Include severity levels
    • Provide actionable remediation steps
    • Link to relevant AWS documentation

  2. Alerting:

    • Set up notifications for critical findings
    • Configure appropriate channels (Slack, email)
    • Define escalation paths

Next Steps​

  1. Initial Setup:

    • Set up Prowler in development environment
    • Test with limited scope
    • Validate IAM permissions

  2. Integration:

    • Add to GitHub Actions workflow
    • Implement results processing
    • Set up reporting

  3. Documentation:

    • Update security scanning documentation
    • Create runbook for Prowler maintenance
    • Document troubleshooting procedures

Resources​

Questions?​

For any questions about this implementation, please contact:

  • [Your Name] - Original Security Scanning Implementation
  • [Security Team Contact] - Security Team Lead