Getting Started with the IaC Provider

Prowler’s Infrastructure as Code (IaC) provider enables scanning of local or remote infrastructure code for security and compliance issues using Trivy. This provider supports a wide range of IaC frameworks, allowing assessment of code before deployment.

Supported IaC Formats

Prowler IaC provider scans the following Infrastructure as Code configurations for misconfigurations and secrets:

Configuration Type	File Patterns
Kubernetes	*.yml, *.yaml, *.json
Docker	Dockerfile, Containerfile
Terraform	*.tf, *.tf.json, *.tfvars
Terraform Plan	tfplan, *.tfplan, *.json
CloudFormation	*.yml, *.yaml, *.json
Azure ARM Template	*.json
Helm	*.yml, *.yaml, *.tpl, *.tar.gz, etc.
YAML	*.yaml, *.yml
JSON	*.json
Ansible	*.yml, *.yaml, *.json, *.ini, without extension

How It Works

• Prowler Cloud leverages Trivy to scan local directories (or specified paths) for supported IaC files, or scans remote repositories.
• No cloud credentials or authentication are required for local scans.
• For remote repository scans, authentication can be provided via git URL, CLI flags or environment variables.
  • Check the IaC Authentication page for more details.
• Mutelist logic (filtering) is handled by Trivy, not Prowler.
• Results are output in the same formats as other Prowler providers (CSV, JSON-OCSF, HTML), plus SARIF for GitHub Code Scanning integration.

Prowler Cloud

Supported Scanners

Scanner selection is not configurable in Prowler Cloud. Default scanners, misconfig and secret, run automatically during each scan.

Step 1: Access Prowler Cloud or Prowler Local Server

1. Navigate to Prowler Cloud or launch Prowler Local Server

2. Go to “Configuration” > “Providers”

   

3. Click “Add Provider”

   

4. Select “Infrastructure as Code”

   

5. Add the Repository URL and an optional alias, then click “Next”

   

Step 2: Enter Authentication Details

6. Optionally provide the authentication details for private repositories, then click “Next”

   

Step 3: Verify Connection & Start Scan

7. Review the provider configuration and click “Launch scan” to initiate the scan

   

Prowler CLI

Supported Scanners

Prowler CLI supports the following scanners:

• Vulnerability
• Misconfiguration
• Secret
• License

By default, only misconfiguration and secret scanners run during a scan. To specify which scanners to use, refer to the Specify Scanners section below.

Usage

Use the iac argument to run Prowler with the IaC provider. Specify the directory or repository to scan, frameworks to include, and paths to exclude.

Scan a Local Directory (default)

prowler iac --scan-path ./my-iac-directory

Scan a Remote GitHub Repository

prowler iac --scan-repository-url https://github.com/user/repo.git

Authentication for Remote Private Repositories

Authentication for private repositories can be provided using one of the following methods:

• GitHub Username and Personal Access Token (PAT):
  prowler iac --scan-repository-url https://github.com/user/repo.git \
    --github-username <username> --personal-access-token <token>
  
• GitHub OAuth App Token:
  prowler iac --scan-repository-url https://github.com/user/repo.git \
    --oauth-app-token <oauth_token>
  
• If not provided via CLI, the following environment variables will be used (in order of precedence):
  • GITHUB_OAUTH_APP_TOKEN
  • GITHUB_USERNAME and GITHUB_PERSONAL_ACCESS_TOKEN
• If neither CLI flags nor environment variables are set, the scan will attempt to clone without authentication or using the credentials provided in the git URL.

Mutually Exclusive Flags

• --scan-path and --scan-repository-url are mutually exclusive. Only one can be specified at a time.

Specify Scanners

To run only specific scanners, use the --scanners flag. For example, to scan only for vulnerabilities and misconfigurations:

prowler iac --scan-path ./my-iac-directory --scanners vuln misconfig

Exclude Paths

prowler iac --scan-path ./my-iac-directory --exclude-path ./my-iac-directory/test ./my-iac-directory/examples

Output

Use the standard Prowler output options. The IaC provider also supports SARIF output for GitHub Code Scanning integration:

prowler iac --scan-path ./iac --output-formats csv json-ocsf html

SARIF Output

To generate SARIF output for integration with SARIF-compatible tools:

prowler iac --scan-repository-url https://github.com/user/repo -M sarif

See the SARIF reporting documentation for details on the format and severity mapping.