Prowler 5.1.1

UI

Fixes

• fix(filters): add resource type filter for findings by @prowler-bot in #6525
• fix(dep): address compatibility issues by @prowler-bot in #6557

SDK

Fixes

• fix(Azure TDE): add filter for master DB by @prowler-bot in #6514

Full Changelog: 5.1.0...5.1.1

Prowler 5.1.0

New features to highlight in this version

🔒 RBAC - Role Based Access Control

Gain granular control over user access and permissions with our new Role-Based Access Control. Now you can assign roles and privileges to specific users, ensuring they only have access to what they need. Also, now you can create cloud provider's groups to be assigned to roles to allow them to be visible.

🧑‍🔧 4 New Checks!

We have expanded our coverage with 4 new checks, enhancing your security and compliance for EC2, StepFunctions and CloudFormation in AWS and Azure SQLServer.

1. ec2_launch_template_imdsv2_required
2. stepfunctions_statemachine_logging_enabled
3. cloudformation_stack_cdktoolkit_bootstrap_version
4. sqlserver_recommended_minimal_tls_version

🚀 30 New AWS Fixers!

We have included 30 new fixers to help you automatically remediate misconfigurations in AWS services: Lambda, SQS, ECR, Glacier, OpenSearch, S3, EC2, CloudTrail and CodeArtifact.

Run a specific fixer with:
prowler aws --check <check_id> --fixer

See all the new available fixers with prowler aws --list-fixers

1. awslambda_function_not_publicly_accessible_fixer
2. sqs_queues_not_publicly_accessible_fixer
3. ecr_repositories_not_publicly_accessible_fixer
4. glacier_vaults_policy_public_access_fixer
5. opensearch_service_domains_not_publicly_accessible_fixer
6. s3_bucket_public_write_acl_fixer
7. s3_bucket_public_list_acl_fixer
8. s3_bucket_public_access_fixer
9. ec2_instance_port_cifs_exposed_to_internet_fixer
10. s3_bucket_policy_public_write_access_fixer
11. ec2_ami_public_fixer
12. cloudtrail_logs_s3_bucket_is_not_publicly_accessible_fixer
13. codeartifact_packages_external_public_publishing_disabled_fixer
14. ec2_instance_port_cassandra_exposed_to_internet_fixer
15. ec2_instance_port_elasticsearch_kibana_exposed_to_internet_fixer
16. ec2_instance_port_ftp_exposed_to_internet_fixer
17. ec2_instance_port_kafka_exposed_to_internet_fixer
18. ec2_instance_port_kerberos_exposed_to_internet_fixer
19. ec2_instance_port_ldap_exposed_to_internet_fixer
20. ec2_instance_port_memcached_exposed_to_internet_fixer
21. ec2_instance_port_mongodb_exposed_to_internet_fixer
22. ec2_instance_port_mysql_exposed_to_internet_fixer
23. ec2_instance_port_oracle_exposed_to_internet_fixer
24. ec2_instance_port_postgresql_exposed_to_internet_fixer
25. ec2_instance_port_rdp_exposed_to_internet_fixer
26. ec2_instance_port_redis_exposed_to_internet_fixer
27. ec2_instance_port_sqlserver_exposed_to_internet_fixer
28. ec2_instance_port_ssh_exposed_to_internet_fixer
29. ec2_instance_port_telnet_exposed_to_internet_fixer
30. ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports_fixer

📄 Added CIS 3.0 for GCP

Prowler now supports the CIS 3.0 for GCP.

🖊️ New check's category gen-ai

With the growing number of Generative AI, Machine Learning and LLM training services, we are adding a new gen-ai category to allow AI related service checks to be found/run more easily.

🐎 Several performance improvements in the API

🔧 Other issues and bug fixes solved

New Contributors

Special thanks to our amazing new contributors: @madslundholmdk @Twodragon0

• @madslundholmdk made their first contribution in #5821
• @Twodragon0 made their first contribution in #5867

UI

Features

• feat(users): user detail can be edited now properly by @paabloLC in #6135
• feat(GHA): add gha for API by @pedrooot in #6032
• feat(roles): RBAC functionality by @paabloLC in #6201
• feat(scans): add new component - alert bar by @paabloLC in #6391
• feat(update-credentials): add explanation text for the current behavior by @paabloLC in #6400

Fixes

• fix(invitations): remove wrong url by @paabloLC in #6005
• fix(BC: NextUI): fix BC from NextUI, resolve ESLint warnings and optimize hooks dependencies by @paabloLC in #6404
• fix(invitation): correct the URL used to share an invitation by @paabloLC in #6472
• styles(invitations): tweak styles for invitation details box by @paabloLC in #6475

Chores / Dependencies

• chore(rbac): tweaks role permissions by @paabloLC in #6496
• chore(deps-dev): bump eslint-plugin-import from 2.29.1 to 2.31.0 in /ui by @dependabot in #6482
• chore(deps): bump @radix-ui/react-slot from 1.1.0 to 1.1.1 in /ui by @dependabot in #6481
• chore(roles): prevent capitalization of provider groups and roles by @paabloLC in #6497
• chore(groups): Enable updating groups without roles or providers by @paabloLC in #6498
• chore(manage-groups): tweaks for provider manage groups by @paabloLC in #6468
• chore(deps): bump @radix-ui/react-toast from 1.2.1 to 1.2.4 in /ui by @dependabot in #6445
• chore(deps): bump lucide-react from 0.417.0 to 0.471.0 in /ui by @dependabot in #6456
• chore(deps): bump date-fns from 3.6.0 to 4.1.0 in /ui by @dependabot in #6444
• chore(deps-dev): bump @iconify/react from 5.0.1 to 5.2.0 in /ui by @dependabot in #6421
• chore(deps): bump nanoid from 3.3.7 to 3.3.8 in /ui by @dependabot in #6110
• chore(deps): bump cross-spawn from 7.0.3 to 7.0.6 in /ui by @dependabot in #5881
• chore(deps): bump cookie and next-auth in /ui by @dependabot in #5880
• chore(deps): bump next from 14.2.12 to 14.2.22 in /ui by @dependabot in #6356

API

Features

• feat(api-rbac): RBAC system by @AdriiiPRodri in #6114
• feat(services): Add GET /overviews/services to API by @vicferpoy in #6029
• feat(celery): Add configurable broker visibility timeout setting by @vicferpoy in #6245
• feat(compliance): generate compliance reports for GCP scans using API by @vicferpoy in #6318

Fixes

• fix(tenant): fix delete tenants behavior by @vicferpoy in #6013
• fix(deploy): temporal fix for the alpine-python segmentation fault by @AdriiiPRodri in #6109
• fix(RLS): enforce config security by @jfagoagas in #6066
• fix(db-utils): fix batch_delete function by @vicferpoy in #6283
• fix(users): fix /users/me behavior when having more than 1 users in the same tenant by @vicferpoy in #6284
• fix(migrations): fix django migration order dependency by @vicferpoy in #6302
• fix(api): change the inserted_at.lte unittest by @AdriiiPRodri in #6403
• fix(rbac): block admin role deletion by @AdriiiPRodri in #6470

Chores / Dependencies

• ref(rbac): disable some checks by @AdriiiPRodri in #6471
• chore(rls): rename tenant_transaction to rls_transaction by @jfagoagas in #6202
• ref(rbac): improve rbac implementation for views by @AdriiiPRodri in #6226
• chore(rls): Add tenant_id filters in views and improve querysets by @jfagoagas in #6211
• chore(deps-dev): bump openapi-schema-validator from 0.6.2 to 0.6.3 by @dependabot in #6454
• chore(deps-dev): bump vulture from 2.11 to 2.14 in /api by @dependabot in #6426
• chore(deps-dev): bump safety from 3.2.3 to 3.2.9 in /api by @dependabot in #6431
• chore(deps): bump jinja2 from 3.1.4 to 3.1.5 in /api by @dependabot in #6316
• chore(deps): bump django from 5.1.1 to 5.1.4 in /api by @dependabot in #6376
• ref(rbac): enable relationship creation when objects is created by @AdriiiPRodri in #6238

Docs

• docs(prowler-app): add link to https://api.prowler.com/api/v1/docs by @pedrooot in #6016
• docs(api): add commands to run API scheduler by @MrCloudSec in #6085

SDK

Features

• feat(awslambda): add new fixer awslambda_function_not_publicly_accessible_fixer by @danibarranqueroo in #5840
• feat(sqs): add new fixer sqs_queues_not_publicly_accessible_fixer by @danibarranqueroo in https://github.com/prowle...

Prowler 5.0.5 - Powerslave

What's Changed

• fix(gha): run API and UI tests in correct versions by @prowler-bot in #6301
• fix(migrations): fix django migration order dependency by @prowler-bot in #6303
• chore(version): update Prowler version by @MrCloudSec in #6293

Full Changelog: 5.0.4...5.0.5

Prowler 5.0.4 - Powerslave

What's Changed

Fixes

• fix(aws): disallow child-accounts to overwrite policy for ai_services_opt_out by @prowler-bot in #6292
• fix(db-utils): fix batch_delete function by @prowler-bot in #6285
• fix(users): fix /users/me behavior when having more than 1 users in the same tenant by @prowler-bot in #6288

Chores

• chore(findings): remove delta new as filter by default in findings by @prowler-bot in #6281
• chore(gha): solve pypi release github action by @prowler-bot in #6286
• chore(menu): add API reference link to the sidebar by @prowler-bot in #6289
• chore(version): update Prowler version by @MrCloudSec in #6277

Full Changelog: 5.0.3...5.0.4

Prowler 5.0.3 - Powerslave

What's Changed

Fixes

• fix(aws): add missing region to Backup Recovery Point by @prowler-bot in #6275
• fix(aws): solve None type errors by @prowler-bot in #6272
• fix(gha): make conditional job for checking the repo by @prowler-bot in #6260

Chores

• chore(api): Use prowler ^5.0 by @prowler-bot in #6267
• chore(gha): build and push OSS UI by @prowler-bot in #6248
• chore: skip action on .env changes by @prowler-bot in #6259
• chore: update Prowler version by @jfagoagas in #6258
• chore(GHA): add gha for API by @prowler-bot in #6247

Full Changelog: 5.0.2...5.0.3

Prowler 5.0.2 - Powerslave

API

Fixes

• fix(RLS): enforce config security by @prowler-bot in #6190
• feat(celery): Add configurable broker visibility timeout setting by @prowler-bot in #6246

Chores

• chore(rls): rename tenant_transaction to rls_transaction by @prowler-bot in #6203

SDK

Fixes

• fix(.env): remove comment by @prowler-bot in #6242

Chores

• chore(version): update Prowler version by @MrCloudSec in #6196

Full Changelog: 5.0.1...5.0.2

Prowler 5.0.1 - Powerslave

UI

Fixes

• fix(invitations): remove wrong url by @prowler-bot in #6012
• fix(users): user detail can be edited now properly by @prowler-bot in #6137

Chores

• chore(deps): bump cross-spawn from 7.0.3 to 7.0.6 in /ui by @prowler-bot in #6176
• chore(deps): bump nanoid from 3.3.7 to 3.3.8 in /ui by @prowler-bot in #6175
• chore: delete unneeded requirements file by @prowler-bot in #6058

API

Fixes

• fix(deploy): temporal fix for the alpine-python segmentation fault by @prowler-bot in #6115
• fix(tenant): fix delete tenants behavior by @prowler-bot in #6014

SDK

Fixes

• fix(app): add support for TLS 1.3 to Web Apps check by @prowler-bot in #6144
• fix(aurora): Add default ports to the check of using non default ports by @prowler-bot in #6151
• fix(autoscaling): autoscaling_group_launch_configuration_requires_imdsv2 fails if Launch Template is used by @prowler-bot in #6147
• fix(aws): check AWS Owned keys in firehose_stream_encrypted_at_rest by @prowler-bot in #6121
• fix(aws): get firewall manager managed rule groups by @prowler-bot in #6124
• fix(aws): set IAM identity as resource in threat detection by @prowler-bot in #6118
• fix(aws): set same severity for EC2 IMDSv2 checks by @prowler-bot in #6104
• fix(aws): set unique resource IDs by @prowler-bot in #6192
• fix(backup): modify list recovery points call by @prowler-bot in #6096
• fix(compliance_tables): add correct values for findings by @prowler-bot in #6127
• fix(gcp): make sure default project is active by @prowler-bot in #6113
• fix(iam): set unique resource id for each user access key by @prowler-bot in #6134
• fix(rds): add invalid SG to status_extended by @prowler-bot in #6170

Chores

• chore(actions): standardize names by @prowler-bot in #6092

Full Changelog: 5.0.0...5.0.1

Prowler 4.6.2 - Blood Brothers

What's Changed

Fixes

• fix(aws): check AWS Owned keys in firehose_stream_encrypted_at_rest by @prowler-bot in #6120
• fix(aws): get firewall manager managed rule groups by @prowler-bot in #6123
• fix(aws): set IAM identity as resource in threat detection by @prowler-bot in #6117
• fix(aws): set same severity for EC2 IMDSv2 checks by @prowler-bot in #6103
• fix(backup): modify list recovery points call by @prowler-bot in #6057
• fix(compliance_tables): add correct values for findings by @prowler-bot in #6126
• fix(gcp): make sure default project is active by @prowler-bot in #6112
• fix(tests): use datetime.datetime.now() in GCP kms_key_rotation_enabled by @prowler-bot in #6083

Chores

• chore(container): upload v4 with correct tags by @MrCloudSec in #6093
• chore(containers): support for v4.6 branch by @prowler-bot in #6084
• chore(dependabot): Update for UI and v4 by @prowler-bot in #6087
• chore(deps): bump boto3 from 1.35.66 to 1.35.77 by @dependabot in #6107
• chore(deps): bump botocore from 1.35.66 to 1.35.76 by @dependabot in #6071
• chore(deps): bump botocore from 1.35.76 to 1.35.77 by @dependabot in #6100
• chore(deps): bump microsoft-kiota-abstractions from 1.6.2 to 1.6.6 by @dependabot in #6080
• chore(deps): bump msgraph-sdk from 1.12.0 to 1.14.0 by @dependabot in #6074
• chore(deps): bump slack-sdk from 3.33.4 to 3.33.5 by @dependabot in #6077
• chore(deps): bump trufflesecurity/trufflehog from 3.84.1 to 3.85.0 by @dependabot in #6067
• chore(deps-dev): bump bandit from 1.7.10 to 1.8.0 by @dependabot in #6072
• chore(deps-dev): bump coverage from 7.6.7 to 7.6.9 by @dependabot in #6076
• chore(deps-dev): bump mkdocs-material from 9.5.45 to 9.5.48 by @dependabot in #6078
• chore(deps-dev): bump pylint from 3.3.1 to 3.3.2 by @dependabot in #6099
• chore(deps-dev): bump pytest from 8.3.3 to 8.3.4 by @dependabot in #6075
• chore(deps-dev): bump vulture from 2.13 to 2.14 by @dependabot in #6069
• chore(version): update Prowler version by @MrCloudSec in #5969

Full Changelog: 4.6.1...4.6.2

Prowler 5.0.0 - Powerslave 🚀

Tell me why I had to be a powerslave
I don't wanna die, I'm a god
Why can't I live on?
When the life giver dies
All around is laid waste
And in my last hour
I'm a slave to the power of death

Powerslave was the fifth studio album by Iron Maiden, released on 3 September 1984. 🎸 Fast forward 40 years and 3 months later, we are thrilled to announce the release of Prowler 5.0 a.k.a. Powerslave — our most advanced and comprehensive release to date. Powerslave, also the seventh song on that iconic album, was written by Bruce Dickinson and explores an Egyptian pharaoh's wondering why he has to die, we know that is exactly what we think about Open Source, as soon as it is released, a piece of Open Source software will never die. 🌟

Prowler 5.0.0 - Powerslave is meant to be a game changer 🕹️ in the Cloud Security space as it comes with many new and needed features for our community of users and customers. If we want the cloud adoption to keep growing, we need more Open Source software to help gain confidence in the cloud with open, agnostic and transparent tools, that is what we call of the Open Cloud Security movement. 🌐

---

🎉 What's New?

🖥️ Enhanced UI, API, SDK, and Persistent Storage

• A brand-new UI component to unify all scans and drill down into findings and more.
• Robust APIs to solve a variety of use cases.
• SDKs for seamless integration and automation.
• Persistent storage for reporting, ensuring that your security insights are comprehensive and always accessible.

🔄 Continuous Monitoring and One-Time Assessments

• Support for both continuous monitoring and ad-hoc security assessments.
• Why settle for one-time assessments when you can stay continuously protected? 🛡️

📚 Expanded Detection and Remediation Control Framework

• Over 1,000 security controls across AWS, Azure, Google Cloud, and Kubernetes.
• Numerous remediation options to secure your cloud infrastructure effectively.

🤖 AI-Driven Control Creation

• Leveraging artificial intelligence to automatically generate new detection checks and remediations.
• Stay ahead of the latest threats with cutting-edge security measures. ⚡

---

💾 Get Started

From today, you can:

• Use the Prowler platform on-premises by downloading and running it yourself. As usual, using just the powerful CLI with the same output formats as always (pipx install prowler), or for the whole platform together with new components, just run docker compose up -d from the root folder of Prowler repo, open https://localhost:3000, add your user and start making your cloud secure.
• Or use all in one place, Prowler as a Cloud Service managed by us 🌩️ Visit prowler.com and sign up for 15 days free and let us know what do you think! 🗨️

---

🔮 What’s Next?

We're continuously adding new features! Keep track of upcoming updates here: roadmap.prowler.com 🛠️

Join us on this journey to revolutionize Open Cloud Security. 🌟

Prowler 4.6.1 - Blood Brothers

What's Changed

Fixes

• fix(aws): exclude threat detection checks if category not present by @prowler-bot in #5934
• fix(azure): containerregistry_not_publicly_accesible is not accurate by @prowler-bot in #5966
• fix(gcp): use session credentials to check if API is active by @prowler-bot in #5936
• fix(k8s): handle Kubernetes kubeconfig content correctly by @prowler-bot in #5967
• fix(list_by_service): execute lambda if requested by @prowler-bot in #5931
• fix(rds): add default key value to RDS event by @prowler-bot in #5965

Full Changelog: 4.6.0...4.6.1