Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
inspector2_coverage_scan_status_active
Amazon Inspector coverage is evaluated for every resource it tracks (EC2 instances, ECR images and repositories, Lambda functions). A resource whose scan status is INACTIVE, for example because of UNMANAGED_EC2_INSTANCE, NO_INVENTORY, UNSUPPORTED_OS or ACCESS_DENIED, is not being scanned for vulnerabilities.
Stopped, terminated, tag-excluded and aged-out resources are not evaluated.
Amazon Inspector 2 activation and coverage across regions, verifying that scanning is active for EC2, ECR, Lambda functions, and Lambda code where applicable.
It flags missing account activation or gaps in any scan type.
integration_instance_access_restricted
Oracle Integration Cloud instances are evaluated for network endpoint restrictions, confirming access is limited to approved IPs or VCNs. Configurations with 0.0.0.0/0, missing endpoint details, or PUBLIC endpoints without allowlists are identified; PRIVATE endpoints or PUBLIC endpoints with IP/VCN allowlists indicate restricted access.
intune_device_compliance_policy_unassigned_devices_not_compliant_by_default
Intune has a built-in Device Compliance Policy that governs how devices without an explicit compliance policy are treated. When the default behavior marks those devices as Compliant, unmanaged devices can be treated as compliant and gain access to corporate resources. This check verifies the default is set to Not compliant (secureByDefault = true).
kafka_cluster_encryption_at_rest_uses_cmk
Amazon MSK clusters are inspected for encryption at rest using a customer-managed KMS key for data volumes. Serverless clusters are inherently encrypted. Provisioned clusters are recognized only when the configured DataVolumeKMSKeyId corresponds to a customer-managed key.
kafka_cluster_enhanced_monitoring_enabled
Amazon MSK clusters are assessed for enhanced monitoring levels beyond DEFAULT (e.g., PER_BROKER, PER_TOPIC_PER_BROKER, PER_TOPIC_PER_PARTITION).
Serverless clusters include enhanced monitoring by design; provisioned clusters are evaluated by their configured monitoring level.
kafka_cluster_in_transit_encryption_enabled
Amazon MSK clusters are evaluated for encryption in transit on both paths: clientbroker set to TLS only and inter-broker encryption enabled. Serverless clusters provide this by default.
The finding highlights clusters where client-broker traffic isn't TLS-only or inter-broker encryption is turned off.
kafka_cluster_is_public
Amazon MSK clusters with broker endpoints exposed to the public Internet.
Serverless clusters are private by default; provisioned clusters are evaluated for their public access configuration.
kafka_cluster_mutual_tls_authentication_enabled
Amazon MSK clusters enforce client authentication on client-to-broker connections. Serverless clusters use TLS-based authentication by default; provisioned clusters must have mutual TLS (mTLS) explicitly enabled.
kafka_cluster_unrestricted_access_disabled
Amazon MSK clusters are evaluated for unauthenticated client access. Serverless clusters inherently require authentication; provisioned clusters are checked for configurations that allow unrestricted connections rather than authenticated clients.
kafka_cluster_uses_latest_version
Amazon MSK clusters are evaluated for use of the latest supported Apache Kafka version. Provisioned clusters are compared to the most recent release, while serverless clusters are treated as automatically managed for versioning.
kafka_connector_in_transit_encryption_enabled
MSK Connect connectors are evaluated for in-transit encryption using TLS on client connections to Kafka brokers and connected systems.
Disable anonymous requests to the API server.
Do not use token based authentication.
This admission controller rejects all net-new usage of the Service field externalIPs.
Use https for kubelet connections.
Enable certificate based kubelet authentication.
Verify kubelet's certificate before establishing connection.
Do not always authorize all requests.
Restrict kubelet nodes to reading only objects associated with them.
Turn on Role Based Access Control.
Limit the rate at which the API server accepts requests.
Do not allow all requests.
Always pull images.