prowler-cloud/Prowler Security Scan

Run Prowler cloud security scanner using the official Docker image

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Activelast commit Jul 10, 2026
License
Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned
uses: prowler-cloud/prowler@7345e051cf5a54e1bf5ac47e1055f9afe28a919b # 5.33.1

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
providerCloud provider to scan (e.g. aws, azure, gcp, github, kubernetes, iac). See https://docs.prowler.com for supported providers.yes
image-tagDocker image tag for prowlercloud/prowler. Default is "stable" (latest release). Available tags: "stable" (latest release), "latest" (master branch, not stable), "<x.y.z>" (pinned release version). See all tags at https://hub.docker.com/r/prowlercloud/prowler/tags nostable
output-formatsOutput format(s) for scan results (e.g. "json-ocsf", "sarif json-ocsf")nojson-ocsf
push-to-cloudPush scan findings to Prowler Cloud. Requires the PROWLER_CLOUD_API_KEY environment variable. See https://docs.prowler.com/user-guide/tutorials/prowler-import-findings#using-the-clinofalse
flagsAdditional CLI flags passed to the Prowler scan (e.g. "--severity critical high --compliance cis_aws"). Values containing spaces can be quoted, e.g. "--resource-tag 'Environment=My Server'".no""
extra-envSpace-, newline-, or comma-separated list of host environment variable NAMES to forward to the Prowler container (e.g. "AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN" for AWS, "GITHUB_PERSONAL_ACCESS_TOKEN" for GitHub, "CLOUDFLARE_API_TOKEN" for Cloudflare). List names only; set the values via `env:` at the workflow or job level (typically from `secrets.*`). See the README for per-provider examples. no""
upload-sarifUpload SARIF results to GitHub Code Scanning (requires "sarif" in output-formats and both `security-events: write` and `actions: read` permissions)nofalse
sarif-filePath to the SARIF file to upload (auto-detected from output/ if not set)no""
sarif-categoryCategory for the SARIF upload (used to distinguish multiple analyses)noprowler
fail-on-findingsFail the workflow step when Prowler detects findings (exit code 3). By default the action tolerates findings and succeeds.nofalse

no outputs