prowler-cloud/Prowler Security Scan
Run Prowler cloud security scanner using the official Docker image
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- Apache 2.0
Pinned Snippet
uses: prowler-cloud/prowler@7345e051cf5a54e1bf5ac47e1055f9afe28a919b # 5.33.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| provider | Cloud provider to scan (e.g. aws, azure, gcp, github, kubernetes, iac). See https://docs.prowler.com for supported providers. | yes | — |
| image-tag | Docker image tag for prowlercloud/prowler. Default is "stable" (latest release). Available tags: "stable" (latest release), "latest" (master branch, not stable), "<x.y.z>" (pinned release version). See all tags at https://hub.docker.com/r/prowlercloud/prowler/tags | no | stable |
| output-formats | Output format(s) for scan results (e.g. "json-ocsf", "sarif json-ocsf") | no | json-ocsf |
| push-to-cloud | Push scan findings to Prowler Cloud. Requires the PROWLER_CLOUD_API_KEY environment variable. See https://docs.prowler.com/user-guide/tutorials/prowler-import-findings#using-the-cli | no | false |
| flags | Additional CLI flags passed to the Prowler scan (e.g. "--severity critical high --compliance cis_aws"). Values containing spaces can be quoted, e.g. "--resource-tag 'Environment=My Server'". | no | "" |
| extra-env | Space-, newline-, or comma-separated list of host environment variable NAMES to forward to the Prowler container (e.g. "AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN" for AWS, "GITHUB_PERSONAL_ACCESS_TOKEN" for GitHub, "CLOUDFLARE_API_TOKEN" for Cloudflare). List names only; set the values via `env:` at the workflow or job level (typically from `secrets.*`). See the README for per-provider examples. | no | "" |
| upload-sarif | Upload SARIF results to GitHub Code Scanning (requires "sarif" in output-formats and both `security-events: write` and `actions: read` permissions) | no | false |
| sarif-file | Path to the SARIF file to upload (auto-detected from output/ if not set) | no | "" |
| sarif-category | Category for the SARIF upload (used to distinguish multiple analyses) | no | prowler |
| fail-on-findings | Fail the workflow step when Prowler detects findings (exit code 3). By default the action tolerates findings and succeeds. | no | false |
Outputs
no outputs