Prowler

Connect Prowler so agents can review failed security findings, exposed resources, and compliance status across your cloud accounts

Connect Prowler and CloudThinker agents can list failed security checks by severity, show the resources behind them, and report where each compliance framework is failing. Prowler authenticates with an API key, and the connection is read-only: agents never start scans, mute findings, or change providers.

Prerequisites

• A Prowler Cloud account, or a self-managed Prowler whose API is reachable from the internet. To limit who can reach it, allowlist CloudThinker’s egress IPs. These docs don’t publish CloudThinker’s egress IP list: ask your CloudThinker contact, or contact us. See Reaching private services for other options.
• At least one cloud account (Prowler calls it a provider) that Prowler has already scanned. Agents read scan results; they can’t run a scan.
• A Prowler user with the Manage Account permission. Prowler requires it to create API keys.
• Edit permission on connections in your CloudThinker workspace.

Setup

1. Create an API key in Prowler

   Sign in to Prowler as the user whose access agents should have (see Required permissions). Go to Profile → Account and click Create API Key to open the form.

   Name the key cloudthinker and optionally set an expiration date. Without one, the key expires after 365 days. Then click Create API Key in the form.

   Prowler shows the new key once. Copy it before you close the dialog.

2. Open Prowler in CloudThinker

   In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for Prowler and click Connect.

3. Enter the key and connect

   Fill in the two fields. The form shows them by these exact names:

   • PROWLER_API_KEY: the key you copied.
   • API_BASE_URL: keep the default for Prowler Cloud, or enter your self-managed Prowler API address.

   Click Connect.

   Success state: the Prowler connection shows a Connected status.

Connected doesn’t prove the key works. Prowler checks the key the first time an agent calls it, so run the verify prompt below right after you connect.

Connection details

Field	Required	Description	Example
PROWLER_API_KEY	Yes	Prowler API key	<your-api-key>
API_BASE_URL	No	Prowler API address. Defaults to https://api.prowler.com/api/v1 (Prowler Cloud)	https://prowler.example.com/api/v1

Required permissions

A Prowler API key has the same access as the user who created it.

Goal	Prowler setup
Read findings, resources, and compliance	Unlimited Visibility, or only the provider groups agents should see
Create the key	Manage Account

Create the key from a dedicated Prowler user. Give that user a role with Manage Account (needed to create its own key) plus Unlimited Visibility or only the provider groups CloudThinker needs. You can then change or remove its access without affecting anyone else.

Agent capabilities

Capability	What agents read
Provider coverage	The cloud accounts Prowler monitors and an overview of their findings
Failed findings	Failed checks filtered by severity (critical, high, medium, low, informational), grouped, with details
Resources	Resource inventory, one resource’s details, and the findings on it
Compliance	Status per framework and the requirements that fail
Checks and docs	What a Prowler check or compliance framework covers, from the Prowler Hub catalog and Prowler documentation

Checks and docs come from the public Prowler Hub and Prowler documentation, not from your tenant. Everything else is read with your API key.

Agents can’t add or delete providers, start or schedule scans, create or change mute rules, or send findings to Jira. Do those in Prowler.

Verify the connection

Start a chat, type # and pick Prowler, then ask:

Summarize my Prowler providers and the count of failed findings by severity

Expected result: a list of your providers with failed-finding counts per severity. If the key is bad, the agent reports a 401 error instead (see Troubleshooting).

Example prompts

List the critical failed Prowler findings and the resources they affect
Which Prowler compliance frameworks have the most failing requirements?
Show the Prowler resource inventory for my AWS accounts

Agents answer from what they read in the current conversation. A failed Prowler call is reported as an error, never as zero findings.

Troubleshooting

Every request fails with 401

Prowler rejected the key. It may be mistyped, expired, or revoked, or its user was removed from the tenant. Create a new key in Profile → Account and update the connection.

Requests fail with a not-found error

API_BASE_URL is wrong. Restore https://api.prowler.com/api/v1 for Prowler Cloud, or enter your self-managed API address ending in /api/v1.

Agents see no providers or findings

The key’s user can’t see any providers, or Prowler has no scan results yet. Give the user Unlimited Visibility or the right provider groups, and check in Prowler that a scan has finished.

Some providers or findings are missing

The key’s user sees only the provider groups its role allows. Add the missing provider groups to that role, or give it Unlimited Visibility, then ask again.

An agent says it can't start a scan or onboard an account

That’s expected. The connection is read-only. Add the cloud account and run the scan in Prowler, then ask again.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Revoke, don’t delete. Prowler can’t delete an API key. Use Revoke to disable a key you no longer need.
• Rotate before expiry. Keys expire after 365 days by default. Create a new key and update the connection before then.

Related

AWS Connection

Inspect and fix the accounts Prowler scans

Drata Connection

Failing tests, control readiness, and personnel gaps