Scanning AWS Accounts when not deployed in AWS?

[kfoxton]

Hello, We were trying to setup the assume role setup to scan our AWS Organization's aws accounts. We have Prowler setup on-premise, but part of the cloudformation setup is to define the account that the role assumption will come from, as per the image here: https://mintcdn.com/prowler/3MeTQEK7UW2A9QiV/images/providers/fill-stack-data.png?fit=max&auto=format&n=3MeTQEK7UW2A9QiV&q=85&s=aea65d657787c8998f9dadd0469b3dbb . Is it a requirement that the scanner needs to be deployed in an AWS account in order to authenticate in this manner?

Thanks,

[HugoPBrito]

Hi @kfoxton,

Yes, it is. CloudFormation AssumeRole is only used in the context of AWS, as it allows entities within AWS to assume a role in another AWS account, not in other cloud providers.

[kfoxton]

For setting up Credentials then, is there a recommended permission setup for the user that will be used to setup the credentials? From the setup document, it just seems to say create an iam access-key:

Thanks,

[andoniaf]

Hi @kfoxton, the Credentials section is only if you want to use static credentials instead of assume role. The recommended way is to use assume role.

There's no problem with having Prowler self-hosted on-premise. To use assume role, you need to:

1. Configure AWS credentials on your on-premise (via AWS CLI, environment variables, etc.)
2. Deploy the CloudFormation template in the AWS account(s) you want to scan
3. Use the AWS account ID from step 1 in the CloudFormation template's "Account ID" field - this allows those credentials to assume the role

However, whether assume role is the best choice for you depends on how you can configure AWS credentials in your self-hosted environment. If you cannot configure them programmatically and will be manually managing static credentials anyway, then I recommend you skip the assume role setup and use those static credentials directly when configuring the provider in Prowler (the Credentials section).

In that case, if you're doing a one-time assessment, short-term credentials are always better for security. But if you want continuous monitoring without having to refresh credentials every time, you'll need to create an Access Key for a user with the required permissions to run the scan.