Cloud Security Posture
Assessment
Two minutes for an instant posture snapshot. Then grant read-only access and AHAD runs the full assessment — hundreds of automated checks — delivered in your 1:1 briefing.
Unlock with your briefing claim
This assessment is complimentary for IDC Saudi Arabia CIO Summit attendees who have claimed a HackerGazing™ briefing. Takes 30 seconds.
Claim my briefing →Where does your estate live?
Pick everything that applies. Each one is covered by the full assessment.
Your posture snapshot
Based on your ten answers. The full Prowler assessment replaces this with evidence from your actual configuration.
Read-only access, nothing else
Prowler only needs permission to read configuration. It never changes anything, never reads your data, and you can revoke access the moment the assessment is done.
- Create a read-only role for AHAD in IAM. Attach the AWS-managed policies SecurityAudit and ViewOnlyAccess — this is the standard, least-privilege combination Prowler runs with.
- Trust AHAD’s assessment account and set an External ID (we send you both by email after this step).
- Send us the role ARN. Multi-account? Deploy the role via StackSets and send the org ID.
# CLI equivalent (replace the account and external ID from our email)
aws iam create-role --role-name AHAD-ProwlerReadOnly \
--assume-role-policy-document file://trust-ahad.json
aws iam attach-role-policy --role-name AHAD-ProwlerReadOnly \
--policy-arn arn:aws:iam::aws:policy/SecurityAudit
aws iam attach-role-policy --role-name AHAD-ProwlerReadOnly \
--policy-arn arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
Reference: docs.prowler.com → Getting started → AWS authentication.
- Register an application in Microsoft Entra ID (e.g. AHAD-Prowler) and create a client secret with a 30-day expiry.
- Grant the app the built-in roles Reader and Security Reader on every subscription in scope.
- Add Microsoft Graph application permissions Directory.Read.All and Policy.Read.All (admin consent), so identity and conditional-access checks can run.
- Send us the tenant ID, client ID and secret through the secure channel we email you — never in plain email.
# Assign roles on a subscription
az role assignment create --assignee <APP_ID> --role "Reader" --scope /subscriptions/<SUB_ID>
az role assignment create --assignee <APP_ID> --role "Security Reader" --scope /subscriptions/<SUB_ID>
- Create a service account (e.g. ahad-prowler@…) in a project in scope.
- Grant it Viewer and Security Reviewer at the organization or folder level so every project is covered.
- Create a JSON key with a short lifetime and send it through the secure channel we email you.
gcloud organizations add-iam-policy-binding <ORG_ID> \ --member="serviceAccount:ahad-prowler@<PROJECT>.iam.gserviceaccount.com" --role="roles/viewer" gcloud organizations add-iam-policy-binding <ORG_ID> \ --member="serviceAccount:ahad-prowler@<PROJECT>.iam.gserviceaccount.com" --role="roles/iam.securityReviewer"
- Register an application in Entra ID for AHAD with a certificate or short-lived secret.
- Grant Microsoft Graph application permissions, read-only: Directory.Read.All, Policy.Read.All, AuditLog.Read.All, SecurityEvents.Read.All, User.Read.All; plus Exchange.ManageAsApp with the Global Reader role for mail-flow checks. Admin consent required.
- Send us tenant ID and client ID; the secret goes through the secure channel.
M365-only tenants can additionally be checked against CISA’s ScubaGear secure-configuration baselines — we include it when relevant.
- Create a ClusterRole with get / list / watch on all resources and bind it to a service account ahad-prowler in its own namespace.
- Generate a short-lived token for that service account and share it with the API server endpoint through the secure channel.
kubectl create namespace ahad-prowler kubectl create serviceaccount ahad-prowler -n ahad-prowler kubectl create clusterrolebinding ahad-prowler-view --clusterrole=view --serviceaccount=ahad-prowler:ahad-prowler kubectl create token ahad-prowler -n ahad-prowler --duration=72h
We email you the trust details and a secure link for credentials. No scan starts until you confirm.
Request received
Your snapshot is saved with your briefing. Within one business day you’ll get the trust details and a secure link for credentials — then we run the full assessment and walk you through it in your 1:1.