Turn the compliance checklist into a real, running scan.
Prowler audits a real AWS account's actual configuration and maps every finding to CIS, SOC 2, and PCI-DSS at once — the concrete tool behind the last slide's framework talk.
# scan with a DEDICATED read-only identity — never personal/admin creds aws iam attach-role-policy --role-name prowler-scan-role \ --policy-arn arn:aws:iam::aws:policy/SecurityAudit prowler aws --compliance cis_4.0_aws,soc2_aws \ --output-formats html,json-ocsf
One scan
Same underlying checks, mapped to CIS and SOC 2 and PCI-DSS simultaneously — not three separate audits.
Read-only, always
Every check is a Describe*/List*/Get* call — the tool auditing you should never be the highest-value target itself.
Severity ≠ priority
A finding on a public bucket of marketing images isn't the same real risk as the same finding on customer PII — the CVSS-vs-reachability logic from Module 2, applied to compliance findings.
"We're SOC 2 compliant" and "we ran Prowler and fixed what it found" are the same claim — one is the paperwork, the other is the actual verification.