Sold by: Prowler
Deployed on AWS
Prowler Private Cloud is the full Prowler cloud security platform, installed in your own AWS account. This bundle covers 10 paid and 15 other cloud accounts every month for 1,000 USD a month, or 9,600 USD for 12 months upfront. Your findings stay in your account and Region, and the charge is on your AWS bill.
Overview
Prowler is the open source cloud security platform. Prowler Private Cloud is the full Prowler platform, installed in your own AWS account from one CloudFormation template and running on Amazon ECS.
What you get
- Scans of every connected cloud account, on the schedule you set, as often as you like.
- Compliance reports for 70+ frameworks, including CIS, NIST 800-53, PCI DSS, ISO 27001, SOC 2 and HIPAA.
- Lighthouse AI, the security assistant, on Amazon Bedrock in your account.
- Attack paths, alerts, finding triage, organizations and single sign-on.
Why Private Cloud
- Your findings and resource data never leave your account. You choose the Region.
- Prowler has no access to your installation. Scans run from your account with read-only roles you control.
Need AWS GovCloud (US), an air-gapped environment, or a different bundle size or contract term? We offer those through a private offer. Contact us at support@prowler.com .
Pricing
- 1,000 USD per month, billed every month the installation runs, from the month you subscribe, accounts onboarded or not. Or 9,600 USD for 12 months paid upfront (20% off).
- Includes 10 paid accounts and 15 other accounts each month. Every account beyond either is 125 USD a month (reduced from 200 USD).
- Example: 12 AWS accounts and 16 Google Cloud projects in a month = 1,000 USD + 3 extra accounts (375 USD) = 1,375 USD.
How billing works
- You're billed for the cloud accounts Prowler scans in each calendar month (UTC). An account counts once a month, however many scans it has, even if you remove it later that month.
- Your AWS bill lists every line of the price table, including the accounts your plan includes at $0.00.
- At the start of each month, your installation emails you last month's usage, line by line.
- AWS bills the infrastructure and Amazon Bedrock usage separately, at AWS prices.
FAQ
Which accounts are paid, and which are not? Paid accounts are AWS accounts, Azure subscriptions and Microsoft 365 tenants. Everything else Prowler scans is a non-paid "other" account: Google Cloud, Kubernetes, GitHub, MongoDB Atlas, infrastructure as code, Oracle Cloud, Alibaba Cloud, Cloudflare, OpenStack, container images, Google Workspace, Vercel and Okta. Other accounts cost nothing up to your plan's allowance: one per paid account on Pay as You Go, 15 on the 10-Account Bundle and 40 on the 25-Account Bundle. Past that, each one is an extra account at 125 USD a month.
Does any of my data leave my AWS account? No. Findings, resource data and Lighthouse AI prompts stay in your account and Region. The installation reports account counts to AWS Marketplace for billing and checks this listing's registry for new releases.
What does the AWS infrastructure cost? AWS bills it to your account separately from Prowler, at AWS prices for your Region.
What happens if my subscription ends? Prowler keeps working for 7 days and emails you every day. After that, new scans and premium features pause, but your findings, history and reports stay and nothing is deleted. Subscribe again and everything resumes within the hour.
How do updates work? New Prowler releases install automatically in a nightly window. A database snapshot is taken before each update.
How does my team sign in, and who can reach the web interface? After the install, open the address in the stack's Outputs tab (UiUrl) and sign in as <admin@prowler.local> with the admin password you chose. Invite your team from Users, or set up single sign-on. There is no public sign-up. You can change the admin password in the portal, or remove the admin once your team is in; updates don't bring it back. Who can reach the web interface is what you chose at launch: from anywhere, or only from your IP range.
Can I use my own domain? Yes, at launch or later; without one, Prowler runs on its CloudFront address. Use a subdomain starting with prowler, such as prowler.example.com: Prowler then answers at cloud.prowler.example.com, api.cloud.prowler.example.com and mcp.prowler.example.com. Get an ACM certificate for them in us-east-1 (and one in your Region unless the domain is a Route 53 zone in this account), then update the stack and fill in Your own domain. Automatic updates keep it.
How do I turn Lighthouse AI on or off? To turn it on, update the stack in CloudFormation and set Lighthouse AI to Enabled. It is ready within minutes, with no keys, and AWS bills Bedrock usage to your account. To turn it off, delete its provider in the portal's Lighthouse AI settings; setting the stack back to Disabled leaves it as it is.
How do I uninstall or reinstall? Contact support@prowler.com and we'll send you the steps. Deleting the stack keeps your data (database snapshot, buckets, secrets, key), and a new installation in the same account needs them removed first. One installation per account. Cancel your subscription separately in the AWS Marketplace console.
Highlights
- The full Prowler platform in your own AWS account. Findings, resource data and AI prompts stay in your VPC and Region.
- 2,500+ checks and 70+ compliance frameworks across AWS, Azure, Google Cloud, Kubernetes, Microsoft 365, GitHub and infrastructure as code.
- Lighthouse AI on Amazon Bedrock in your account, with no extra subscription, and attack paths included.
Details
Sold by
Categories
Delivery method
Supported services
Delivery option
Deploy on Amazon ECS with AWS CloudFormation
Latest version
Operating system
Linux
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time. Alternatively, you can pay upfront for a contract, which typically covers your anticipated usage for the contract duration. Any usage beyond contract will incur additional usage-based costs.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/unit |
|---|---|---|
Bundle month | 10 paid, 15 other accounts a month. 365-day contract: quantity 1 covers the year | $1,000.00 |
Included paid account | AWS, Azure and Microsoft 365 accounts covered by the bundle fee, up to 10 | $0.00 |
Included other account | Other accounts (Google Cloud, Kubernetes, GitHub, more) in the bundle fee, up to 15 | $0.00 |
Extra account | Each account of either kind beyond the bundle's 10 paid and 15 other. Reduced from $200 | $125.00 |
Dimensions summary
You pay one monthly bundle fee that covers up to 10 paid accounts and up to 15 other accounts. Paid accounts include AWS, Azure, and Microsoft 365. Other accounts include Google Cloud, Kubernetes, GitHub, and more. These two account types are counted separately against the bundle's limits. If you go beyond either limit, each account past the cap bills as a separate extra-account charge, at a reduced rate. Pricing scales by adding extra accounts on top of the fixed bundle fee.
Top-of-mind questions for buyers
An account is a single provider account. For AWS it means one AWS account, for Azure one subscription, and for Microsoft 365 one tenant. For code repositories it means one repository. For other providers like Kubernetes or managed code hosting, each connected account or project counts as one.
The bundle covers up to 10 paid accounts and up to 15 other accounts. Each account past either cap bills separately as an extra account, at a reduced rate shown in the table. The monthly bundle fee stays fixed, and extra-account charges add on top.
They count separately. Paid accounts (AWS, Azure, Microsoft 365) count against the 10-account limit. Other accounts (Google Cloud, Kubernetes, code repositories, and more) count against the 15-account limit. Filling one limit does not reduce room in the other. Overflow in either triggers extra-account charges.
prowler.com
Helpful?
Vendor refund policy
Usage is billed as it happens. If you believe you were charged in error, contact support@prowler.com within 30 days and we will review it.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Deploy on Amazon ECS with AWS CloudFormation
Supported services: Learn more
- Amazon ECS
Container image
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
Prowler Private Cloud updates itself: new Prowler releases install automatically every night. If AWS emails you that a version is no longer offered to new subscribers, your installation is not affected and you don't need to do anything.
Adds a one-click "Launch in AWS CloudFormation" link to this delivery option. Same images and template as 5.46.100.
First release of Prowler Private Cloud on AWS Marketplace, built on Prowler 5.46. The full Prowler platform runs in your own AWS account on Amazon ECS.
What you get in this version:
- Scans of AWS, Azure, Microsoft 365, Google Cloud, Kubernetes, GitHub and more, on the schedule you set, with read-only access.
- New checks from Prowler 5.43 to 5.46: Amazon Bedrock guardrails and model invocation logging, Amazon Cognito account recovery, AWS WAF managed rules, Google Vertex AI Workbench, Azure AI Services and Microsoft Entra ID.
- Compliance reports for every public framework Prowler supports, including the new FedRAMP 20x Key Security Indicators and Class C rules.
- Issues: failed findings grouped into attack paths, each with an exploitability verdict and the evidence behind it.
- Partial scans: re-check up to 10 resources at once, for example to confirm a fix.
- Onboarding of single accounts or whole AWS Organizations, Azure management groups and Google Cloud organizations.
- Attack paths, alerts, finding triage, single sign-on, the Prowler API and the Prowler MCP Server.
- Lighthouse AI, the security assistant, on Amazon Bedrock in your own account (OpenAI gpt-oss-120b), when you turn it on.
- Security updates through Prowler 5.46, including the October 2026 fixes for Node.js, Next.js, Django REST framework and Pillow.
Additional details
Usage instructions
Before you start
- An AWS account where you can create IAM roles.
- About 35 minutes for the install.
- One Prowler installation per AWS account.
Install
- Open the installation link for this listing. It opens the AWS CloudFormation console with the Prowler template loaded: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https%3A%2F%2Fprowler-privatecloud-marketplace-templates.s3.us-east-1.amazonaws.com%2Ftemplates%2Fbundle10%2F5.46.100%2Ftemplate.yaml&stackName=prowler-private-cloud
- At the top right of the console, switch to a supported Region. AWS Marketplace only accepts usage from Amazon ECS in these Regions, so the template refuses any other:
- Americas: us-east-1, us-east-2, us-west-1, us-west-2, ca-central-1, sa-east-1
- Europe: eu-west-1, eu-west-2, eu-west-3, eu-central-1, eu-north-1
- Asia Pacific: ap-east-1, ap-south-1, ap-southeast-1, ap-southeast-2, ap-northeast-1, ap-northeast-2
- Fill in the Required section:
- Admin password: for the built-in user <admin@prowler.local>. 12 to 72 characters, with upper and lower case letters, a digit and a symbol.
- Notification email: receives update, alarm and subscription notices.
- Lighthouse AI: Enabled or Disabled. It needs Amazon Bedrock's gpt-oss-120b model, which isn't offered in us-west-1, ca-central-1, eu-west-3 or ap-east-1. Choose Disabled there.
- Who can open the portal: from anywhere, or only from your IP range. For an IP range, enter it as a CIDR, for example 203.0.113.0/24.
- Leave the other sections empty unless you need them:
- Network: an existing VPC, with two private subnets in different zones and a NAT gateway.
- Your own domain: you can also add it later with a stack update.
- Version: leave it as it is.
- Tick the IAM acknowledgements and choose Create stack. The install takes about 35 minutes.
- Confirm the subscription email AWS sends to the notification address. Without it, you get no notices.
- Open the portal address in the stack's Outputs tab (UiUrl) and sign in as <admin@prowler.local> with your password.
- The AWS account you installed in is already connected. Start its first scan from Scans.
- To add your team, open Users in your Prowler Private Cloud portal and create an invitation for each person. The portal shows an invitation link: copy it and send it to them yourself, because this installation doesn't send email.
- To use single sign-on instead, set it up from Integrations in the portal, in the SSO section.
- Add more accounts, or a whole AWS Organization, from Cloud Providers.
What the stack creates
- IAM roles for its own services, and a read-only scan role.
- A VPC (unless you chose one), an ECS cluster on Fargate, an Aurora PostgreSQL database, an ElastiCache cache, S3 buckets and a CloudFront distribution.
- A KMS key. Data is encrypted at rest with it, and in transit with TLS.
- SNS notifications, CloudWatch logs and alarms, and AWS Backup.
AWS bills this infrastructure to your account.
What leaves your account
- Usage reports to AWS Marketplace, every hour.
- A check of this listing's container registry for new releases, every night.
- With Lighthouse AI on, calls to Amazon Bedrock in your own account, billed by AWS per use.
Billing
- Each account scanned in a calendar month counts once that month.
- If the subscription ends, the portal and a daily email count down 7 days. Then new scans and premium features pause. Your data stays, and everything resumes within the hour of subscribing again.
Updates and changes
- New releases install automatically in a nightly window.
- To change a setting later, update the stack.
Help
- Support: support@prowler.com
- Documentation: https://docs.prowler.com
- Every check and compliance framework: Prowler Hub, https://hub.prowler.com
Resources
Vendor resources
Support
Vendor support
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Prowler Private Cloud is the full Prowler cloud security platform, installed in your own AWS account. This bundle covers 25 paid and 40 other cloud accounts every month for 2,000 USD a month, or 19,200 USD for 12 months upfront. Your findings stay in your account and Region, and the charge is on your AWS bill.
Prowler Private Cloud is the full Prowler cloud security platform, installed in your own AWS account. It checks AWS, Azure, Google Cloud, Kubernetes, Microsoft 365 and more against 2,500+ security checks and 70+ compliance frameworks. Your findings stay in your account and Region. Pay 125 USD per paid account a month, on your AWS bill.
Prowler Cloud is a cloud security platform built on the open source Prowler engine. It runs scheduled, configurable scans across AWS, Azure, Google Cloud, Kubernetes, Microsoft 365, GitHub and more, with organization-wide onboarding for AWS, Azure and GCP. Track compliance against CIS, NIST, PCI DSS and every public framework, triage findings, map attack paths, and get alerts via Slack, Jira and email. Includes Lighthouse AI - The Agentic Cloud Defender, RBAC, SAML SSO, Security Hub integration, full API and MCP server.
Prowler Cloud is a cloud security platform built on the open source Prowler engine. It runs scheduled, configurable scans across AWS, Azure, Google Cloud, Kubernetes, Microsoft 365, GitHub and more, with organization-wide onboarding for AWS, Azure and GCP. Track compliance against CIS, NIST, PCI DSS and every public framework, triage findings, map attack paths, and get alerts via Slack, Jira and email. Includes Lighthouse AI - The Agentic Cloud Defender, RBAC, SAML SSO, Security Hub integration, full API and MCP server.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.