Module 09: Custom Checks & Configurations

Track 2 · Prowler Open Source CLI · Time: ~1h 20 min · Pass: 8/10

Scenario

Cloudsmiths has an internal rule: every S3 bucket must carry a DataClassification tag. None of the upstream checks enforces that, so you're going to write your own. You'll also override the severity of a noisy default check to match Cloudsmiths' actual risk appetite.

Learning objectives

1. Override severity and metadata for built-in checks.
2. Tune configurable checks via --config-file.
3. Build a new check from scratch (Python + metadata).
4. Test the check locally and load it without forking Prowler.
5. Find, install and run community and official checks from the Prowler Registry, and understand how artifacts are published and access-controlled.