Prowler UI (Docker) - Not able to add AWS Provider using "Connect assuming IAM Role"

[YazeedNO]

Steps to Reproduce

Adding AWS Provider using "Connect via Credentials" works as expected.
Issue:
Not able to add AWS Provider using "Connect assuming IAM Role".
Create CloudFormation Template in AWS account.
Copy Role ARN
Set Session name "prowler-scan"
Set Session timeout "3600"
Error: Provider not set
Error: AWS assume role error - Unable to locate credentials

Expected behavior

Add AWS Cloud Provider via Prowler UI using AWS IAM Role

Actual Result with Screenshots or Logs

See below Environment Resource for screenshots

How did you install Prowler?

Docker (docker pull toniblyx/prowler)

Environment Resource

On AWS EC2 Instance:
OS Running: CIS Ubuntu Linux 22.04 LTS Benchmark - Level 1 - v04 -80ec131e-1631-4b92-92cc-ef35c56c3ec8
R53>ALB>443>TG:3000>EC2(private subnet) with NAT Gateway attached
Error: Provider has no secret

On Docker Desktop:
OS Running: Windows 11 Enterprise (24H2)
Error: AWSAssumeRoleError[1012]: AWS assume role error - Unable to locate credentials

OS used

AWS EC2:
CIS Ubuntu Linux 22.04 LTS Benchmark - Level 1 - v04 -80ec131e-1631-4b92-92cc-ef35c56c3ec8

Docker Desktop:
OS Running: Windows 11 Enterprise (24H2)

Prowler version

5.5.1

Pip version

N/A

Context

Using IAM roles to securely delegate access to AWS resources without hardcoding credentials or relying on local profiles. This aligns with AWS best practices for least privilege and credential management, especially in environments like EC2 or containerized deployments where roles can be assumed dynamically.

[tbalza]

I found a quick workaround for working locally by editing these files,

.env
AWS_PROFILE=prowler-profile

~/.aws/config
[profile prowler-profile]
role_arn = arn:aws:iam::123456789012:role/ProwlerScan
source_profile = default

docker-compose.yaml
api:
volumes:
- "${HOME}/.aws:/home/prowler/.aws:ro"

worker:
volumes:
- "${HOME}/.aws:/home/prowler/.aws:ro"

worker-beat:
volumes:
- "${HOME}/.aws:/home/prowler/.aws:ro"

[YazeedNO]

Thanks @tbalza, will give it a try and let you know how it goes in the Prowler App once tested.

[HugoPBrito]

Hi @YazeedNO,

Were you able to add the provider successfully?

Huge thanks @tbalza! 🥇

[YazeedNO]

See update @HugoPBrito,
Thanks @tbalza, this worked on AWS, I still need to test the functionality on the App as I will need to add multiple AWS Accounts.
I don't think it's feasible to add multiple profiles in ~/.aws/config for this use case.
Will keep you posted on the results of adding multiple AWS accounts with the IAM Role in the App.

However, the App errored out to locate the profile on docker desktop, this is just for local testing, so not a big deal.

[HugoPBrito]

Hi @YazeedNO,

As you said, let us know if anything comes up, as well as when the problem is resolved so we can close the issue once everything is working correctly.

[YazeedNO]

Working on it this week, will post updates by the end of the week.

[YazeedNO]

Local Docker doesn't seem to work for this use case and this was just for testing multiple AWS accounts.

For AWS EC2 instance this worked and we managed to fix this for scanning the current AWS account and multiple AWS Accounts using IAM Roles.

The fix for me was:
Not reading the CloudFormation Template guide.

For Standalone you need to edit the:
AccountID: AWS account ID where ProwlerApp is running
IAM Principal: IAM instance Profile Role used by the EC2 instance.

This CF Template needs to be deployed into the AWS account running ProwlerApp and any other AWS accounts you need to scan.

The most important one is the IAM Role that is assumed by the EC2 instance where ProwlerApp is running.
You will need to add an additional permission policy set to AssumeRole in the other AWS account.
prowler-assume-cross-account-role
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/ProwlerScan" } ] }

All working and not using the workaround as suggested.

[HugoPBrito]

Thank you for your contributions!

We’ll take your experience into account to better guide other users in the future. Your input is really appreciated.

[lzolotarevskyi]

I don't know, this guide is not working for me. I set up ec2, deployed CF template in account where Prowler App is running following this:
AccountID: AWS account ID where ProwlerApp is running
IAM Principal: IAM instance Profile Role used by the EC2 instance.

And I can't scan even the account where ProwlerApp deployed, what am I doing wrong? I am getting error - AWSAssumeRoleError[1012]: AWS assume role error - Unable to locate credentials

Deployed with docker compose