prowler-compliance
This skill handles end-to-end compliance framework authoring, from choosing between universal (multi-provider, zero Python code) or legacy (single-provider, existing families) schemas to syncing with upstream sources, mapping checks to controls, and fixing JSON bugs. Use it when creating new frameworks, adding ConfigRequirements guardrails, auditing check mappings, or troubleshooting compliance output in the UI.
prowler-compliance creates, syncs, and audits compliance frameworks across multiple cloud providers using universal or legacy JSON schemas.
AI-generated summary based on this skill's SKILL.md
Install
prowler-cloud/prowler/prowler-compliance · repository language: Python
git clone https://github.com/prowler-cloud/prowler
cp -r prowler/skills/prowler-compliance ~/.claude/skills/prowler-compliancenpx skillfed install prowler-cloud/prowler/prowler-complianceFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I create compliance frameworks in prowler?
prowler-compliance handles end-to-end framework authoring. Choose between universal schemas (multi-provider, zero Python code) for new frameworks or legacy schemas (single-provider, existing families) for updates. Universal frameworks let you define requirements once and map checks across AWS, Azure, and GCP without coding. Legacy frameworks work within established provider families. Both support syncing with upstream sources like CIS, NIST, and CSA CCM.
What's the difference between universal and legacy compliance schemas?
prowler-compliance offers two schema types. Universal frameworks are multi-provider, require no Python code, and let you map a single requirement to checks across AWS, Azure, and GCP simultaneously. Legacy frameworks are single-provider, use existing families, and require Python code for provider-specific logic. Choose universal for new, cross-cloud frameworks; use legacy when extending established provider families or maintaining backward compatibility.
How do I map checks to compliance requirements in prowler?
prowler-compliance supports check-to-requirement mapping through its framework structure. Define requirements, then map each to one or more checks per provider. Use ConfigRequirements guardrails to prevent loosened configurations from satisfying stricter controls. Audit mappings by reviewing the compliance JSON, validating schema structure, and testing output in the UI. The skill handles both universal (cross-provider) and legacy (single-provider) mapping patterns.
What are ConfigRequirements guardrails and how do I add them?
prowler-compliance's ConfigRequirements guardrails prevent weakened configurations from falsely satisfying compliance requirements. Add them to your framework to enforce stricter validation logic beyond basic check results. This ensures that even if a check passes, the guardrail can fail if the underlying config doesn't meet the requirement's intent. Use guardrails when mapping checks to high-assurance controls or when a single check result isn't sufficient for compliance.
How do I sync compliance frameworks with upstream catalogs like CIS or NIST?
prowler-compliance enables syncing frameworks with upstream sources (CIS, NIST, CSA CCM, PCI-DSS). Define your framework requirements to align with upstream control IDs and descriptions. The skill supports validation to ensure mappings stay current and accurate. When upstream catalogs update, audit your check-to-requirement mappings to maintain compliance. Use the framework structure to track which upstream source each requirement comes from.
How do I fix compliance JSON bugs and validate framework structure?
prowler-compliance includes JSON schema validation and bug-fixing tools. Common issues include duplicate IDs, malformed requirement definitions, and invalid check mappings. Validate your framework against the universal or legacy schema to catch structural errors. Use the compliance output formatter to test how your framework renders in the UI. Fix bugs by correcting JSON syntax, ensuring unique IDs, and verifying all check references exist in your provider's check catalog.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: prowler-compliance description: > Creates, syncs, audits and manages Prowler compliance frameworks end-to-end. Covers the two supported JSON schemas (universal multi-provider and legacy per-provider), the SDK model tree (legacy attribute classes, universal ComplianceFramework, ConfigRequirements guardrails), output formatters (legacy per-framework + universal data-driven), API/UI consumption, upstream sync workflows, and cloud-auditor check-mapping reviews. Trigger: When working with compliance frameworks (CIS, CIS Controls, NIST, PCI-DSS, SOC2, GDPR, ISO27001, ENS, MITRE ATT&CK, CCC, C5, CSA CCM, DORA, KISA ISMS-P, ASD Essential Eight, DISA STIG, CISA SCuBA, SecNumCloud, FedRAMP, HIPAA, NIS2, Prowler ThreatScore), creating a universal multi-provider framework, adding ConfigRequirements guardrails, syncing with upstream catalogs, auditing check-to-requirement mappings, adding output formatters, or fixing compliance JSON bugs (duplicate IDs, empty Version, wrong Section, stale check refs). license: Apache-2.0 metadata: author: prowler-cloud version: "2.0" scope: [root, sdk] auto_invoke: - "Creating/updating compliance frameworks"
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 15 files
skills/prowler-compliance/SKILL.md
skills/prowler-compliance/assets/audit_framework_template.py
skills/prowler-compliance/assets/build_inventory.py
skills/prowler-compliance/assets/cis_framework.json
skills/prowler-compliance/assets/configs/ccc.yaml
skills/prowler-compliance/assets/dump_section.py
skills/prowler-compliance/assets/ens_framework.json
skills/prowler-compliance/assets/generic_framework.json
skills/prowler-compliance/assets/iso27001_framework.json
skills/prowler-compliance/assets/mitre_attack_framework.json
skills/prowler-compliance/assets/parsers/__init__.py
skills/prowler-compliance/assets/parsers/finos_ccc.py
skills/prowler-compliance/assets/prowler_threatscore_framework.json
skills/prowler-compliance/assets/query_checks.py
skills/prowler-compliance/assets/sync_framework.py