---
id: prowler-cloud/prowler/prowler-provider
version: "46730397"
license: Apache-2.0
install: manual
updated: 2026-07-27
---

# prowler-provider — Prowler-provider guides you through adding new cloud providers or services to the Prowler SDK. It provides the required directory structure, class templates for providers and services, and patterns for handling authentication and CLI arguments securely.

Publisher: prowler-cloud · Stars: 14491 · Updated: 2026-07-27

Install (manual): `git clone https://github.com/prowler-cloud/prowler`

## SKILL.md

## When to Use

Use this skill when:
- Adding a new cloud provider to Prowler
- Adding a new service to an existing provider
- Understanding the provider architecture pattern

## Provider Architecture Pattern

Every provider MUST follow this structure:

```text
prowler/providers/{provider}/
├── __init__.py
├── {provider}_provider.py      # Main provider class
├── models.py                   # Provider-specific models
├── config.py                   # Provider configuration
├── exceptions/                 # Provider-specific exceptions
├── lib/
│   ├── service/               # Base service class
│   ├── arguments/             # CLI arguments parser
│   └── mutelist/              # Mutelist functionality
└── services/
    └── {service}/
        ├── {service}_service.py   # Resource fetcher
        ├── {service}_client.py    # Python singleton instance
        └── {check_name}/          # Individual checks
            ├── {check_name}.py
            └── {check_name}.metadata.json
```

## Sensitive CLI Arguments

Flags that accept secrets (tokens, passwords, API keys) MUST follow these rules:

1. **Use `nargs="?"` with `default=None`** — the flag accepts an optional value for backward compatibility; the recommended path is environment variables.
2. **Set `metavar` to the environment variable name** users should use (e.g., `metavar="GITHUB_PERSONAL_ACCESS_TOKEN"`).
3. **Add the flag to the `SENSITIVE_ARGUMENTS` frozenset** at the top of the provider's `arguments.py`. This set is used to redact values in HTML output and warn users who pass secrets directly.
4. **Do not add new arguments that require passing secrets as CLI values** — secrets should come from environment variables. The flag accepts a value for backward compatibility, but CLI warns users to prefer env vars.

### Pattern

```python
# prowler/providers/{provider}/lib/arguments/arguments.py

SENSITIVE_ARGUMENTS = frozenset({"--my-api-key", "--my-password"})


def init_parser(self):
    auth_subparser = parser.add_argument_group("Authentication Modes")
    auth_subparser.add_argument(
        "--my-api-key",
        nargs="?",
        default=None,
        metavar="MY_API_KEY",
        help="API key for authentication. Use MY_API_KEY env var instead of passing directly.",
    )
```

## Provider Class Template

```python
from prowler.providers.common.provider import Provider

class {Provider}Provider(Provider):
    """Provider class for {Provider} cloud platform."""

    def __init__(self, arguments):
        super().__init__(arguments)
        self.session = self._setup_session(arguments)
        self.regions = self._get_regions()

    def _setup_session(self, arguments):
        """Provider-specific authentication."""
        # Implement credential handling
        pass

    def _get_regions(self):
        """Get available regions for provider."""
        # Return list of regions
        pass
```

## Service Class Template

```python
from prowler.providers.{provider}.lib.service.service import {Provider}Service

class {Service}({Provider}Service):
    """Service class for {service} resources."""

    def __init__(self, provider):
        super().__init__(provider)
        self.{resources} = []
        self._fetch_{resources}()

    def _fetch_{resources}(self):
        """Fetch {resource} data from API."""
        try:
            response = self.client.list_{resources}()
            for item in response:
                self.{resources}.append(
                    {Resource}(
                        id=item["id"],
                        name=item["name"],
                        region=item.get("region"),
                    )
                )
        except Exception as e:
            logger.error(f"Error fetching {resources}: {e}")
```

## Service Client Template

```python
from prowler.providers.{provider}.services.{service}.{service}_service import {Service}

{service}_client = {Service}
```

## Supported Providers

Current providers:
- AWS (Amazon Web Services)
- Azure (Microsoft Azure)
- GCP (Google Cloud Platform)
- Kubernetes
- GitHub
- M365 (Microsoft 365)
- OracleCloud (Oracle Cloud Infrastructure)
- AlibabaCloud
- Cloudflare
- MongoDB Atlas
- NHN (NHN Cloud)
- LLM (Language Model providers)
- IaC (Infrastructure as Code)

## Commands

```bash
# Run provider
uv run python prowler-cli.py {provider}

# List services for provider
uv run python prowler-cli.py {provider} --list-services

# List checks for provider
uv run python prowler-cli.py {provider} --list-checks

# Run specific service
uv run python prowler-cli.py {provider} --services {service}

# Debug mode
uv run python prowler-cli.py {provider} --log-level DEBUG
```

## Resources

- **Templates**: See [assets/](assets/) for Provider, Service, and Client singleton templates
- **Documentation**: See [references/provider-docs.md](references/provider-docs.md) for official Prowler Developer Guide links


[View on SkillFed](https://skillfed.io/prowler-cloud/prowler/prowler-provider) · [View on GitHub](https://github.com/prowler-cloud/prowler)