Run a CIS AWS Foundations Benchmark Scan With Prowler

Prowler maps its AWS checks to every CIS Amazon Web Services Foundations Benchmark version from 1.4 to 7.0. One command scans an account against the version you pick and writes a requirement-by-requirement CSV you can hand to an auditor. This guide uses the framework IDs shipped in upstream Prowler 5.45.0, the latest release in October 2026.

Quick answer

Sources: cis_7.0_aws.json and prowler/__main__.py at tag 5.45.0, checked October 2026.

Use cis_7.0_aws unless an auditor asked for a specific older version. Guides written in 2023 to 2025 tell you to run cis_2.0_aws or cis_3.0_aws; those IDs still work, but they score you against benchmarks CIS has since replaced.

Which CIS AWS framework IDs Prowler has

At tag 5.45.0 the prowler/compliance/aws/ folder holds eight CIS AWS Foundations files:

• cis_1.4_aws, cis_1.5_aws
• cis_2.0_aws, cis_3.0_aws
• cis_4.0_aws, cis_5.0_aws, cis_6.0_aws
• cis_7.0_aws, added in Prowler 5.32.0 (changelog)

The ID format is framework_version_provider. cisa_aws sits in the same folder but is the CISA framework, not a CIS Benchmark. To print the list from your own install:

prowler aws --list-compliance | grep cis_

CIS announced AWS Foundations v7.0.0 in its April 2026 benchmark update. The CIS AWS benchmark page now lists v7.1.0 as the current Foundations version (checked October 2026), and Prowler 5.45.0 has no 7.1 mapping yet. Until it does, 7.0 is the newest version you can run.

Run the scan from the CLI

1. Install Prowler in a virtual environment: pip install prowler.
2. Give it read-only AWS credentials. The recommended set is the SecurityAudit and ViewOnlyAccess managed policies plus Prowler's additions policy; see the Prowler IAM role guide.
3. List the requirements and the checks behind each one, so you know what the report will contain.
4. Run the scan scoped to the framework.
5. Open the compliance CSV.

python3 -m venv .venv && . .venv/bin/activate
pip install prowler

# what CIS 7.0 checks, requirement by requirement
prowler aws --list-compliance-requirements cis_7.0_aws

# scan with the default credential chain or a named profile
prowler aws --profile audit --compliance cis_7.0_aws -o ./cis-report

To scan through a role in another account, add -R and the external ID:

prowler aws -R arn:aws:iam::111122223333:role/ProwlerScan -I my-external-id --compliance cis_7.0_aws -o ./cis-report

--compliance limits the run to checks that the framework uses, so it is faster than a full scan. Prowler exits with code 3 when any check fails; add -z if that breaks a CI job.

Read the compliance CSV

Prowler writes the usual CSV, JSON-OCSF and HTML outputs plus one file per framework under compliance/. The CSV is semicolon-delimited and has one row per requirement and resource. The columns that matter:

• REQUIREMENTS_ID and REQUIREMENTS_DESCRIPTION: the CIS control number and title.
• REQUIREMENTS_ATTRIBUTES_PROFILE: Level 1 or Level 2.
• REQUIREMENTS_ATTRIBUTES_ASSESSMENTSTATUS: whether CIS calls the control Automated or Manual.
• STATUS: PASS, FAIL or MANUAL for that row.
• RESOURCEID, REGION and CHECKID: what was evaluated and by which Prowler check.

A quick count of failing requirements:

python3 - <<'EOF'
import csv, glob
f = glob.glob("cis-report/compliance/*_cis_7.0_aws.csv")[0]
rows = list(csv.DictReader(open(f), delimiter=";"))
fails = sorted({r["REQUIREMENTS_ID"] for r in rows if r["STATUS"] == "FAIL"})
print(len(fails), "failing requirements:", ", ".join(fails))
EOF

Column names come from the CIS output model; Prowler writes them in upper case.

Run it from the web app

In the Prowler web app every scan is evaluated against all frameworks, so there is nothing to select up front. Open Compliance, pick the scan, and open the CIS AWS card for the version you need. The detail page shows Pass, Fail and Manual counts, the sections with the most failures and a requirement accordion with the checks and resources behind each control. CSV download works for every framework, and the app can also generate a PDF report for the latest CIS version of each provider (API changelog). The flow is described in the Prowler compliance docs.

Kevra Security customers use this path: the same open-source web app, run and upgraded by us, with daily and on-demand scans.

What MANUAL means

A requirement shows MANUAL in two cases:

• The requirement has no check mapped at all. In cis_7.0_aws those are 2.1.2 (authorization guardrails for Organization accounts), 2.1.3 (management account not used for workloads), 2.1.4 (OU structure) and 6.8 (VPC endpoints for AWS services). Prowler adds a placeholder row with status MANUAL.
• The mapped check cannot be decided from the API. account_maintain_current_contact_details (2.2) is one: it always returns MANUAL and tells you where to look in the console.

MANUAL is not a pass. An auditor will want evidence for these, usually a screenshot or a short written procedure. Count them before you report a score.

Common gaps

Region scope

Prowler scans every enabled region by default. If you pass -f us-east-1 to save time, controls that must hold in every region (CloudTrail, AWS Config, VPC flow logs, EBS default encryption) are only evaluated where you looked. Run the CIS scan without a region filter, or use --excluded-region only for regions an SCP blocks.

Root account checks

Root controls (2.4 to 2.7 in CIS 7.0) read the IAM credential report. The hardware MFA check runs only in the commercial aws partition, and it reports nothing when the root user has no password or keys, which is what you get with centralized root access in AWS Organizations (2.1.1). An empty result there is expected.

Organizations controls

Section 2.1 is new in 7.0 and is about AWS Organizations. Its checks need Organizations read access, so scan the management or delegated administrator account to get real results. From a member account those checks do not have the Organizations data they need.

Muted findings

Findings you muted with a mutelist still appear in the CSV with MUTED set to True. If you filter them out of an audit export, do it on purpose.

Related: least-privilege IAM role for Prowler, scanning every account in an AWS Organization, sending Prowler findings to AWS Security Hub, hosted Prowler.

FAQ

Which CIS AWS benchmark version does Prowler support?

Upstream Prowler 5.45.0 ships CIS AWS Foundations 1.4, 1.5, 2.0, 3.0, 4.0, 5.0, 6.0 and 7.0 as cis_1.4_aws through cis_7.0_aws. CIS lists 7.1.0 as current, which Prowler does not map yet (checked October 2026).

How do I run a Prowler CIS scan?

Run prowler aws --compliance cis_7.0_aws with read-only AWS credentials. The requirement-level CSV is written to output/compliance/.

Why does my Prowler CIS report show MANUAL?

MANUAL means Prowler cannot decide the control from the AWS API, either because no check is mapped or because the check needs a human to look. You need to collect evidence for those yourself.

Does Prowler produce a CIS PDF report?

The Prowler web app and API can generate a CIS Benchmark PDF for the latest CIS version of a provider, and every framework downloads as CSV. The CLI writes compliance results as CSV.

Is cis_2.0_aws still a valid Prowler compliance ID?

Yes. Prowler keeps old versions, so cis_2.0_aws still runs, but it scores you against a benchmark CIS has replaced. Run prowler aws --list-compliance to see every ID your install has and pick the newest one your auditor accepts.

Does Kevra Security include CIS AWS reports?

Yes. Kevra Security runs the open-source Prowler web app with all its compliance frameworks, including every CIS AWS version, with daily and on-demand scans. See Kevra Security.

Prowler is a trademark of its owners. Kevra is not affiliated with, endorsed by or sponsored by Prowler. Kevra Security runs the open-source Prowler project (Apache-2.0) as a managed service.