1#!/bin/bash
2# Run Prowler CIS AWS Foundations benchmark against your AWS account
3# Requires: AWS credentials with SecurityAudit + ViewOnlyAccess permissions
4# Install: pip install prowler
5 
6# Run full CIS Level 1 check
7prowler aws \
8  --compliance cis_level1_aws \
9  --output-formats html json csv \
10  --output-directory ./security-reports/prowler \
11  --severity critical high
12 
13# Run specific CIS check group (e.g., IAM only)
14prowler aws \
15  --compliance cis_level1_aws \
16  --group iam \
17  --output-formats json
18 
19# Run against multiple accounts (with assume-role)
20for ACCOUNT_ID in 123456789 987654321 456789123; do
21  prowler aws \
22    --role arn:aws:iam::${ACCOUNT_ID}:role/ProwlerAuditRole \
23    --compliance cis_level1_aws \
24    --output-formats json \
25    --output-directory ./security-reports/${ACCOUNT_ID}
26done
27 
28# Schedule in CI (weekly baseline report):
29# 0 0 * * 1 /scripts/run-prowler.sh > /var/log/prowler-$(date +%Y%m%d).log

1# Kyverno policy: enforce container security best practices
2# Applied at admission time — pods violating policy are rejected
3apiVersion: kyverno.io/v1
4kind: ClusterPolicy
5metadata:
6  name: restrict-pod-security
7  annotations:
8    policies.kyverno.io/title: Restrict Pod Security
9    policies.kyverno.io/severity: high
10    policies.kyverno.io/description: >-
11      Enforce security context requirements for all pods.
12      Pods running as root or privileged are rejected.
13spec:
14  validationFailureAction: Enforce  # Reject non-compliant pods (use Audit to dry-run first)
15  background: true
16  rules:
17    - name: restrict-privileged
18      match:
19        any:
20          - resources:
21              kinds: [Pod]
22      validate:
23        message: "Privileged containers are not allowed."
24        pattern:
25          spec:
26            containers:
27              - =(securityContext):
28                  =(privileged): false
29 
30    - name: require-non-root
31      match:
32        any:
33          - resources:
34              kinds: [Pod]
35      validate:
36        message: "Containers must not run as root. Set runAsNonRoot: true."
37        pattern:
38          spec:
39            securityContext:
40              runAsNonRoot: true
41            containers:
42              - =(securityContext):
43                  =(runAsUser): ">0"
44 
45    - name: require-read-only-root
46      match:
47        any:
48          - resources:
49              kinds: [Pod]
50      validate:
51        message: "Root filesystem must be read-only."
52        pattern:
53          spec:
54            containers:
55              - securityContext:
56                  readOnlyRootFilesystem: true