Security posture
What is exposed right now?Catch public buckets
Public access, drift and stale keys in your AWS account, checked once a day and whenever you run a check. A check that did not finish reads as unknown, never as a pass.
Security checks start on Startup, with a 15-day trial. Read-only to connect.
What does it check in my AWS account?
Read-only checks mapped to CIS AWS Foundations controls, in plain words, plus findings from AWS's own scanners where you already pay for them. See what the read role can see.
Public access
Buckets, snapshots, databases and ports open to anyone.
Sign-in and keys
Root MFA, logins without MFA, old access keys.
Encryption and logging
Disk and database encryption, the activity log.
AWS scanners, Prowler
Security Hub, GuardDuty, Inspector, or your Prowler file.
How often are security checks run?
Once a day and whenever you run a check. A check that could not run reads as unknown, never as a pass.
- A check with no verdict is named, not hidden.
- A scanner that is off reads as off, not clean.
- An account not scanned yet says so.
Which findings can it fix?
4 kinds, among them an unused access key and an open port. A person approves each, through a separate fix role you choose to install.
How a security finding becomes an approved fix
Finding
A check fails, named in plain words.
Fix drafted
From the allowlist, with its undo stated.
You approve
Nothing runs until a person approves.
Waiting for youApplied, verified
Live setting rechecked first, then logged.
More on fixes you approve. Findings also feed questionnaire answers from your settings.
Which plan are security checks on?
Posture checks and the architecture map start on Startup, with a 15-day trial. Growth adds server contents, fraud signals, the threat map and fixes.
Every plan connects through the AWS integration.
Every plan, side by side- Security posture checks
- Startup and above
- Architecture map
- Startup and above
- Server contents (what is installed inside servers)
- Growth and above
- Approval-gated fixes
- Growth and above
Questions about security checks
01How often are security checks run?
Once a day, and whenever you run a check yourself. A check that could not run, for a missing permission or a provider error, reads as unknown and is never counted as a pass.
02Does it use AWS's own security scanners?
Where you already have them on: Security Hub, GuardDuty, Inspector, IAM Access Analyzer and Macie. A scanner that is switched off is reported as off, which is a different answer from nothing found.
03Can I send my own Prowler results?
Yes, through the API: upload the file that prowler aws -M json-asff writes. Only a passed record for the same check resolves a finding; a resource missing from the file is not counted as fixed.
04Which findings can it fix?
The ones that cost money or open a door: an unused access key, an unencrypted new disk, a port open to the whole internet. MarshalCloud drafts each one; a person approves, and it runs through a separate fix role you choose to install.
See what the read role can see.
Read-only to connect. Fixes need a second role you choose to add, and each one waits for a person.