/prowler-provider

name: prowler-provider
description: >
  Creates new Prowler providers (built-in or external plug-in) or adds services to existing providers.
  Trigger: When adding a new provider to the Prowler SDK, building an external provider plug-in (prowler.providers entry point), implementing the Provider contract (from_cli_args, get_scan_arguments, get_credentials_schema), or adding a new service to an existing provider.
license: Apache-2.0
metadata:
  author: prowler-cloud
  version: "1.1"
  scope: [root, sdk]
  auto_invoke:
    - "Adding new providers"
    - "Adding services to existing providers"
allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task

When to Use

• Adding a built-in provider under `prowler/providers/`
• Shipping a provider, checks or compliance frameworks as an external package (entry points)
• Adding a service (`{service}_service.py` + `{service}_client.py`) to an existing provider

Choose the provider type first (`docs/developer-guide/provider.mdx`): **SDK** (official Python SDK, e.g. AWS, Azure, GCP, Kubernetes), **API** (direct REST calls, e.g. NHN, MongoDB Atlas), **Hybrid** (e.g. M365, GitHub), or **Tool/Wrapper** (delegates to an external tool: `iac`, `image`, `llm`).

Provider Layout

prowler/providers/{provider}/
├── __init__.py
├── {provider}_provider.py          # class {Provider}Provider(Provider)
├── models.py                       # identity/session models, {Provider}OutputOptions
├── {provider}_regions_by_service.json  # regional providers only
├── exceptions/exceptions.py        # provider-specific exception codes
├── lib/
│   ├── arguments/arguments.py      # init_parser(self), optional validate_arguments(), SENSITIVE_ARGUMENTS
│   ├── mutelist/mutelist.py        # {Provider}Mutelist(Mutelist).is_finding_muted()
│   └── service/service.py          # base service class
└── services/{service}/
    ├── {service}_service.py
    ├── {service}_client.py
    └── {check_name}/               # see prowler-sdk-check

Critical Rules

• **Class name**: `Provider.get_class()` imports `prowler.providers.{name}.{name}_provider` and expects `f"{name.capitalize()}Provider"`: `stackit` -> `StackitProvider`, `alibabacloud` -> `AlibabacloudProvider`, `mongodbatlas` -> `MongodbatlasProvider`. Any other casing fails to load.
• **Abstract members** of `prowler/providers/common/provider.py` `Provider`: properties `type`, `identity`, `session`, `audit_config`; methods `setup_session()`, `print_credentials()`. Also implement `test_connection()` (the API uses it), `fixer_config` and `mutelist` properties.
• `Provider` has no `__init__` contract: the subclass `__init__` takes explicit kwargs (credentials, `config_path`, `config_content`, `fixer_config`, `mutelist_path`, `mutelist_content`, scoping) and **must end with `Provider.set_global_provider(self)`**.
• `sdk_only = True` by default (CLI only). Set `sdk_only = False` only when the API/UI support the provider (`Provider.get_app_providers()`).
• Tool wrappers set `is_external_tool_provider = True` (external) or are listed in `EXTERNAL_TOOL_PROVIDERS` (`prowler/lib/check/external_tool_providers.py`, built-in); they skip check loading and most metadata validation.
• Secret-bearing flags: `nargs="?"`, `default=None`, env var preferred, and listed in the module-level `SENSITIVE_ARGUMENTS` frozenset in `lib/arguments/arguments.py` (collected by `prowler/lib/cli/redact.py` to redact output). Do not add new flags that require passing secrets on the command line.
• Services never raise on API errors: log and keep a distinguishable "not retrieved" state (see `prowler-sdk-check`, permission errors are not findings).
• Resource models can declare `sensitive_fields: ClassVar[tuple[str, ...]] = ("field",)` so `Check_Report` redacts those values in outputs.

Service and Client

# prowler/providers/{provider}/services/{service}/{service}_client.py
from prowler.providers.common.provider import Provider
from prowler.providers.{provider}.services.{service}.{service}_service import {Service}

{service}_client = {Service}(Provider.get_global_provider())

The client is a module-level singleton created on first import; the service fetches everything in `__init__` and checks only read attributes. A service may read another service's client, but never instantiate another provider SDK client for it. Templates: [assets/service.py](assets/service.py), [assets/client.py](assets/client.py).

Built-in Provider: Files to Touch

Verified against `stackit` and `alibabacloud`; grep an existing provider name across `prowler/` and `tests/` to catch anything new.

| File | Change | |------|--------| | `prowler/providers/{provider}/` | Provider package (layout above) | | `prowler/providers/common/provider.py` | `elif arguments.provider == "{provider}":` branch in `init_global_provider` mapping CLI args to the constructor (exact equality, not substring) | | `prowler/lib/cli/parser.py` | Add to `known_providers`, the `usage=` string and the epilog provider list | | `prowler/__main__.py` | Import and build `{Provider}OutputOptions`; compliance output branch if the provider ships frameworks | | `prowler/config/config.py` | `Provider` enum value | | `prowler/config/config.yaml` + `prowler/config/schema/{provider}.py` + `registry.py` | Only if the provider has configurable checks | | `prowler/config/{provider}_mutelist_example.yaml` | Example mutelist | | `prowler/lib/check/models.py` | `CheckReport{Provider}(Check_Report)` dataclass | | `prowler/lib/outputs/finding.py` | Provider branches filling `auth_method`, `account_uid`, `account_name`, `resource_uid`, `region`, ... | | `prowler/lib/outputs/outputs.py` | `stdout_report` detail field | | `prowler/lib/outputs/summary_table.py` | Entity type and audited entities | | `prowler/lib/outputs/html/html.py` | `get_{provider}_assessment_summary()` | | `prowler/compliance/{provider}/__init__.py` | When the provider ships compliance frameworks (`prowler-compliance