# Share a Prowler Report — Cloud Findings Without Emailing a Zip

Canonical: https://commareports.com/share-prowler-report
Published: 2026-08-30

> Prowler writes an HTML report per scan into output/. Publish it to Comma so auditors and engineers read the same findings at one URL — private, revisioned, and annotated in place.

# Share a Prowler report

A Prowler scan is a few hundred findings across a handful of accounts. The
default distribution method is a zip file attached to an email, which has two
predictable outcomes: nobody opens it, and a copy of your cloud's weak points
now lives permanently in three inboxes.

## Publish the HTML output

Prowler writes its outputs — CSV, JSON-OCSF, HTML — into `output/`:

```bash
prowler aws --output-formats html csv
ls output/            # prowler-output-<account>-<timestamp>.html
```

Drag that HTML file into [the app](https://commareports.com/), or publish it
from the same job:

```bash
REPORT_HTML=$(ls -t output/*.html | head -1)

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html "$REPORT_HTML" \
        --arg title "Prowler — prod — $(date +%F)" '{title: $title, html: $html}')"
```

Prowler exits non-zero when it finds failures, so tolerate that exit code on
the scan step or publish with `if: always()`.

## Treat it as sensitive, because it is

A cloud posture report is an inventory of your soft targets: account ids,
ARNs, public buckets, permissive security groups, unrotated keys. Every report
is **private by default**. From there, in the [sharing model](/docs/sharing):

- **Team** — everyone in your workspace.
- **Domain-gated** — anyone with an email at your company, no account
  provisioning.
- **Named reviewers** — the four people on the remediation thread.
- **[Password-protected](/password-protect-html-report)** — for the external
  auditor who does not have and should not get a login.

Which is a strictly better story than a zip file, because access is revocable
and the copy does not multiply.

## Remediation happens in the comments

- **Anchored threads** on the individual finding — "accepted risk, this is the
  CDN origin bucket, SEC-208" — see [commenting on HTML](/comment-on-html).
- **Revisions** — one report id per account, one revision per scan, so a
  regression is visible rather than rediscovered.
- **Resolved threads** carry the decision forward, which is exactly what the
  next audit asks you to produce.

## Keep it current

Posture drifts daily. A [routine](/features/routines) runs the scan on a
schedule and PATCHes the same report — see
[monthly compliance digest](/features/routines/monthly-compliance-digest).

## Limits

- **Entry HTML: 5 MB.** A multi-account scan with thousands of findings can
  exceed it — scan per account and publish one report each, which is the
  right granularity for remediation anyway.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a security report →](https://commareports.com/)**

### Related

- [Share a ScoutSuite report](/share-scoutsuite-report) · [Share a security scan report](/share-security-scan-report)
- [Share a Checkov report](/share-checkov-report) · [Share a Trivy report](/share-trivy-report)
- [Password-protect a report](/password-protect-html-report) · [Monthly compliance digest](/features/routines/monthly-compliance-digest)