How do I share a Prowler HTML report?

Prowler writes its outputs into `output/` — including an HTML file named for the provider, account and timestamp. Drag that file into Comma, or PATCH it to the API from the job that runs the scan. You get one URL instead of a zip attachment.

Is it safe to share a Prowler report?

Only deliberately. It enumerates account ids, resource ARNs, misconfigured buckets and open security groups — a map of where to attack you. Reports are private by default; scope it to your team, your email domain, named reviewers, or put a password on the link before it goes to an external auditor.

Can I keep one URL per AWS account?

Yes. PATCH the same report id on every scan. The URL stays stable and each scan appends a revision, so 'is this finding new?' is answerable from the report instead of from memory.

How do I automate the scan and the publish?

Any scheduler works; a routine runs it on a cron, PATCHes the same report, and notifies whoever is subscribed — so the compliance link you handed over last quarter never goes stale.

Can reviewers mark a finding as accepted risk?

That is the main reason to publish rather than attach. Anchored threads sit on the finding, so 'accepted, this bucket is the public CDN origin, ticket SEC-208' stays attached to it across scans.

Share a Prowler report

A Prowler scan is a few hundred findings across a handful of accounts. The default distribution method is a zip file attached to an email, which has two predictable outcomes: nobody opens it, and a copy of your cloud's weak points now lives permanently in three inboxes.

Publish the HTML output

Prowler writes its outputs — CSV, JSON-OCSF, HTML — into output/:

prowler aws --output-formats html csv
ls output/            # prowler-output-<account>-<timestamp>.html

Drag that HTML file into the app, or publish it from the same job:

REPORT_HTML=$(ls -t output/*.html | head -1)

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html "$REPORT_HTML" \
        --arg title "Prowler — prod — $(date +%F)" '{title: $title, html: $html}')"

Prowler exits non-zero when it finds failures, so tolerate that exit code on the scan step or publish with if: always().

Treat it as sensitive, because it is

A cloud posture report is an inventory of your soft targets: account ids, ARNs, public buckets, permissive security groups, unrotated keys. Every report is private by default. From there, in the sharing model:

Team — everyone in your workspace.
Domain-gated — anyone with an email at your company, no account provisioning.
Named reviewers — the four people on the remediation thread.
Password-protected — for the external auditor who does not have and should not get a login.

Which is a strictly better story than a zip file, because access is revocable and the copy does not multiply.

Remediation happens in the comments

Anchored threads on the individual finding — "accepted risk, this is the CDN origin bucket, SEC-208" — see commenting on HTML.
Revisions — one report id per account, one revision per scan, so a regression is visible rather than rediscovered.
Resolved threads carry the decision forward, which is exactly what the next audit asks you to produce.

Keep it current

Posture drifts daily. A routine runs the scan on a schedule and PATCHes the same report — see monthly compliance digest.

Limits

Entry HTML: 5 MB. A multi-account scan with thousands of findings can exceed it — scan per account and publish one report each, which is the right granularity for remediation anyway.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a security report →