Getting Started With StackIT

Prowler supports StackIT from the CLI. This guide walks you through the requirements and how to run scans.

StackIT support in Prowler is community-maintained. For commercial support or to request additional service coverage, contact us.

Prerequisites

Before running Prowler with the StackIT provider, ensure you have:

1. A StackIT account with at least one project
2. A StackIT service account key file with project permissions for the services to scan. iaas.viewer is sufficient for the currently shipped IaaS checks. For SKE, assign the project-scoped Reader role as a broad read-only convenience, or create a custom role with resource-manager.project.get, ske.cluster.list, ske.cluster.get, and ske.version.list. The resource-manager.project.get permission is optional for scanning; it only lets Prowler verify and display the project name. See the Authentication guide for the full setup.
3. Access to Prowler CLI (see Installation)

Prowler CLI

Step 1: Point Prowler at the Service Account Key

Prowler authenticates with a StackIT service account key. The SDK signs the RSA challenge in the key and refreshes access tokens internally for the life of the scan, so there is no manual token rotation.

On a workstation or persistent agent (key on disk):

export STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.stackit/sa-key.json"
export STACKIT_PROJECT_ID="12345678-1234-1234-1234-123456789abc"

In CI/CD (key in a secret manager, never written to disk):

export STACKIT_SERVICE_ACCOUNT_KEY="$(vault kv get -field=key stackit/sa)"
export STACKIT_PROJECT_ID="12345678-1234-1234-1234-123456789abc"

CLI flags work too:

prowler stackit \
  --stackit-service-account-key-path ~/.stackit/sa-key.json \
  --stackit-project-id 12345678-1234-1234-1234-123456789abc

For the inline key, prefer the STACKIT_SERVICE_ACCOUNT_KEY env var over the matching CLI flag; passing the secret on the command line leaks it through process listings and shell history.

Keep the key file outside of source control and lock it down with chmod 600 ~/.stackit/sa-key.json. Anyone with the JSON can mint access tokens for the service account.

Step 2: Run Your First Scan

prowler stackit

Prowler will discover and audit the project’s IaaS security groups across the available StackIT regions.

Scan specific regions:

prowler stackit --stackit-region eu01 eu02

Run specific security checks:

prowler stackit --checks iaas_security_group_ssh_unrestricted

# List all available checks
prowler stackit --list-checks

Filter by check severity:

prowler stackit --severity critical high

Generate specific output formats:

# JSON only
prowler stackit --output-modes json

# CSV and HTML
prowler stackit --output-modes csv html

# Custom output directory
prowler stackit --output-directory /path/to/reports/

Use a mutelist to suppress findings:

# mutelist.yaml
Mutelist:
  Accounts:
    "12345678-1234-1234-1234-123456789abc":
      Checks:
        iaas_security_group_ssh_unrestricted:
          Regions:
            - "*"
          Resources:
            - "test-sg-id"
          Tags: []

prowler stackit --mutelist-file mutelist.yaml

Step 3: Review the Results

Prowler outputs findings to the console and writes reports to the output/ directory by default:

• CSV: output/prowler-output-stackit-{project_id}-{timestamp}.csv
• JSON: output/prowler-output-stackit-{project_id}-{timestamp}.json
• HTML: output/prowler-output-stackit-{project_id}-{timestamp}.html

Supported StackIT Services

Service	StackIT API	Description	Example Checks
IaaS	iaas	Virtual machines, network interfaces, security groups	iaas_security_group_ssh_unrestricted, iaas_security_group_rdp_unrestricted, iaas_security_group_database_unrestricted, iaas_security_group_all_traffic_unrestricted, iaas_server_public_ip_attached
Object Storage	objectstorage	Buckets, object lock, retention policies, access keys	objectstorage_bucket_object_lock_enabled, objectstorage_bucket_retention_policy, objectstorage_access_key_expiration
Kubernetes Engine	ske	Managed Kubernetes clusters	ske_cluster_no_public_endpoint

Additional services will be added in future releases. Track progress in the Prowler release notes.

Troubleshooting

Authentication Errors

If the scan fails with a 401 error, the service account key is no longer valid (revoked, rotated or the key file is incomplete). Re-issue the key in the StackIT portal and update STACKIT_SERVICE_ACCOUNT_KEY_PATH.

Permission Errors

If the connection probe warns that Resource Manager access could not be verified with a 403 response, Prowler continues to service discovery. Grant the optional resource-manager.project.get permission to verify and display the project name.

If a service call fails with a 403 response, the service account is missing a permission required by that service. iaas.viewer is sufficient for the shipped IaaS checks. The ske_cluster_no_public_endpoint check lists clusters and therefore requires ske.cluster.list; STACKIT least-privilege custom-role examples also include ske.cluster.get and ske.version.list. Service API calls remain authoritative and stop the scan when access is denied.

For detailed setup steps, see the Authentication guide.