Skip to main content
Prowler supports StackIT from the CLI. This guide walks you through the requirements and how to run scans.
StackIT support in Prowler is community-maintained. For commercial support or to request additional service coverage, contact us.

​
Prerequisites

Before running Prowler with the StackIT provider, ensure you have:
  1. A StackIT account with at least one project
  2. A StackIT service account key file with permissions on the project (iaas.viewer is enough for the currently shipped IaaS checks; project.owner works for any future service). See the Authentication guide for the full setup.
  3. Access to Prowler CLI (see Installation)

​
Prowler CLI

​
Step 1: Point Prowler at the Service Account Key

Prowler authenticates with a StackIT service account key. The SDK signs the RSA challenge in the key and refreshes access tokens internally for the life of the scan, so there is no manual token rotation. On a workstation or persistent agent (key on disk):
In CI/CD (key in a secret manager, never written to disk):
CLI flags work too:
For the inline key, prefer the STACKIT_SERVICE_ACCOUNT_KEY env var over the matching CLI flag; passing the secret on the command line leaks it through process listings and shell history.Keep the key file outside of source control and lock it down with chmod 600 ~/.stackit/sa-key.json. Anyone with the JSON can mint access tokens for the service account.

​
Step 2: Run Your First Scan

Prowler will discover and audit the project’s IaaS security groups across the available StackIT regions. Scan specific regions:
Run specific security checks:
Filter by check severity:
Generate specific output formats:
Use a mutelist to suppress findings:

​
Step 3: Review the Results

Prowler outputs findings to the console and writes reports to the output/ directory by default:
  • CSV: output/prowler-output-stackit-{project_id}-{timestamp}.csv
  • JSON: output/prowler-output-stackit-{project_id}-{timestamp}.json
  • HTML: output/prowler-output-stackit-{project_id}-{timestamp}.html

​
Supported StackIT Services

Additional services will be added in future releases. Track progress in the Prowler release notes.

​
Troubleshooting

​
Authentication Errors

If the scan fails with a 401 error, the service account key is no longer valid (revoked, rotated or the key file is incomplete). Re-issue the key in the StackIT portal and update STACKIT_SERVICE_ACCOUNT_KEY_PATH.

​
Permission Errors

If checks fail with a 403 error, the service account is missing the required role on the project. Re-check the role assignment in the StackIT portal (iaas.viewer is the minimum for the shipped IaaS checks). For detailed setup steps, see the Authentication guide.