scan

name	scan
description	Run a Prowler compliance scan against your AWS account (SOC2 + HIPAA)
user_invocable	true
argument_description	Optional: --service s3,iam | --check check_id | --profile name | --region us-east-1 | --severity critical,high | --full | or just a service name like 's3'

/scan

Run a compliance scan using Prowler against your AWS account.

Instructions

Use the Agent tool to spawn the scanner agent:

• subagent_type: scanner
• Pass $ARGUMENTS to the agent prompt so it knows what flags to use

Example agent prompt:

Run a Prowler compliance scan with these arguments: $ARGUMENTS

If no arguments provided, run a smart scan: discover active services and regions first, then scan only those, filtering noise.
If --full is passed, run a full SOC2 + HIPAA scan across all regions.

Default Behavior (Smart Scan)

When no flags are provided, the scanner will:

1. Discover active services — run AWS discovery commands to find which services have user-created resources
2. Discover active regions — check where resources actually exist
3. Scan only what matters — use --service and --region with only the discovered values
4. Filter noise — remove findings for inactive services, multi-region duplicates in empty regions, and CIS-only CloudWatch checks

This typically reduces findings from 200-300 to 50-80 real compliance gaps.

Usage Examples

/scan                          # Smart scan: auto-detect services + regions, filter noise
/scan --full                   # Full scan: all regions, all services, no filtering
/scan s3                       # Scan S3 service only
/scan --service s3,iam         # Scan S3 and IAM
/scan --check iam_root_mfa_enabled  # Single check
/scan --severity critical,high # Only critical and high
/scan --profile production     # Use specific AWS profile
/scan --region us-east-1       # Limit to one region (overrides auto-detection)

Flags

Flag	Description
--full	Skip service/region auto-detection, scan everything (all regions, all services)
--service s3,iam	Override service auto-detection, scan only these services
--region us-east-1	Override region auto-detection, scan only this region
--check check_id	Run specific Prowler check(s)
--profile name	Use a specific AWS profile
--severity critical,high	Filter by severity level

Output

The scanner will:

1. Run Prowler and save raw OCSF output to .compliance/scans/
2. Create individual finding files in .compliance/findings/
3. Print a summary of results by severity
4. Report how many noise findings were filtered out