If you've never heard of Prowler, you're not alone. I built my own AWS security scanner before I stumbled across it. Read the landing page, had a quiet moment of what is this, and realised it was basically the scan engine I had spent weeks building from scratch.
It's open source, free, covers every major AWS finding category, and maps everything to compliance frameworks out of the box. It is one o