{
  "id": 3621574,
  "title": "I audited Prowler's 48 IAM checks against a linter I built, and found a real gap",
  "url": "https://urgent.news/2026/08/26/i-audited-prowlers-48-iam-checks-against-a-linter-i-built-and-found-a",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-26T23:52:27.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/bimscreator/i-audited-prowlers-48-iam-checks-against-a-linter-i-built-and-found-a-real-gap-1h0c"
  },
  "original_language": "en",
  "account": "A reporter examined 48 IAM checks by Prowler and discovered a significant discrepancy, as they constructed a Python function to scan AWS IAM policy documents and identify common risks. The reporter built the iam-lint tool, which scans for issues such as wildcard actions, wildcard resources, and unrestricted iam:PassRole. The reporter then compared the 48 checks against the 7 rules in the iam-lint tool. The reporter found a gap between the two tools - MISSING_MFA_CONDITION - that is not covered by Prowler's checks. This distinction is important as it ensures that policies requiring MFA for sensitive actions are properly enforced. The reporter filed a request to add the new check to Prowler's list, following their guidelines and confirming the gap did not already exist in Prowler's checks.",
  "summary": "A few weeks ago I was prepping for a Cloud Security Engineer interview and built a small exercise: a Python function that scans an AWS IAM policy document and flags a few classic risks: wildcard actions, wildcard resources, unrestricted iam:PassRole . It was meant to be throwaway interview prep. It didn't stay throwaway. I kept adding rules, and it turned into iam-lint , a real, tested,…",
  "key_points": [
    "Reporter built iam-lint tool to scan AWS IAM policies for common risks",
    "Gap found between Prowler's 48 checks and iam-lint's 7 rules: MISSINGMFACONDITION"
  ],
  "editors_take": "The discovery of a gap in Prowler's IAM checks, specifically MISSINGMFACONDITION, highlights a previously unaddressed security risk that could leave policies vulnerable to exploitation if not properly enforced.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}