DEV Community

Bala Paranj
Bala Paranj

Posted on

Prowler has HIPAA checks. What checklist-based compliance still misses.

#hipaa #aws #security #compliance

✓ Human-authored analysis; AI used for formatting and proofreading.

The 2018 conversation

In Prowler issue #227, a user asked: "any plan to add [HIPAA checks]?"

A contributor laid out a checklist consisting of MFA, VPC flow logs, encrypted EBS volumes, S3 bucket policies, encrypted RDS. The maintainer's response:

"Adding HIPAA checks is no small task and I don't believe checks for full compliance will be possible as it depends much upon how each user/application handles PHI."

They shipped the checks and have continued expanding them. Prowler's release v5.22.0, March 2026 includes HIPAA compliance frameworks for AWS and Azure, listed as a supported framework in the README. The issue was closed in 2018, and HIPAA has been part of Prowler for years.

MFA enabled? Check. Encrypted volumes? Check. Access logs? Check. These are useful checks. They're the same class of checks AWS Config provides. They're necessary but not sufficient.

What the checklist misses

The Prowler HIPAA checks (and AWS Config Conformance Pack, and Security Hub) all share the same architecture: individual rules evaluated independently against individual resources. This creates three blind spots that no checklist can fill.

1. No compound risk

Prowler checks if a bucket is public. Prowler checks if a policy has wildcard actions. But it can't detect that the combination is the S3+IAM lateral movement pattern behind most documented AWS breaches.

Stave detects compound patterns across services:

[high] ec2_to_s3_lateral
Overbroad EC2 instance profile + unrestricted egress = S3 data exfiltration.
(CTL.EC2.PROFILE.OVERBROAD.001 + CTL.VPC.SG.EGRESS.001)
Enter fullscreen mode Exit fullscreen mode 
[critical] public_phi_exposure
Public S3 bucket + no encryption enforcement = PHI exposure.
(CTL.S3.PUBLIC.005 + CTL.S3.ENCRYPT.KMS.OWNERSHIP.001)
Enter fullscreen mode Exit fullscreen mode 
[high] vpc_endpoint_bypass
VPC endpoint with default policy = any principal on the VPC reaches any S3 bucket.
(CTL.VPC.ENDPOINT.GATEWAY.DEFAULTPOLICY.001)
Enter fullscreen mode Exit fullscreen mode

No individual check catches these. They require cross-rule reasoning.

2. No duration tracking

Prowler tells you a resource is non-compliant right now. It doesn't tell you it's been non-compliant for 6 months.

Finding: phi-patient-records
  First unsafe: 2025-06-01T00:00:00Z
  Last seen:    2026-01-11T00:00:00Z
  Duration:     5,400+ hours (threshold: 168 hours)
Enter fullscreen mode Exit fullscreen mode

For HIPAA, this distinction matters. A bucket that was briefly public during a deploy and caught within the SLA is different from one that's been exposed for 7 months. Duration is the missing dimension in every cloud security checklist.

3. No PHI-specific depth

The Prowler contributor's checklist is service-level: encrypted volumes, access logs, VPC flow logs. These are correct for general AWS hardening. But HIPAA S3 requires deeper analysis:

PHI-Specific Check Prowler Stave
CMK vs AWS-managed key No — checks "is KMS enabled?" Yes — CTL.S3.ENCRYPT.KMS.OWNERSHIP.001 fails on alias/aws/s3
Object Lock compliance mode No Yes — CTL.S3.LOCK.001–003 tiers: none=critical, governance=high, compliance=pass
Presigned URL restrictions No Yes — CTL.S3.PRESIGNED.001 checks s3:signatureAge/s3:authType conditions
VPC endpoint without policy No Yes — CTL.VPC.ENDPOINT.GATEWAY.DEFAULTPOLICY.001 detects the wormhole
ACL escalation (WRITE_ACP) No Yes — CTL.S3.ACL.ESCALATION.001 detects privilege escalation path
Latent exposure behind PAB No Yes — CTL.S3.PUBLIC.005 detects public policy masked by PAB toggle
HIPAA section citations No Yes — every finding cites §164.312

The Prowler maintainer was right: full HIPAA compliance depends on how each user handles PHI. But that's an argument for a tool that evaluates the actual PHI storage configuration, not just generic service settings.

What the user in #227 needed

The user asking for HIPAA checks in 2018 needed:

  1. A HIPAA profile — a curated set of controls mapped to Security Rule sections, not a generic checklist
  2. Compound risk detection — dangerous combinations, not just individual failures
  3. Duration tracking — how long has this been non-compliant?
  4. PHI-specific controls — CMK enforcement, Object Lock compliance mode, presigned URL restrictions
  5. Acknowledged exceptions — documented risk acceptance with compensating controls
  6. Offline evaluation — auditor-ready evidence, not dashboard access

Prowler shipped item 1 (a checklist with HIPAA framework tags). Items 2-6 remain unaddressed.

How Stave fills the gap 

stave apply --observations phi-observations/ --format text
Enter fullscreen mode Exit fullscreen mode 
═══ HIPAA Security Rule ═══
Bucket:    phi-patient-records
Result:    FAIL

── COMPOUND RISKS ──

  [critical] public_phi_exposure (triggers: CTL.S3.PUBLIC.005, CTL.S3.ENCRYPT.KMS.OWNERSHIP.001)
  Public bucket with no CMK encryption = PHI exposure

── critical ──

  [FAIL] CTL.S3.ACCESS.001 — critical
  Compliance: §164.312(a)(1) — Access control

  [FAIL] CTL.S3.ENCRYPT.KMS.OWNERSHIP.001 — critical
  Compliance: §164.312(a)(2)(iv) — CMK required for key revocation

── Summary ──

  critical: 0/4 passed
  high:     2/8 passed
  medium:   0/2 passed
Enter fullscreen mode Exit fullscreen mode

3,500+ controls + 770+ chain detectors. Every finding cites the HIPAA section. Duration tracked. Exceptions require compensating controls. Runs offline.

The answer to #227

The Prowler maintainer said full HIPAA compliance checks aren't possible because it depends on how each user handles PHI. It's true that no tool can verify organizational policies, BAAs, or workforce training.

But technical controls on PHI storage infrastructure are verifiable. A bucket either has CMK encryption or it doesn't. Object Lock is either in compliance mode or it isn't. The VPC endpoint either has a restrictive policy or it doesn't.

Stave evaluates what's verifiable and says so explicitly:

"Stave evaluates technical controls only. A BAA with AWS is a contractual prerequisite for HIPAA compliance that Stave cannot verify."

That disclaimer present in every HIPAA report is the honest boundary. Everything inside that boundary, Stave proves. Everything outside it, Stave acknowledges it can't.

That's the answer issue #227 needed in 2018.

Coverage: the full Prowler HIPAA checklist

Against the Prowler HIPAA checklist, every item is covered plus depth beyond the checklist:

Prowler Check Stave Controls Depth beyond the checklist
Account: MFA Enabled CTL.IAM.ROOT.MFA.001, CTL.IAM.CONSOLE.MFA.001 Root vs console distinguished
Account: Root Credentials CTL.IAM.ROOT.ACCESSKEY.001 Duration tracking on exposure
S3: Encryption + IP Filter CTL.S3.ENCRYPT.001–004, CTL.S3.NETWORK.001, CTL.S3.NETWORK.VPC.001 CMK vs AWS-managed key; key policy audit
S3: IAM Permissions CTL.S3.ACCESS.001–003, CTL.IAM.POLICY.* ACL escalation, presigned URL restrictions
S3: Access Logs CTL.S3.LOG.001, CTL.S3.AUDIT.OBJECTLEVEL.001 Log bucket integrity, retention, prefix
VPC: Flow Logging CTL.VPC.FLOWLOG.001, CTL.VPC.FLOWLOG.STATUS.001, CTL.VPC.FLOWLOG.FORMAT.001 Bidirectional check, NAT/TGW flow logs
VPC: Flow Logs Encrypted CTL.VPC.FLOWLOG.ENCRYPT.001 Ghost S3 destination detection
VPC: ELB Logging CTL.ELB.LOG.001, CTL.ELB.NLB.ACCESSLOG.001, CTL.ELB.NLB.CONNLOG.001 Permission audit, ghost bucket, lifecycle
EC2: Encrypted EBS Volumes CTL.EC2.EBS.ENCRYPT.001, CTL.EC2.EBS.ENCRYPT.CMK.001 KMS policy audit, SCP enforcement
EC2: Encrypted EBS Snapshots CTL.EC2.EBS.SNAPSHOT.ENCRYPT.001, CTL.EBS.ENCRYPT.KEYORIGIN.001 Shared unencrypted snapshot detection
RDS: Encrypted RDS CTL.RDS.ENCRYPT.001, CTL.RDS.ENCRYPT.CMK.001, CTL.RDS.SNAPSHOT.ENCRYPT.001 Backup encryption, cross-region, SSL enforcement

What Stave does that no checklist can

Beyond checklist parity, Stave provides capabilities the Prowler architecture has no equivalent for:

  • Compound risk detection across services (770+ chain detectors)
  • Duration tracking on every finding (SLA-based)
  • CMK vs AWS-managed key distinction for PHI encryption
  • Object Lock compliance mode tiering for PHI retention
  • Presigned URL restrictions for PHI buckets
  • Latent exposure detection (public policy behind PAB)
  • ACL escalation detection (WRITE_ACP privilege escalation)
  • Acknowledged exceptions with mandatory compensating controls
  • HIPAA §164.312 citations on every finding
  • Proof of pass via logic trace

The checklist covers breadth. Stave covers depth and cross-service reasoning.

Top comments (0)