feat(compliance): add DORA framework for AWS

[pedrooot]

Description

This PR adds the DORA compliance framework for the AWS provider.

Steps to review

Please add a detailed description of how to review this PR.

Checklist

Community Checklist

• This feature/issue is listed in here or roadmap.prowler.com
• Is it assigned to me, if not, request it via the issue/feature in here or Prowler Community Slack

• Review if the code is being covered by tests.
• Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
• Review if backport is needed.
• Review if is needed to change the Readme.md
• Ensure new entries are added to CHANGELOG.md, if applicable.

SDK/CLI

• Are there new checks included in this PR? Yes / No
  • If so, do we need to update permissions for the provider? Please review this carefully.

UI

• All issue/task requirements work as expected on the UI
• Screenshots/Video of the functionality flow (if applicable) - Mobile (X < 640px)
• Screenshots/Video of the functionality flow (if applicable) - Table (640px > X < 1024px)
• Screenshots/Video of the functionality flow (if applicable) - Desktop (X > 1024px)
• Ensure new entries are added to CHANGELOG.md, if applicable.

API

• All issue/task requirements work as expected on the API
• Endpoint response output (if applicable)
• EXPLAIN ANALYZE output for new/modified queries or indexes (if applicable)
• Performance test results (if applicable)
• Any other relevant evidence of the implementation (if applicable)
• Verify if API specs need to be regenerated.
• Check if version updates are required (e.g., specs, Poetry, etc.).
• Ensure new entries are added to CHANGELOG.md, if applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[github-actions]

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
prowler	🟢 Ready	View Preview	May 12, 2026, 12:51 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[github-actions]

✅ All necessary CHANGELOG.md files have been updated.

[github-actions]

🔒 Container Security Scan

Image: prowler:2ac8c47
Last scan: 2026-05-15 11:01:14 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	6
Total	6

5 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

• Review the detailed scan results
• Update affected packages to patched versions
• Consider using a different base image if updates are unavailable

---

📋 Resources:

• Download full report (see artifacts)
• View in Security tab
• Scanned with Trivy

[github-actions]

🔒 osv-scanner: 4 finding(s) in api/uv.lock

Severity gate: HIGH,CRITICAL,UNKNOWN

Severity	ID	Package	Version	Summary
🟠 HIGH (7.5)	GHSA-vfmq-68hx-4jfw	PyPI/lxml	5.3.2	lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files
🟠 HIGH (7)	GHSA-7j59-v9qr-6fq9	PyPI/microsoft-kiota-http	1.9.2	Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
🟠 HIGH (8.9)	GHSA-mf9v-mfxr-j63j	PyPI/urllib3	2.6.3	urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
🟠 HIGH (8.2)	GHSA-qccp-gfcp-xxvc	PyPI/urllib3	2.6.3	urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

To accept a finding, add an [[IgnoredVulns]] entry to osv-scanner.toml at the repo root with a reason and ignoreUntil.

_{View run}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.75%. Comparing base (3410fc9) to head (4a364df).
⚠️ Report is 5 commits behind head on master.

❗ There is a different number of reports uploaded between BASE (3410fc9) and HEAD (4a364df). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (3410fc9)	HEAD (4a364df)
api	1	0

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #11131       +/-   ##
===========================================
- Coverage   93.65%   70.75%   -22.91%     
===========================================
  Files         232      110      -122     
  Lines       33968     8048    -25920     
===========================================
- Hits        31813     5694    -26119     
- Misses       2155     2354      +199     

Flag	Coverage Δ
api	?
prowler-py3.10-lib	70.75% <100.00%> (?)
prowler-py3.11-lib	70.75% <100.00%> (?)
prowler-py3.12-lib	70.75% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
prowler	70.75% <100.00%> (∅)
api	∅ <ø> (∅)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🔒 Container Security Scan

Image: prowler-ui:2ac8c47
Last scan: 2026-05-15 11:01:22 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	2
Total	2

2 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

• Review the detailed scan results
• Update affected packages to patched versions
• Consider using a different base image if updates are unavailable

---

📋 Resources:

• Download full report (see artifacts)
• View in Security tab
• Scanned with Trivy

[github-actions]

🔒 Container Security Scan

Image: prowler-api:2ac8c47
Last scan: 2026-05-15 11:02:51 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	15
Total	15

9 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

• Review the detailed scan results
• Update affected packages to patched versions
• Consider using a different base image if updates are unavailable

---

📋 Resources:

• Download full report (see artifacts)
• View in Security tab
• Scanned with Trivy