Downloading of reports broken

[vjancich]

Issue search

• I have searched the existing issues and this bug has not been reported yet

Which component is affected?

Prowler API

Cloud Provider (if applicable)

AWS

Steps to Reproduce

Hello,

we are running Prowler as an AWS ECS Fargate services (separate ECS service for UI and API with worker). Scanning works fine including attack path creation. Once scan is completed and attack path is created, results are stored in S3 bucket.
However, when we want to see report or download zip, it doesn't work. Message in UI is shows: "Download failed. The scan has no reports, or the report generation task has not started yet."
In the logs for API container is following error:

2026-03-09 08:09:24.128warn{
  "timestamp": "2026-03-09 07:09:23",
  "level": "WARNING",
  "message": "Not Found: /api/v1/scans/019cc835-8800-74d8-bd75-65dd68430577/report",
  "logger": "django.request",
  "module": "log",
  "pathname": "/home/prowler/.cache/pypoetry/virtualenvs/prowler-api-NnJNioq7-py3.12/lib/python3.12/site-packages/django/utils/log.py",
  "lineno": 253,
  "funcName": "log_response",
  "process": 117,
  "thread": 140233479752576,
  "transaction_id": "0b409cc6b56e48a0a67e267426c2c9b6",
  "status_code": 404
}

Prowler shows this error for new scans and also for older scans (few days old). I can see the scan is in PostgreSQL DB.

Expected behavior

It's possible to download scan report

Actual Result with Screenshots or Logs

Error in UI

Warning log in API

2026-03-09 10:30:41.476warn{
  "timestamp": "2026-03-09 09:30:40",
  "level": "WARNING",
  "message": "Not Found: /api/v1/scans/019cd1c1-5ac3-72c6-b616-bfd561e5178d/report",
  "logger": "django.request",
  "module": "log",
  "pathname": "/home/prowler/.cache/pypoetry/virtualenvs/prowler-api-NnJNioq7-py3.12/lib/python3.12/site-packages/django/utils/log.py",
  "lineno": 253,
  "funcName": "log_response",
  "process": 121,
  "thread": 140324112481152,
  "transaction_id": "31b69cc35d20487f97a7f9a1a914ef36",
  "status_code": 404
}

How did you install Prowler?

Cloning the repository from github.com (git clone)

Environment Resource

Running as ECS Fargate services

OS used

not applicable (AWS provided)

Prowler version

v5.19.0

Python version

provided by Prowler

Pip version

provided by Prowler

Context

No response

[HugoPBrito]

Hi @vjancich,

We'll review this as soon as possible, thanks for reporting it.

[HugoPBrito]

Hi @vjancich,

Thanks for the report. Based on the symptoms, this looks more likely to be a deployment/configuration mismatch between your worker and api services:

• Your scans complete successfully.
• The artifacts appear to be uploaded to S3.
• The failure happens only when the API tries to download /api/v1/scans/<id>/report.
• The API returns 404 Not Found, which usually means it is looking for the wrong S3 object/key, not that report generation failed.

In ECS/Fargate with separate services, the most likely cause is that the worker uploads reports using one S3 bucket/config, while the api tries to read them using a different one.

Could you please verify these points in both the api and worker task definitions?

1. DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET
   • It must be exactly the same in both services.
2. AWS region/config
   • Check that DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION is the same in both services.
3. IAM permissions
   • The api task role must have permission to s3:GetObject on the report bucket.
   • The worker task role must have permission to s3:PutObject.
4. Stored scan output location
   • Please inspect the output_location value for one failing scan in PostgreSQL.
   • We want to confirm it looks like:
     s3://<your-bucket>/<tenant-id>/<scan-id>/<report>.zip
5. Bucket alignment
   • Confirm that the bucket in scan.output_location is the same bucket configured in the API service through DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET.

A quick test would be:

• Pick one failing scan
• Copy its output_location
• Check directly in S3 whether that exact object exists
• Then compare that bucket/path with the bucket configured in the API container

If the object exists in S3 but the API still returns 404, that would strongly indicate a config mismatch in the API service.

Once you confirm those points, we can tell whether this is a deployment issue on your side or whether there is a code path we should harden.

[vjancich]

Hello @HugoPBrito ,

thank you for getting back to me. I followed your suggestions and everything seems fine except output_location value in PostgreSQL. It's null in all cases which probably explains the behaviour.
Do you have any idea why it has no value?

We have properly set env vars DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION and DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET

Just little correction, API and worker are running on the same ECS Task so both are getting same env vars. Only UI is separate ECS task.

Thank you