cloud-audit

Find AWS attack chains and get exact fixes.

Open-source CLI scanner that correlates findings into exploitable paths
and generates copy-paste remediation (AWS CLI + Terraform).

Detect exploitable attack paths - Get AWS CLI + Terraform fixes - Run locally, no SaaS required

Documentation - Quick Start - Compliance - CIS - SOC 2 - BSI C5 - ISO 27001 - HIPAA - NIS2 - Attack Chains - MCP Server

Quick Start

pip install cloud-audit
cloud-audit scan

Uses your default AWS credentials and region. Try without an AWS account:

cloud-audit demo

What You Get

+------- Health Score -------+
| 42 / 100                   |   Risk exposure: $725K - $7.3M
+----------------------------+

+---- Attack Chains (3 detected) -----------------------------------+
|  CRITICAL  Internet-Exposed Admin Instance                         |
|            i-0abc123 - public SG + admin IAM role + IMDSv1         |
|            Fix: Restrict security group (effort: LOW)              |
|                                                                    |
|  CRITICAL  CI/CD to Admin Takeover                                 |
|            github-deploy - OIDC no sub + admin policy              |
|            Fix: Add sub condition (effort: LOW)                    |
+--------------------------------------------------------------------+

Findings by severity:  CRITICAL: 3  HIGH: 8  MEDIUM: 12  LOW: 5

88 checks across 21 AWS services. Every finding includes AWS CLI + Terraform remediation.

_{Watch the 1-minute demo}

If cloud-audit helped you find something you missed, consider giving it a star. It helps others discover the project.

Features

Attack Chain Detection

Other scanners give you a flat list of findings. cloud-audit correlates them into attack paths an attacker would actually exploit.

  Internet --> Public SG --> EC2 (IMDSv1) --> Admin IAM Creds --> Account Takeover
               aws-vpc-002   aws-ec2-004       Detected: AC-01, AC-02

Examples from the 25 built-in rules:

Chain	What it catches
Internet-Exposed Admin Instance	Public SG + admin IAM role + IMDSv1 = account takeover
CI/CD to Admin Takeover	OIDC without sub condition + admin policy = pipeline hijack
SSRF to Credential Theft	Public instance + IMDSv1 + no VPC flow logs = invisible exfiltration
Unpatched Instance Exposed to Internet	Open SG + missing patches (SSM) = known CVE exploitation
CloudTrail Blind Spot	CloudTrail not delivering to CloudWatch = all 15 CIS alarms non-functional

Based on MITRE ATT&CK Cloud and Datadog pathfinding.cloud. See all 25 rules in the docs.

Copy-Paste Remediation

Every finding includes AWS CLI commands, Terraform HCL, and documentation links. Export all fixes as a runnable script:

cloud-audit scan --export-fixes fixes.sh

Scan Diff

Compare scans to track drift. Catches ClickOps changes, manual console edits, and regressions that IaC scanning misses.

cloud-audit diff yesterday.json today.json

Exit code 0 = no new findings, 1 = regression. See daily-scan-with-diff.yml for a CI/CD workflow.

6 Compliance Frameworks

Built-in compliance engine with per-control evidence, readiness scoring, and auditor-ready reports.

CIS AWS v3.0 - 62 controls, 55 automated (89%)
SOC 2 Type II - 43 criteria, 24 automated (56%)
BSI C5:2020 - 134 criteria, 57 automated/partial
ISO 27001:2022 - 93 Annex A controls, 47 automated/partial
HIPAA Security Rule - 47 specs, 29 automated/partial
NIS2 Directive - 43 measures, 33 automated/partial

Breach Cost Estimation

Every finding includes a dollar-range risk estimate based on published breach data (IBM Cost of a Data Breach 2024, Verizon DBIR, enforcement actions). Attack chains use compound risk multipliers. Every estimate links to its source.

MCP Server for AI Agents

Ask Claude Code, Cursor, or VS Code Copilot to scan your AWS account:

claude mcp add cloud-audit -- uvx --from cloud-audit cloud-audit-mcp

6 tools: scan_aws, get_findings, get_attack_chains, get_remediation, get_health_score, list_checks. Free and standalone - no SaaS account needed.

How It Compares

Feature	Prowler	Trivy	Checkov	cloud-audit
Checks	576	517	2500+	88
Attack chain detection	No	No	No	25 rules
Remediation per finding	CIS only	No	Links	100% (CLI + Terraform)
Breach cost estimation	No	No	No	Per finding + chain
CIS v3.0 compliance engine	Yes	No	No	62 controls with evidence
SOC 2 Type II compliance	No	No	No	43 criteria with evidence
Total compliance frameworks	CIS only	—	—	6 (CIS, SOC 2, BSI C5, ISO 27001, HIPAA, NIS2)
MCP server (AI agents)	Paid ($99/mo)	No	No	Free, standalone

cloud-audit has fewer checks than Prowler but covers 6 compliance frameworks and deeper output per finding: remediation code, attack chain context, cost estimates, and compliance evidence. If you need exhaustive compliance coverage across multiple clouds, Prowler is the better choice. If you need a focused scan that shows how findings combine into real attack paths and tells you exactly how to fix each one, cloud-audit is built for that.

_{Feature snapshot as of April 2026. Verify against upstream docs for the latest details.}

Reports

cloud-audit scan --format html --output report.html    # Client-ready HTML
cloud-audit scan --format json --output report.json    # Machine-readable
cloud-audit scan --format sarif --output results.sarif # GitHub Code Scanning
cloud-audit scan --format markdown --output report.md  # PR comments

Format is auto-detected from file extension.

Installation

pip install cloud-audit          # pip (recommended)
pipx install cloud-audit         # pipx (isolated)
docker run ghcr.io/gebalamariusz/cloud-audit scan  # Docker

Docker with credentials:

docker run -v ~/.aws:/home/cloudaudit/.aws:ro ghcr.io/gebalamariusz/cloud-audit scan

Usage

cloud-audit scan -R                                    # Show remediation
cloud-audit scan --profile prod --regions eu-central-1  # Specific profile/region
cloud-audit scan --regions all                          # All enabled regions
cloud-audit scan --min-severity high                   # Filter by severity
cloud-audit scan --role-arn arn:aws:iam::...:role/audit # Cross-account
cloud-audit scan --quiet                               # Exit code only (CI/CD)
cloud-audit list-checks                                # List all checks

Exit code	Meaning
0	No findings
1	Findings detected
2	Scan error

Configuration file

Create .cloud-audit.yml in your project root:

provider: aws
regions:
  - eu-central-1
  - eu-west-1
min_severity: medium
exclude_checks:
  - aws-eip-001
suppressions:
  - check_id: aws-vpc-001
    resource_id: vpc-abc123
    reason: "Legacy VPC, migration planned for Q3"
    accepted_by: "jane@example.com"
    expires: "2026-09-30"
  - check_id: "aws-cw-*"
    reason: "CloudWatch alarms managed by separate team"
    accepted_by: "ops@example.com"

Environment variables

Variable	Example
`CLOUD_AUDIT_REGIONS`	`eu-central-1,eu-west-1`
`CLOUD_AUDIT_MIN_SEVERITY`	`high`
`CLOUD_AUDIT_EXCLUDE_CHECKS`	`aws-eip-001,aws-iam-001`
`CLOUD_AUDIT_ROLE_ARN`	`arn:aws:iam::...:role/auditor`

Precedence: CLI flags > env vars > config file > defaults.

CI/CD

- run: pip install cloud-audit
- run: cloud-audit scan --format sarif --output results.sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Ready-to-use workflows: basic scan, daily diff, post-deploy.

AWS Permissions

cloud-audit requires read-only access. Attach SecurityAudit:

aws iam attach-role-policy --role-name auditor --policy-arn arn:aws:iam::aws:policy/SecurityAudit

cloud-audit never modifies your infrastructure.

What It Checks

88 checks across IAM, S3, EC2, VPC, RDS, EIP, EFS, CloudTrail, GuardDuty, KMS, CloudWatch, Lambda, ECS, SSM, Secrets Manager, AWS Config, Security Hub, Account, AWS Backup, Amazon Inspector, and AWS WAF.

Full check list (88 checks)

IAM (17 checks)

ID	Severity	Description
`aws-iam-001`	Critical	Root account without MFA
`aws-iam-002`	High	IAM user with console access but no MFA
`aws-iam-003`	Medium	Access key older than 90 days
`aws-iam-004`	Medium	Access key unused for 45+ days
`aws-iam-005`	Critical	IAM policy with Action:* and Resource:*
`aws-iam-006`	Medium	Password policy below CIS requirements
`aws-iam-007`	Critical	OIDC trust policy without sub condition
`aws-iam-008`	Critical	Root account has active access keys
`aws-iam-009`	Medium	Multiple active access keys per user
`aws-iam-010`	Medium	Direct policy attachment on user (not via group)
`aws-iam-011`	Medium	No AWSSupportAccess role
`aws-iam-012`	Medium	IAM Access Analyzer not enabled
`aws-iam-013`	Medium	Expired SSL/TLS certificate in IAM
`aws-iam-014`	Medium	AWSCloudShellFullAccess attached
`aws-iam-015`	Medium	Root uses virtual MFA (not hardware)
`aws-iam-016`	Medium	EC2 instance without IAM role
`aws-iam-017`	Medium	IAM role max session duration exceeds 1 hour

S3 (7 checks)

ID	Severity	Description
`aws-s3-001`	High	S3 bucket without public access block
`aws-s3-002`	Low	S3 bucket using SSE-S3 instead of SSE-KMS
`aws-s3-003`	Low	S3 bucket without versioning
`aws-s3-004`	Low	S3 bucket without lifecycle rules
`aws-s3-005`	Medium	S3 bucket without access logging
`aws-s3-006`	Medium	S3 bucket policy does not deny HTTP
`aws-s3-007`	Low	S3 bucket without MFA Delete

EC2 (6 checks)

ID	Severity	Description
`aws-ec2-001`	High	Publicly shared AMI
`aws-ec2-002`	Medium	Unencrypted EBS volume
`aws-ec2-003`	Low	Stopped EC2 instance (EBS charges continue)
`aws-ec2-004`	High	EC2 instance with IMDSv1 (SSRF risk)
`aws-ec2-005`	Low	EC2 instance without termination protection
`aws-ec2-006`	Medium	EBS default encryption disabled

VPC (6 checks)

ID	Severity	Description
`aws-vpc-001`	Medium	Default VPC in use
`aws-vpc-002`	Critical	Security group open to 0.0.0.0/0 or ::/0 on sensitive ports
`aws-vpc-003`	Medium	VPC without flow logs
`aws-vpc-004`	Medium	NACL allows internet access to admin ports
`aws-vpc-005`	Medium	Default security group has active rules
`aws-vpc-006`	Medium	VPC without private subnets (no network segmentation)

RDS (4 checks)

ID	Severity	Description
`aws-rds-001`	Critical	Publicly accessible RDS instance
`aws-rds-002`	High	Unencrypted RDS instance
`aws-rds-003`	Medium	Single-AZ RDS instance
`aws-rds-004`	Low	RDS auto minor version upgrade disabled

CloudTrail (8 checks)

ID	Severity	Description
`aws-ct-001`	Critical	No multi-region CloudTrail trail
`aws-ct-002`	High	CloudTrail log file validation disabled
`aws-ct-003`	Critical	CloudTrail S3 bucket is publicly accessible
`aws-ct-004`	High	CloudTrail S3 bucket has no access logging
`aws-ct-005`	Medium	CloudTrail not encrypted with KMS
`aws-ct-006`	Medium	S3 object-level write events not logged
`aws-ct-007`	Medium	S3 object-level read events not logged
`aws-ct-008`	Medium	CloudTrail not integrated with CloudWatch Logs

CloudWatch (16 checks)

ID	Severity	Description
`aws-cw-001`	High	No alarm for root account usage
`aws-cw-002`	Medium	No alarm for unauthorized API calls
`aws-cw-003`	Medium	No alarm for console sign-in without MFA
`aws-cw-004`	Medium	No alarm for IAM policy changes
`aws-cw-005`	Medium	No alarm for CloudTrail config changes
`aws-cw-006`	Medium	No alarm for console auth failures
`aws-cw-007`	Medium	No alarm for CMK disable/deletion
`aws-cw-008`	Medium	No alarm for S3 bucket policy changes
`aws-cw-009`	Medium	No alarm for Config changes
`aws-cw-010`	Medium	No alarm for security group changes
`aws-cw-011`	Medium	No alarm for NACL changes
`aws-cw-012`	Medium	No alarm for network gateway changes
`aws-cw-013`	Medium	No alarm for route table changes
`aws-cw-014`	Medium	No alarm for VPC changes
`aws-cw-015`	Medium	No alarm for Organizations changes
`aws-cw-016`	Medium	CloudWatch log group not encrypted with KMS

Other Services (24 checks)

ID	Severity	Description
`aws-gd-001`	High	GuardDuty not enabled
`aws-gd-002`	Medium	GuardDuty findings unresolved for 30+ days
`aws-cfg-001`	Medium	AWS Config not enabled
`aws-cfg-002`	High	AWS Config recorder stopped
`aws-kms-001`	Medium	KMS key without automatic rotation
`aws-kms-002`	High	KMS key policy with Principal:*
`aws-lambda-001`	High	Lambda function URL with no authentication
`aws-lambda-002`	Medium	Lambda running on a deprecated runtime
`aws-lambda-003`	High	Potential secrets in Lambda env vars
`aws-ecs-001`	Critical	ECS task running in privileged mode
`aws-ecs-002`	High	ECS task without log configuration
`aws-ecs-003`	Medium	ECS service with Execute Command enabled
`aws-ssm-001`	Medium	EC2 instance not managed by SSM
`aws-ssm-002`	High	SSM parameter stored as plain String
`aws-ssm-003`	Medium	EC2 instance not patch compliant (SSM)
`aws-sm-001`	Medium	Secret without rotation
`aws-sm-002`	Low	Secret unused for 90+ days
`aws-eip-001`	Low	Unattached Elastic IP
`aws-efs-001`	Medium	EFS file system not encrypted
`aws-sh-001`	Medium	Security Hub not enabled
`aws-account-001`	Medium	No security alternate contact
`aws-backup-001`	Medium	No AWS Backup vault or backup plan
`aws-inspector-001`	Medium	Amazon Inspector v2 not enabled
`aws-waf-001`	Medium	No WAFv2 WebACL in region

Alternatives

Prowler - 576+ checks, multi-cloud, full CIS coverage, auto-remediation. The most comprehensive open-source scanner.
Trivy - Container, IaC, and cloud scanner. Strong on containers, growing cloud coverage.
Steampipe - SQL-based cloud querying. Very flexible.
AWS Security Hub - Native AWS service with continuous monitoring. Free 30-day trial.

Documentation

cloud-audit has grown beyond what a single README can cover. The full documentation is at haitmg.pl/cloud-audit and includes:

Getting Started - installation, quick start, demo mode
Compliance - 6 frameworks: CIS AWS v3.0, SOC 2, BSI C5, ISO 27001, HIPAA, NIS2
Attack Chains - all 25 rules with MITRE ATT&CK references
MCP Server - full setup guide for Claude Code, Cursor, VS Code
Configuration - config file, env vars, suppressions
CI/CD - GitHub Actions, SARIF, pre-commit hooks
Reports - HTML, JSON, SARIF, Markdown output formats
All 88 Checks - full check reference by service

This README covers the essentials. For compliance framework details, advanced configuration, and per-check documentation, see the full docs.

What's Next

Root cause grouping ("fix 1 setting, close 12 findings")
Historical score tracking for Type II audits
Multi-account scanning (AWS Organizations)
Terraform drift detection

Past releases: CHANGELOG.md

Development

git clone https://github.com/gebalamariusz/cloud-audit.git
cd cloud-audit
pip install -e ".[dev]"

pytest -v                          # tests
ruff check src/ tests/             # lint
ruff format --check src/ tests/    # format
mypy src/                          # type check

See CONTRIBUTING.md for how to add a new check.

License

MIT - Mariusz Gebala / HAIT

Name		Name	Last commit message	Last commit date
Latest commit History 92 Commits
.github		.github
assets		assets
docs		docs
examples		examples
scripts		scripts
src/cloud_audit		src/cloud_audit
tests		tests
.cloud-audit.example.yml		.cloud-audit.example.yml
.gitignore		.gitignore
.mcp.json		.mcp.json
.pre-commit-hooks.yaml		.pre-commit-hooks.yaml
CHANGELOG.md		CHANGELOG.md
CODEOWNERS		CODEOWNERS
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
Dockerfile		Dockerfile
LICENSE		LICENSE
Makefile		Makefile
README.md		README.md
ROADMAP.md		ROADMAP.md
SECURITY.md		SECURITY.md
action.yml		action.yml
mkdocs.yml		mkdocs.yml
pyproject.toml		pyproject.toml

Uh oh!

Folders and files

Latest commit

History

Repository files navigation

cloud-audit

Quick Start

What You Get

Features

Attack Chain Detection

Copy-Paste Remediation

Scan Diff

6 Compliance Frameworks

Breach Cost Estimation

MCP Server for AI Agents

How It Compares

Reports

Installation

Usage

CI/CD

AWS Permissions

What It Checks

IAM (17 checks)

S3 (7 checks)

EC2 (6 checks)

VPC (6 checks)

RDS (4 checks)

CloudTrail (8 checks)

CloudWatch (16 checks)

Other Services (24 checks)

Alternatives

Documentation

What's Next

Development

License

About

Topics

Resources

License

Code of conduct

Contributing

Security policy

Uh oh!

Stars

Watchers

Forks

Releases 21

Sponsor this project

Uh oh!

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

Packages