Repolode
Submit
gebalamariusz

gebalamariusz/cloud-audit

Read-only AWS security scanner with 110 checks, IAM privilege-escalation analysis, attack chains, and AI agent blast-radius reporting, each finding with an AWS CLI and Terraform fix.

Open-source alternative to:ProwlerAWS Security Hub

View on GitHub
Stars
74
Forks
12
Open issues
11
Last commit
24 days ago

What is it?

cloud-audit is a Python command-line scanner for AWS accounts. It runs 110 configuration checks across 25 services, including IAM, S3, EC2, KMS, CloudTrail, Lambda and Bedrock, and reports findings with a health score. It also looks for IAM privilege-escalation methods, correlates findings into attack chains, and ranks which fixes break the most chains.

A separate agent-blast command inventories Bedrock Agents and AgentCore resources and works out what an agent's IAM identities could reach if the agent were hijacked. With the --verify option, it asks the IAM policy simulator to confirm each reachable permission. Offline commands such as simulate, blast-radius and exposure work from a saved JSON report without making further AWS calls.

The tool is read-only and does not change resources in the account. It outputs console tables, JSON, HTML, SARIF, and Markdown, and includes an MCP server with read-only tools for AI assistants.

Key features

  • 01Runs 110 read-only configuration checks across 25 AWS services, each with an AWS CLI and Terraform fix.
  • 02Detects 64 IAM privilege-escalation methods and lateral AssumeRole paths.
  • 03Correlates findings into 31 attack-chain rules and ranks fixes by chains broken.
  • 04Maps AI agent reach for Bedrock Agents and AgentCore under two threat models.
  • 05Verifies escalation paths and agent permissions with the IAM policy simulator via --verify.
  • 06Exports results as console, JSON, HTML, SARIF or Markdown and runs in CI/CD.

Use cases

  • Auditing an AWS account for IAM misconfigurations and privilege-escalation paths before or after deployment.
  • Checking what a Bedrock or AgentCore agent could access if its credentials or prompts were compromised.
  • Running scheduled scans in GitHub Actions and uploading SARIF results to Code Scanning.
  • Comparing scan results over time to detect configuration drift.

Quick start

  1. 1

    Install from PyPI

    pip install cloud-audit
  2. 2

    Try the offline demo with no AWS account

    cloud-audit demo --save demo.json
  3. 3

    Run a read-only scan of your AWS account with default profile and region

    cloud-audit scan

Things to know

  • Scans only AWS accounts, not other cloud providers.
  • The --verify proof mode and agent-blast need AWS credentials with IAM simulator access.

In collections

Open-source personal AI agents

Topics

#aws#cloud-security#iam#security-scanner#compliance#infrastructure-security#personal-agent#audit#aws-audit#aws-security

FAQ

What is cloud-audit?
Read-only AWS security scanner with 110 checks, IAM privilege-escalation analysis, attack chains, and AI agent blast-radius reporting, each finding with an AWS CLI and Terraform fix. cloud-audit is a Python command-line scanner for AWS accounts. It runs 110 configuration checks across 25 services, including IAM, S3, EC2, KMS, CloudTrail, Lambda and Bedrock, and reports findings with a health score. It also looks for IAM privilege-escalation methods, correlates findings into attack chains, and ranks which fixes break the most chains.
Is cloud-audit free to use? What license does it have?
cloud-audit is open source under the MIT license. Check the license terms before using it in commercial products.
Is cloud-audit still maintained?
Actively maintained. The last commit to cloud-audit was on Oct 14, 2026.
What can I use cloud-audit for?
Auditing an AWS account for IAM misconfigurations and privilege-escalation paths before or after deployment. Checking what a Bedrock or AgentCore agent could access if its credentials or prompts were compromised. Running scheduled scans in GitHub Actions and uploading SARIF results to Code Scanning. Comparing scan results over time to detect configuration drift.
How do I install cloud-audit?
Install from PyPI: pip install cloud-audit Try the offline demo with no AWS account: cloud-audit demo --save demo.json Run a read-only scan of your AWS account with default profile and region: cloud-audit scan
Where can I get cloud-audit?
The source code and installation instructions are on GitHub: https://github.com/gebalamariusz/cloud-audit

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects