cloud-audit
English | 简体中文
Find AWS attack paths, IAM escalation routes, and the fixes that matter most.
Open-source, read-only AWS security scanner. It correlates findings into attack chains, ranks fixes by how many chains they break, and ships an AWS CLI + Terraform fix with every finding. No agent, no infrastructure, nothing written to your account.
Quick Start - What You Get - Installation - What's Checked - Documentation
Quick Start
pip install cloud-audit
cloud-audit scan # uses your default AWS credentials and regionNo AWS account handy? Run a full sample report offline:
cloud-audit democloud-audit is read-only. It never modifies your infrastructure; SecurityAudit is enough (permissions).
Example Output
+---- Attack Chains (5 detected) -----------------------------------+
| CRITICAL Internet-Exposed Admin Instance |
| i-0abc123 - public SG + admin IAM role + IMDSv1 |
| CRITICAL IAM Privilege Escalation via iam:PassRole |
| ci-deploy-role - 3-step path to admin |
| CRITICAL CI/CD to Admin Takeover |
| github-deploy - OIDC without sub + admin policy |
+-------------------------------------------------------------------+
+---- Remediation Plan ---------------------------------------------+
| Fix 4 root causes, break 22 attack chains |
| Quick wins (effort LOW, 14 chains): |
| 1. Restrict SG ingress on sg-0abc123 -> breaks 8 chains |
| 2. Add OIDC sub condition -> breaks 6 chains |
+-------------------------------------------------------------------+
