Find AWS attack chains and get exact fixes.

Open-source CLI scanner that correlates findings into exploitable paths
and generates copy-paste remediation (AWS CLI + Terraform).

Detect exploitable attack paths  -  Get AWS CLI + Terraform fixes  -  Run locally, no SaaS required

Documentation - Quick Start - CIS AWS v3.0 - Attack Chains - MCP Server

pip install cloud-audit
cloud-audit scan

Uses your default AWS credentials and region. Try without an AWS account:

cloud-audit demo

+------- Health Score -------+
| 42 / 100                   |   Risk exposure: $725K - $7.3M
+----------------------------+

+---- Attack Chains (3 detected) -----------------------------------+
|  CRITICAL  Internet-Exposed Admin Instance                         |
|            i-0abc123 - public SG + admin IAM role + IMDSv1         |
|            Fix: Restrict security group (effort: LOW)              |
|                                                                    |
|  CRITICAL  CI/CD to Admin Takeover                                 |
|            github-deploy - OIDC no sub + admin policy              |
|            Fix: Add sub condition (effort: LOW)                    |
+--------------------------------------------------------------------+

Findings by severity:  CRITICAL: 3  HIGH: 8  MEDIUM: 12  LOW: 5

80 checks across 18 AWS services. Every finding includes AWS CLI + Terraform remediation.

_{Watch the 1-minute demo}

If cloud-audit helped you find something you missed, consider giving it a star. It helps others discover the project.

Other scanners give you a flat list of findings. cloud-audit correlates them into attack paths an attacker would actually exploit.

  Internet --> Public SG --> EC2 (IMDSv1) --> Admin IAM Creds --> Account Takeover
               aws-vpc-002   aws-ec2-004       Detected: AC-01, AC-02

Examples from the 20 built-in rules:

Based on MITRE ATT&CK Cloud and Datadog pathfinding.cloud. See all 20 rules in the docs.

Every finding includes AWS CLI commands, Terraform HCL, and documentation links. Export all fixes as a runnable script:

cloud-audit scan --export-fixes fixes.sh

Compare scans to track drift. Catches ClickOps changes, manual console edits, and regressions that IaC scanning misses.

cloud-audit diff yesterday.json today.json

Exit code 0 = no new findings, 1 = regression. See daily-scan-with-diff.yml for a CI/CD workflow.

Built-in compliance engine for the CIS Amazon Web Services Foundations Benchmark v3.0.0. 55 of 62 recommendations are automated (7 require manual review). Each control has evidence templates for auditors and per-control remediation guidance.

Planned: SOC 2, ISO 27001, BSI C5, HIPAA, NIS2.

Every finding includes a dollar-range risk estimate based on published breach data (IBM Cost of a Data Breach 2024, Verizon DBIR, enforcement actions). Attack chains use compound risk multipliers. Every estimate links to its source.

Ask Claude Code, Cursor, or VS Code Copilot to scan your AWS account:

claude mcp add cloud-audit -- uvx --from cloud-audit cloud-audit-mcp

6 tools: scan_aws, get_findings, get_attack_chains, get_remediation, get_health_score, list_checks. Free and standalone - no SaaS account needed.

cloud-audit has fewer checks than Prowler but deeper output per finding: remediation code, attack chain context, cost estimates, and compliance evidence. If you need exhaustive compliance coverage across multiple clouds, Prowler is the better choice. If you need a focused scan that shows how findings combine into real attack paths and tells you exactly how to fix each one, cloud-audit is built for that.

_{Feature snapshot as of March 2026. Verify against upstream docs for the latest details.}

cloud-audit scan --format html --output report.html    # Client-ready HTML
cloud-audit scan --format json --output report.json    # Machine-readable
cloud-audit scan --format sarif --output results.sarif # GitHub Code Scanning
cloud-audit scan --format markdown --output report.md  # PR comments

Format is auto-detected from file extension.

pip install cloud-audit          # pip (recommended)
pipx install cloud-audit         # pipx (isolated)
docker run ghcr.io/gebalamariusz/cloud-audit scan  # Docker

Docker with credentials:

docker run -v ~/.aws:/home/cloudaudit/.aws:ro ghcr.io/gebalamariusz/cloud-audit scan

cloud-audit scan -R                                    # Show remediation
cloud-audit scan --profile prod --regions eu-central-1  # Specific profile/region
cloud-audit scan --regions all                          # All enabled regions
cloud-audit scan --min-severity high                   # Filter by severity
cloud-audit scan --role-arn arn:aws:iam::...:role/audit # Cross-account
cloud-audit scan --quiet                               # Exit code only (CI/CD)
cloud-audit list-checks                                # List all checks

provider: aws
regions:
  - eu-central-1
  - eu-west-1
min_severity: medium
exclude_checks:
  - aws-eip-001
suppressions:
  - check_id: aws-vpc-001
    resource_id: vpc-abc123
    reason: "Legacy VPC, migration planned for Q3"
    accepted_by: "jane@example.com"
    expires: "2026-09-30"

- run: pip install cloud-audit
- run: cloud-audit scan --format sarif --output results.sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Ready-to-use workflows: basic scan, daily diff, post-deploy.

cloud-audit requires read-only access. Attach SecurityAudit:

aws iam attach-role-policy --role-name auditor --policy-arn arn:aws:iam::aws:policy/SecurityAudit

cloud-audit never modifies your infrastructure.

80 checks across IAM, S3, EC2, VPC, RDS, EIP, EFS, CloudTrail, GuardDuty, KMS, CloudWatch, Lambda, ECS, SSM, Secrets Manager, AWS Config, Security Hub, and Account.

• Prowler - 576+ checks, multi-cloud, full CIS coverage, auto-remediation. The most comprehensive open-source scanner.
• Trivy - Container, IaC, and cloud scanner. Strong on containers, growing cloud coverage.
• Steampipe - SQL-based cloud querying. Very flexible.
• AWS Security Hub - Native AWS service with continuous monitoring. Free 30-day trial.

cloud-audit has grown beyond what a single README can cover. The full documentation is at haitmg.pl/cloud-audit and includes:

• Getting Started - installation, quick start, demo mode
• Compliance - CIS AWS v3.0 with all 62 controls, planned SOC 2, BSI C5, HIPAA, NIS2
• Attack Chains - all 20 rules with MITRE ATT&CK references
• MCP Server - full setup guide for Claude Code, Cursor, VS Code
• Configuration - config file, env vars, suppressions
• CI/CD - GitHub Actions, SARIF, pre-commit hooks
• Reports - HTML, JSON, SARIF, Markdown output formats
• All 80 Checks - full check reference by service

This README covers the essentials. For compliance framework details, advanced configuration, and per-check documentation, see the full docs.

• SOC 2, BSI C5, HIPAA, NIS2 compliance frameworks
• Terraform drift detection
• Root cause grouping

Past releases: CHANGELOG.md

git clone https://github.com/gebalamariusz/cloud-audit.git
cd cloud-audit
pip install -e ".[dev]"

pytest -v                          # tests
ruff check src/ tests/             # lint
ruff format --check src/ tests/    # format
mypy src/                          # type check

See CONTRIBUTING.md for how to add a new check.

MIT - Mariusz Gebala / HAIT