Find AWS attack paths, IAM escalation routes, and the fixes that matter most.
Open-source CLI scanner that helps you decide what to fix first —
not just what's wrong.
Find attack chains and IAM escalation paths - Simulate fixes before you apply them - Fix root causes, not individual findings
Documentation - Quick Start - Compliance - Attack Chains - IAM Escalation - Simulator - MCP Server
pip install cloud-audit
cloud-audit scanUses your default AWS credentials and region. Try without an AWS account:
cloud-audit demoMost scanners give you findings. cloud-audit helps you decide what to fix first.
+---- Attack Chains (5 detected) -----------------------------------+
| CRITICAL Internet-Exposed Admin Instance |
| i-0abc123 - public SG + admin IAM role + IMDSv1 |
| |
| CRITICAL IAM Privilege Escalation via iam:PassRole |
| ci-deploy-role - 3-step path to admin |
| |
| CRITICAL CI/CD to Admin Takeover |
| github-deploy - OIDC no sub + admin policy |
+--------------------------------------------------------------------+
+---- Remediation Plan -------------------------------------------+
| Fix 4 root causes, break 22 attack chains |
| |
| Quick Wins (effort: LOW, chains broken: 14): |
| 1. Restrict SG ingress on sg-0abc123 -> breaks 8 chains |
| 2. Add OIDC sub condition -> breaks 6 chains |
+--------------------------------------------------------------------+
Other tools give you 200 findings sorted by severity. cloud-audit groups them by root cause, shows which single fixes collapse the most attack paths, and lets you simulate the impact before you touch anything:
cloud-audit simulate --fix aws-vpc-002
# Score: 34 -> 58 (+24) | Chains broken: 8 of 22 | Findings resolved: 1194 checks across 23 AWS services. Every finding includes copy-paste AWS CLI + Terraform remediation.
Watch the 1-minute demo
| Feature | What it does |
|---|---|
| IAM Privilege Escalation | 25 escalation methods across 6 categories. PMapper has been dead since 2022 -- this is its open-source replacement. |
| What-If Simulator | cloud-audit simulate --fix aws-vpc-002 shows score change, chains broken, and risk reduction before you apply anything. |
| Root Cause Grouping | "Fix 4 things, break 22 chains." Groups findings by shared root cause and ranks by impact. |
| Security Posture Trend | cloud-audit trend tracks health score, chains, and risk over time with sparkline visualization. |
| AI-SPM | First open-source Bedrock + SageMaker scanner. 5 checks, 3 attack chains (model theft, LLMjacking, data poisoning). |
31 rules correlate individual findings into exploitable attack paths.
Internet --> Public SG --> EC2 (IMDSv1) --> Admin IAM Creds --> Account Takeover
aws-vpc-002 aws-ec2-004 Detected: AC-01, AC-02
| Chain | What it catches |
|---|---|
| IAM Privilege Escalation | iam:PassRole + lambda:Create + iam:Attach = 3-step path to admin |
| Internet-Exposed Admin | Public SG + admin IAM role + IMDSv1 = account takeover |
| CI/CD to Admin Takeover | OIDC without sub condition + admin policy = pipeline hijack |
| LLMjacking | Bedrock no logging + no guardrails = undetected model abuse |
Based on MITRE ATT&CK Cloud and pathfinding.cloud. See all 31 rules.
Every finding includes AWS CLI, Terraform HCL, and docs links. Export all fixes:
cloud-audit scan --export-fixes fixes.shSimulate before applying:
cloud-audit simulate --fix aws-vpc-002
# Score: 34 -> 58 (+24) | Chains broken: 8 of 22 | Findings resolved: 11
cloud-audit simulate --fix aws-vpc-002,aws-ct-001,aws-iam-007
# Score: 34 -> 82 (+48) | Chains broken: 19 of 22cloud-audit diff yesterday.json today.json # Catches ClickOps drift
cloud-audit trend # Posture over time- CIS AWS v3.0 - 62 controls, 55 automated (89%)
- SOC 2 Type II - 43 criteria, 24 automated (56%)
- BSI C5:2020
Beta- 134 criteria, 57 automated/partial - ISO 27001:2022
Beta- 93 controls, 47 automated/partial - HIPAA Security Rule
Beta- 47 specs, 29 automated/partial - NIS2 Directive
Beta- 43 measures, 33 automated/partial
Every finding and chain includes a dollar-range risk estimate based on IBM/Verizon breach data, with source links.
claude mcp add cloud-audit -- uvx --from cloud-audit cloud-audit-mcp6 tools: scan_aws, get_findings, get_attack_chains, get_remediation, get_health_score, list_checks. Free and standalone.
Prowler is the AWS security standard: 572 checks across 83 services, 41 compliance frameworks (CIS, PCI-DSS, HIPAA, SOC2, NIST 800, ISO 27001, GDPR, FedRAMP, NIS2, MITRE ATT&CK and more), 55 auto-remediation fixers, and graph-based attack path analysis in the Prowler App (Cartography + Neo4j). It also covers Azure, GCP, Kubernetes, M365, and 10+ other providers.
cloud-audit is AWS-only and intentionally narrower (94 curated checks). It goes deep where Prowler goes wide: attack chain correlation and IAM escalation detection run in the free CLI with zero infrastructure, every finding ships with reviewable Terraform + AWS CLI remediation, and scan diff / drift tracking is built into the CLI.
| Feature | Prowler | cloud-audit |
|---|---|---|
| AWS checks | 572 across 83 services | 94 across 23 services |
| Compliance frameworks (AWS) | 41 (CIS, PCI-DSS, HIPAA, SOC2, NIST, ISO 27001, GDPR, FedRAMP, NIS2, ...) | 6 (CIS v3.0, SOC 2, BSI C5, ISO 27001, HIPAA, NIS2) |
| Auto-remediation | 55 fixers across 17 AWS services (direct API calls) | 94/94 findings with CLI + Terraform output (reviewable, you apply) |
| Attack path / graph analysis | Prowler App (Cartography + graph queries) | CLI-native (31 rules, no infra) |
| IAM privilege escalation graph | Prowler App | CLI-native (25 methods) |
| What-If remediation simulator | No | Yes |
| AI/ML security checks (Bedrock + SageMaker) | ~20 checks | 5 checks + 3 attack chain rules |
| Scan diff / drift tracking | Prowler App | Built-in CLI (cloud-audit diff) |
| Breach cost estimates (USD) | No | Per-finding + per-chain |
| MCP Server | Free | Free |
| Multi-cloud | AWS + 13 others | AWS only |
| License | Apache 2.0 | MIT |
Use Prowler for compliance breadth, multi-cloud coverage, and graph-based attack path analysis. Use cloud-audit for fast CLI-native attack chain detection, reviewable Terraform remediation, and CI/CD drift tracking. They are complementary, not competitors - a common setup is Prowler for quarterly compliance evidence plus cloud-audit daily in CI/CD.
Prowler stats verified from github.com/prowler-cloud/prowler (April 2026). cloud-audit snapshot as of v2.0.1.
cloud-audit scan --format html -o report.html # Client-ready HTML
cloud-audit scan --format json -o report.json # Machine-readable
cloud-audit scan --format sarif -o results.sarif # GitHub Code Scanning
cloud-audit scan --format markdown -o report.md # PR commentspip install cloud-audit # pip (recommended)
pipx install cloud-audit # pipx (isolated)
docker run ghcr.io/gebalamariusz/cloud-audit scan # DockerDocker with credentials:
docker run -v ~/.aws:/home/cloudaudit/.aws:ro ghcr.io/gebalamariusz/cloud-audit scancloud-audit scan -R # Show remediation
cloud-audit scan --profile prod --regions eu-central-1 # Specific profile/region
cloud-audit scan --regions all # All enabled regions
cloud-audit scan --min-severity high # Filter by severity
cloud-audit scan --role-arn arn:aws:iam::...:role/audit # Cross-account
cloud-audit scan --quiet # Exit code only (CI/CD)
cloud-audit simulate --fix aws-vpc-002 # What-If simulator
cloud-audit trend # Posture over time
cloud-audit list-checks # List all checks| Exit code | Meaning |
|---|---|
| 0 | No findings |
| 1 | Findings detected |
| 2 | Scan error |
Configuration file
Create .cloud-audit.yml in your project root:
provider: aws
regions:
- eu-central-1
- eu-west-1
min_severity: medium
exclude_checks:
- aws-eip-001
suppressions:
- check_id: aws-vpc-001
resource_id: vpc-abc123
reason: "Legacy VPC, migration planned for Q3"
accepted_by: "jane@example.com"
expires: "2026-09-30"
- check_id: "aws-cw-*"
reason: "CloudWatch alarms managed by separate team"
accepted_by: "ops@example.com"Environment variables
| Variable | Example |
|---|---|
CLOUD_AUDIT_REGIONS |
eu-central-1,eu-west-1 |
CLOUD_AUDIT_MIN_SEVERITY |
high |
CLOUD_AUDIT_EXCLUDE_CHECKS |
aws-eip-001,aws-iam-001 |
CLOUD_AUDIT_ROLE_ARN |
arn:aws:iam::...:role/auditor |
Precedence: CLI flags > env vars > config file > defaults.
- run: pip install cloud-audit
- run: cloud-audit scan --format sarif --output results.sarif
- uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: results.sarifReady-to-use workflows: basic scan, daily diff, post-deploy.
cloud-audit requires read-only access. Attach SecurityAudit (covers all checks including IAM escalation analysis):
aws iam attach-role-policy --role-name auditor --policy-arn arn:aws:iam::aws:policy/SecurityAuditcloud-audit never modifies your infrastructure. The simulate command runs locally against scan data -- it does not call AWS APIs.
94 checks across IAM, S3, EC2, VPC, RDS, EIP, EFS, CloudTrail, GuardDuty, KMS, CloudWatch, Lambda, ECS, SSM, Secrets Manager, AWS Config, Security Hub, Account, AWS Backup, Amazon Inspector, AWS WAF, Amazon Bedrock, and Amazon SageMaker.
See all 94 checks by service or run cloud-audit list-checks locally.
Full docs at haitmg.pl/cloud-audit:
- Getting Started - installation, quick start, demo mode
- Attack Chains - all 31 rules with MITRE ATT&CK references
- IAM Escalation - 25 methods, 6 categories
- What-If Simulator - simulate remediation impact
- Compliance - 6 frameworks: CIS, SOC 2, BSI C5, ISO 27001, HIPAA, NIS2
- All 94 Checks - full check reference by service
- Multi-account scanning (AWS Organizations)
- SCP + permission boundary evaluation in IAM escalation
- Terraform drift detection
Past releases: CHANGELOG.md
git clone https://github.com/gebalamariusz/cloud-audit.git
cd cloud-audit
pip install -e ".[dev]"
pytest -v # 496 tests
ruff check src/ tests/ # lint
mypy src/ # type checkSee CONTRIBUTING.md for how to add a new check.