cloud-audit is an open-source Python CLI tool for AWS security auditing. It scans AWS accounts for misconfigurations, correlates findings into exploitable attack chains, and generates copy-paste remediation (AWS CLI + Terraform).

Homepage: https://haitmg.pl/cloud-audit/
Repository: https://github.com/gebalamariusz/cloud-audit
License: MIT
Language: Python 3.9+
Dependencies: boto3, jinja2 (minimal)
PyPI: https://pypi.org/project/cloud-audit/

Key capabilities:

• 80 security checks across 18 AWS services (IAM, S3, EC2, VPC, RDS, CloudTrail, Lambda, ECS, etc.)
• 20 attack chain rules based on MITRE ATT&CK Cloud and Datadog pathfinding.cloud - correlates individual findings into real exploit paths (e.g. public SG + IMDSv1 + admin role = account takeover)
• CIS AWS Foundations Benchmark v3.0 compliance engine (62 controls)
• Every finding includes AWS CLI + Terraform remediation code
• Scan diff command for tracking security drift between scans
• Output formats: HTML, JSON, SARIF (GitHub Code Scanning), Markdown
• Read-only access only (SecurityAudit policy), never modifies infrastructure
• GitHub Action available in Marketplace