cloud-audit is an open-source, read-only AWS security scanner for teams that need to quickly discover and fix security issues in the cloud. Its positioning is "fast, opinionated, zero noise": every finding comes with copy-paste-ready AWS CLI and Terraform remediation, and the scan process writes nothing to the user's account.
[Core capabilities] The scan provides 110 read-only checks covering 25 AWS services, correlates findings into attack chains, ranks remediations by "how many attack chains can be cut," and estimates exposure cost. It has 64 built-in IAM privilege escalation methods, 31 attack chain rules, and blast radius analysis for any resource.
agent-blast is a specialized capability for AI agents: an AI agent in AWS is actually a collection of multiple IAM identities—the role the agent assumes when running, the execution role of the Lambda functions behind its tools, and the roles of knowledge bases, gateways, and sandboxes. When an agent is hijacked, the attacker acts as these identities. agent-blast answers "what this means" for each agent under two threat models. It reads Bedrock Agents (agent resource role, the Lambda resolved by each action group under the DRAFT version and its execution role, and the knowledge base resolved to the S3 data source bucket) and AgentCore (runtime role and network mode, gateway role with authorizers, policy engine and each target and credential provider, and the execution roles of the code interpreter and browser), preserves the raw IAM policies (inline, attached, group) for these identities, and flags whether Conditions are present. It then analyzes, for each identity, 64 privilege escalation methods, AssumeRole hops through the trust graph, and authorization for data, secrets, lateral movement, code execution, and model invocation. Knowledge base buckets are always treated as concrete targets, and write permission to them is reported as RAG poisoning. Anything that cannot be read is reported as a coverage note rather than silently passing.
[How to use] When using real credentials, only one read-only command is needed; the AWS managed SecurityAudit policy covers all checks. It can be run via Docker, and also provides a composable GitHub Action (gebalamariusz/cloud-audit@v0) as well as ready-made workflows (basic scan, daily diff, post-deployment scan). The repository also providesProvides seven read-only MCP tools for AI assistants: scan_aws, get_findings, get_attack_chains, get_remediation, get_health_score, list_checks, get_agent_blast.
Configuration defaults live in .cloud-audit.yml (regions, min_severity, exclude_checks, time-limited suppressions); environment variables (CLOUD_AUDIT_REGIONS, CLOUD_AUDIT_MIN_SEVERITY, etc.) can override the file, and CLI flags can override everything.
[Proof Mode and Verification] scan --verify checks every detected privilege escalation path; verified: true means the simulator allows all required operations, false means one of them was denied (very likely a false positive), and null means no assertion was made. agent-blast --verify checks every specific (principal, action, resource) reach and provides the context the attacker has, while indicating the policy layer where the denial occurs. As of 2026-07-30, the simulator can evaluate identity policies, attached permission boundaries, organization SCPs (including condition keys), and provided context keys; it does not evaluate resource control policies, VPC endpoint policies, role chaining, and resource-based policies for IAM roles.
[Output and Integration] Output formats support tree, json, and markdown; --format json can be imported directly into the browser visualizer, and --format mermaid can generate diagrams for wikis. --quiet returns only the exit code (0 clean, 1 findings, 2 error), and --min-severity high can be used to control the severity threshold; cloud-audit diff old.json new.json --quiet exits 1 when new findings appear, making it easy for daily scans to detect ClickOps drift. simulate can preview remediation effects without actually making changes; blast-radius looks outward from any resource to see the impact after it is compromised; exposure ranks security graph nodes by internet reachability and privilege escalation.
[Limitations and Notes] The project requires Python 3.10 to 3.13, and depends on boto3,typer, rich, pydantic, jinja2, pyyaml, mcp. Permissions are read-only, and attaching the AWS managed SecurityAudit policy is recommended. simulate, blast-radius, exposure, diff, trend, and agent-blast all run locally against saved scan results and do not call AWS; --verify only additionally adds simulator calls. Regions where the service does not exist are skipped, and regions where reads are denied are listed as coverage gaps. The simulator's "true" proves that permissions exist, but does not prove an end-to-end attack, and it does not execute any operations.
cloud-audit is free and remains free, under the MIT license. The author also offers optional professional services, including scan output review (free), AWS security audits, AI agent access reviews, remediation support, and Palo Alto VM-Series on AWS architecture and security reviews.