![\"cloud-audit](\"assets/logo-nobg.png\"){kind=logo}
\n\n \n
\n Find AWS attack paths, IAM escalation routes, and the fixes that matter most.\n
\n\n\n Open-source, read-only AWS security scanner. It correlates findings into attack chains,\n ranks fixes by how many chains they break, and ships an AWS CLI + Terraform fix with\n every finding. No agent, no infrastructure, nothing written to your account.\n
\n\n\n ![\"PyPI](\"https://img.shields.io/pypi/v/cloud-audit?style=flat\")
![\"Python](\"https://img.shields.io/pypi/pyversions/cloud-audit?style=flat\")
![\"CI\"](\"https://github.com/gebalamariusz/cloud-audit/actions/workflows/ci.yml/badge.svg\"){kind=icon}
\n ![\"License:](\"https://img.shields.io/badge/License-MIT-yellow?style=flat\"){kind=icon}
![\"Docker\"](\"https://img.shields.io/badge/Docker-GHCR-blue?style=flat&logo=docker\"){kind=icon}
![\"Documentation\"](\"https://img.shields.io/badge/Docs-haitmg.pl-blue?style=flat\"){kind=icon}
\n Quick Start -\n What You Get -\n Installation -\n What's Checked -\n Documentation\n
\n\n## Quick Start\n\n```bash\npip install cloud-audit\ncloud-audit scan # uses your default AWS credentials and region\n```\n\nNo AWS account handy? Run a full sample report offline:\n\n```bash\ncloud-audit demo\n```\n\ncloud-audit is **read-only**. It never modifies your infrastructure; `SecurityAudit` is enough ([permissions](#aws-permissions)).\n\n## Example Output\n\n```\n+---- Attack Chains (5 detected) -----------------------------------+\n| CRITICAL Internet-Exposed Admin Instance |\n| i-0abc123 - public SG + admin IAM role + IMDSv1 |\n| CRITICAL IAM Privilege Escalation via iam:PassRole |\n| ci-deploy-role - 3-step path to admin |\n| CRITICAL CI/CD to Admin Takeover |\n| github-deploy - OIDC without sub + admin policy |\n+-------------------------------------------------------------------+\n\n+---- Remediation Plan ---------------------------------------------+\n| Fix 4 root causes, break 22 attack chains |\n| Quick wins (effort LOW, 14 chains): |\n| 1. Restrict SG ingress on sg-0abc123 -> breaks 8 chains |\n| 2. Add OIDC sub condition -> breaks 6 chains |\n+-------------------------------------------------------------------+\n```\n\nPreview a fix before you touch anything:\n\n```bash\ncloud-audit simulate --fix aws-vpc-002\n# Score 34 -> 58 (+24) | Chains broken 8 of 22 | Findings resolved 11\n```\n\n## What You Get\n\n- **Attack chains** // 31 rules correlate individual findings into exploitable paths (MITRE ATT&CK + pathfinding.cloud). [docs](https://haitmg.pl/cloud-audit/features/attack-chains/)\n- **Root-cause fixes** // groups findings by shared cause and ranks them: \"fix 4 things, break 22 chains,\" with a what-if `simulate` to preview impact. [docs](https://haitmg.pl/cloud-audit/features/simulate/)\n- **IAM privilege escalation** // 64 methods across 9 categories, including lateral movement through the AssumeRole graph. [docs](https://haitmg.pl/cloud-audit/features/iam-escalation/)\n- **Blast radius** // walk outward from any resource to see what an attacker reaches; export JSON to the live [visualizer](https://blast-audit.haitmg.pl/). [docs](https://haitmg.pl/cloud-audit/features/blast-radius/)\n- **Proof Mode** // `scan --verify` checks each escalation path against the IAM policy simulator (read-only) and flags the ones the principal can actually perform. [docs](https://haitmg.pl/cloud-audit/features/proof-mode/)\n- **Data perimeter** // resource-policy checks for confused-deputy and cross-org exposure, evaluating condition *values* (not just their presence). [docs](https://haitmg.pl/cloud-audit/features/data-perimeter/)\n- **AgentCore security** // checks for Amazon Bedrock AgentCore AI agents: network mode, MMDSv2, memory encryption, gateway authorizer. [docs](https://haitmg.pl/cloud-audit/features/agentcore/)\n- **Threat Feed** // 10 detectors for active-abuse patterns from 2025-2026 incidents, each with a primary-source citation. [docs](https://haitmg.pl/cloud-audit/features/threat-feed/)\n- **Remediation on every finding** // copy-paste AWS CLI + reviewable Terraform you apply yourself; security findings also carry a USD breach-cost estimate with sources.\n- **Trend & drift** // `cloud-audit diff` catches ClickOps drift between scans; `cloud-audit trend` tracks posture over time.\n\n\n \n ![\"blast-audit](\"assets/blast-audit-boardroom.png\")
\n \n
\n Drop a cloud-audit blast-radius --format json export into the open visualizer at\n blast-audit.haitmg.pl - everything runs in your browser.\n