A Python CLI tool that audits an AWS account for common security misconfigurations. Built with Boto3, the AWS SDK for Python.

• Python 3.8+
• AWS account with credentials configured (aws configure)
• IAM permissions: s3:*, ec2:DescribeSecurityGroups, iam:List*, iam:Get*

git clone https://github.com/Moscvv/cloud-misconfig-scanner.git
cd cloud-misconfig-scanner

python3 -m venv venv
source venv/bin/activate   # Windows: venv\Scripts\activate

pip install -r requirements.txt

# Full scan — terminal output
python scanner.py

# Scan a specific region
python scanner.py --region us-east-1

# Run only selected checks
python scanner.py --checks s3 iam

# Export an HTML report
python scanner.py --output html

# Export a JSON report (for piping into other tools)
python scanner.py --output json

╔═══════════════════════════════════════════════╗
║       Cloud Misconfiguration Scanner          ║
║       AWS Security Audit Tool                 ║
╚═══════════════════════════════════════════════╝

  Account : 054154173118
  Region  : ap-northeast-1
  Started : 2026-07-01 06:12:27 UTC

────────────────────────────────────────────────
  [1/3] Scanning S3 Buckets...
────────────────────────────────────────────────
  Found 1 bucket(s). Checking each...

  🔴  [HIGH] s3://misconfigured-test-bucket
       Block Public Access is not fully enabled
       → Disabled settings: BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets

  🔴  [HIGH] s3://misconfigured-test-bucket
       Bucket policy allows public access (Principal: *)
       → Actions exposed: s3:GetObject

════════════════════════════════════════════════
  TOTAL FINDINGS : 8
  🔴 HIGH        : 7
  🟡 MEDIUM      : 1
════════════════════════════════════════════════

cloud-misconfig-scanner/
├── scanner.py              # Entry point — CLI args, orchestration, summary
├── requirements.txt
├── .gitignore
└── scanners/
    ├── s3_scanner.py       # S3 bucket checks
    ├── sg_scanner.py       # EC2 security group checks
    ├── iam_scanner.py      # IAM policy, MFA, and access key checks
    └── report.py           # JSON and HTML report generation

Modular scanners — each service (S3, EC2, IAM) is a separate module. Adding a new check (e.g. CloudTrail logging disabled, RDS public snapshots) means adding one file without touching the core.

Least-privilege friendly — the tool only calls read-only AWS APIs (List*, Get*, Describe*). It never modifies resources.

Pagination handled — all list calls use AWS paginators, so the tool works correctly on accounts with hundreds of buckets, users, or security groups.

Graceful error handling — ClientError is caught per-resource so a permissions gap on one bucket doesn't abort the entire scan.

• Never commit AWS credentials. The .gitignore excludes ~/.aws/, .env, and any *.csv key exports.
• This tool is read-only — it audits and reports, it does not remediate.
• Designed for use in personal/sandbox accounts. In production environments, scope IAM permissions tightly to only the APIs listed above.

• CloudTrail: detect logging disabled per region
• RDS: public snapshots and instances
• S3: server-side encryption not enforced
• Output: CSV format
• Multi-region scan in one pass

• Python 3
• Boto3 — AWS SDK for Python
• AWS Free Tier (S3, EC2, IAM)

Contributions are welcome! To propose a change:

1. Fork the repo and create a branch off main.
2. Keep new checks consistent with the existing pattern — one module per AWS service in scanners/, returning a list of finding dicts with severity, resource, issue, and optional detail.
3. Only use read-only AWS calls (List*, Get*, Describe*) — this tool never modifies resources.
4. Open a pull request describing the check/fix and, if possible, include sample output.

Ideas for a first contribution are listed in the Roadmap above.

This project is licensed under the MIT License.