cloudsploit

Run a scan with default settings

$ cloudsploit scan

$ cloudsploit scan --cloud [aws|azure|gcp|oracle]

$ cloudsploit scan --compliance [hipaa|pci|cis]

$ cloudsploit scan --json [output.json]

$ cloudsploit scan --plugin [pluginName]

$ cloudsploit scan --config [config.js]

cloudsploit command [options]

CloudSploit is an open-source cloud security scanner that detects security risks and misconfigurations across AWS, Azure, GCP, and Oracle Cloud. It checks for hundreds of security issues including public S3 buckets, overly permissive IAM policies, unencrypted databases, and exposed services.
The tool runs plugins that query cloud APIs to assess configuration against security best practices. Results are categorized by severity (OK, WARN, FAIL, UNKNOWN) with descriptions and remediation guidance.
CloudSploit supports compliance mapping to frameworks like CIS Benchmarks, PCI-DSS, and HIPAA, helping organizations meet regulatory requirements. It can be integrated into CI/CD pipelines for continuous security monitoring.

scan

Run security scan against cloud infrastructure.

Target cloud provider: aws, azure, gcp, oracle.

Check against compliance framework (hipaa, pci, cis).

Run only specified plugin.

Output results in JSON format.

Output results in CSV format.

Use custom configuration file.

Suppress specific plugins from results.

Attempt automatic remediation (where supported).

Requires appropriate cloud credentials with read permissions. Scanning large environments may take significant time and incur API costs. Some checks require specific permissions that may not be available in restricted accounts. Automated remediation should be tested in non-production first.

CloudSploit was created by Aqua Security (originally CloudSploit Inc., acquired in 2019) as an open-source cloud security posture management tool. First released around 2015, it grew to support multiple cloud providers and became one of the foundational tools in the cloud security space. Aqua continues to maintain the open-source version while offering a commercial SaaS platform.

prowler(1), scout-suite(1), steampipe(1)