Add cloud-audit - AWS security auditing CLI with remediation engine

[gebalamariusz]

Added cloud-audit to the Defensive section.

What it does: Python CLI that runs 17 opinionated security checks across IAM, S3, EC2, VPC, RDS, and EIP. Each finding includes ready-to-use AWS CLI commands and Terraform HCL snippets to fix the issue.

Open source, MIT licensed.

[gebalamariusz]

Hi @toniblyx - gentle bump on this PR.

Since opening in March, cloud-audit has shipped v2.0 with significant additions that may be relevant for the list:

• 94 curated checks across 23 AWS services (was 17 at PR open)
• 31 attack chain detection rules correlating findings into realistic exploit paths (e.g. public SG + IMDSv1 + IAM role = full takeover)
• 25 IAM privilege escalation detection methods - filling the gap left by PMapper, which was abandoned in 2024
• CIS AWS v3.0 compliance at 89% automation (55 of 62 controls fully automated)
• Featured in Help Net Security (March 2026): https://www.helpnetsecurity.com/2026/03/11/cloud-audit-open-source-aws-security-scanner/

I've pushed an updated commit (d84be4f) refreshing the entry with current stats and linking to the project homepage. Happy to trim, rephrase, or move it under a different section if you'd prefer.

Thanks for maintaining this list - it remains THE reference for AWS security tooling.

Disclosure: author of cloud-audit.

[toniblyx]

Awesome!

[toniblyx]

Please correct the comparison table in your repo, the Prowler column is 100% wrong. Prowler does all what you say it does not and multicloud. Please don't lie to your users.

[toniblyx]

also look at hub.prowler.com to count the controls we support.

[gebalamariusz]

@toniblyx You were right and I'm sorry for the inaccuracies. I've just corrected the comparison table in the cloud-audit README:

gebalamariusz/cloud-audit@7a5bd00

Specific fixes (all verified against github.com/prowler-cloud/prowler master):

• Compliance frameworks: "CIS" -> 41 (CIS, PCI-DSS, HIPAA, SOC2, NIST 800, ISO 27001, GDPR, FedRAMP, NIS2, MITRE ATT&CK + more)
• Auto-remediation: "CIS only" -> 55 fixers across 17 AWS services
• Attack path analysis: "No" -> Yes, via Prowler App (Cartography + Neo4j)
• IAM privilege escalation: "No" -> Yes, via Prowler App Attack Paths
• AI-SPM (Bedrock/SageMaker): "No" -> ~20 checks across both services
• AWS check count: 576 -> 572 (current master)
• Added explicit multi-cloud row (AWS + 13 others)
• Reframed the surrounding text: Prowler is the AWS security standard, cloud-audit is a narrower AWS-only complement, not a replacement

The Prowler-alternative landing page on haitmg.pl and the scanners-compared blog post need the same pass - those are on my list this week.

Genuinely appreciate you calling this out. Maintaining this arsenal list plus Prowler and still stopping to review a PR entry and its attached README is a real service to the community - you could have left the PR unmerged and moved on. You didn't, and that matters.

Prowler is the tool I learned AWS security auditing from. Writing an inaccurate comparison about something you and your team have built was the wrong way to position cloud-audit. Won't happen again.