gebalamariusz/cloud-audit

What's New

15 new checks across 4 new AWS services, bringing the total to 42 curated checks.

New Check Modules

Lambda (3 checks)

• aws-lambda-001 - Public function URL without authentication (HIGH)
• aws-lambda-002 - Deprecated/EOL runtime without security patches (MEDIUM)
• aws-lambda-003 - Potential secrets in environment variables (HIGH)

ECS (3 checks)

• aws-ecs-001 - Privileged containers with root host access (CRITICAL)
• aws-ecs-002 - Missing log configuration on containers (HIGH)
• aws-ecs-003 - ECS Exec enabled in production (MEDIUM)

SSM (2 checks)

• aws-ssm-001 - Running EC2 instances not managed by Systems Manager (MEDIUM)
• aws-ssm-002 - Secret-like parameters stored as String instead of SecureString (HIGH)

Secrets Manager (2 checks)

• aws-sm-001 - Secrets without automatic rotation (MEDIUM)
• aws-sm-002 - Unused secrets costing $0.40/month (LOW)

Extended Existing Checks

• aws-iam-005 - Overly permissive IAM policies (Action: *, Resource: *) (CRITICAL)
• aws-iam-006 - Weak account password policy (CIS 1.8) (MEDIUM)
• aws-s3-004 - S3 buckets without lifecycle rules (LOW, cost)
• aws-s3-005 - S3 buckets without access logging (MEDIUM)
• aws-ec2-004 - EC2 instances with IMDSv1 enabled, vulnerable to SSRF (HIGH)

Other

• Version now reads from package metadata (single source of truth)
• 96 moto tests, all passing
• 15 CIS Benchmark controls mapped

pip install cloud-audit==0.4.0
cloud-audit scan -R