gebalamariusz/cloud-audit

What's new

cloud-audit diff — compare two scans, see what changed.

The only open-source AWS security CLI with built-in scan comparison. Run daily scans, compare them, catch ClickOps drift and regressions that IaC scanning can't see.

cloud-audit diff yesterday.json today.json

Shows new findings, fixed findings, severity changes, and unchanged issues. Exit code 1 on regression — plug it into a cron job.

Diff features

• Terminal (Rich), markdown (--format markdown), JSON (--format json) output
• Exit code 0 = stable, 1 = new findings detected, 2 = error
• Scope warnings when comparing scans from different regions or accounts
• Format auto-detection from --output file extension
• Rich markup escaping for safe terminal output
• File size validation (50 MB max) and input safety checks

CI/CD examples

• daily-scan-with-diff.yml — scheduled daily scan with cache-based baseline
• post-deploy-scan.yml — scan before and after terraform apply

Also in this release

• SARIF spec compliance fixes (physicalLocation, help.markdown, semanticVersion)
• S3 encryption check pivoted: SSE-S3 now LOW (AWS auto-encrypts since Jan 2023)
• Markdown/HTML report improvements (escaping, accessibility, duration formatting)
• Ruff rules expanded (RUF, PIE, RET)
• 213 tests passing

Full Changelog: https://github.com/gebalamariusz/cloud-audit/compare/v0.7.0...v0.8.0