aws-security-scanner - Scan your AWS account for security risks — public

项目说明

🛡️ AWS Cloud Security Scanner

An automated, multi-tool security assessment framework designed to e, audit, and report security posture across AWS cloud infrastructures.

The scanner audits core AWS services—including S3 Buckets, IAM Accounts & Access Policies, CloudTrail Logs, Prowler Compliance, and ScoutSuite Scans—and consolidates all findings into executi HTML, JSON, and PDF reports.

---

📋 Table of Contents

<a href="#key-features">Key Features</a>

<a href="#architecture-diagram">Architecture Diagram</a>

<a href="#repository-structure">Repository Structure</a>

<a href="#quick-start-installation">Quick Start & Installation</a>

<a href="#usage-instructions">Usage Instructions</a>

<a href="#s"> Generated Reports</a>

<a href="#resources">Resources</a>

---

<h2><a class="anchor" id="key-features"></a> 🌟 Key Features</h2>

📦 S3 Bucket Security Scanner:

- Identifies public bucket policies and ACLs.
- Ser Encryption (KMS / AES-256).
- Checks bucket and access logging.

👥 IAM Identity & Pri Audit:

- Enumerates users, roles, and attached policies.
- Highlights IAM accounts lacking Multi-Factor Authentication (MFA).
- Flags accounts with high-risk AdministratorAccess policies.

📊 CloudTrail & Threat Event Analysis:

- multi-region trail configuration and log file .
- Checks KMS encryption status for CloudTrail logs.
- Audits recent administrati events (CreateAccessKey, CreateUser, AttachUserPolicy, etc.).

📝 Executive PDF & HTML Reporting:

- Calculates an o Security Health Score (0–100).
- Categorizes findings by se: Critical, High, Medium, and Low.
- Generates actionable remediation roadmaps with status badges.

🔒 Built-in Privacy & Security:

- Credentials are ne or saved to disk.
- Raw scan outputs (outputs/) are automatically untracked via .gitignore to prevent accidental credential or metadata exposure on Git.

---

<h2><a class="anchor" id="architecture-diagram"></a> 🏗️ Architecture Diagram</h2>

!image alt

---

<h2><a class="anchor" id="repository-structure"></a> 📁 Repository Structure</h2>

---

<h2><a class="anchor" id="quick-start-installation"></a> 🚀 Quick Start & Installation</h2>

1. Prerequisites

Python 3.8+

Active AWS Credentials (AWS_ACCESS_KEY_ID & AWS_SECRET_ACCESS_KEY) with read-only audit permissions (SecurityAudit or ReadOnlyAccess).

2. Install Dependencies

Na to the scanner directory and install required Python packages:

---

<h2><a class="anchor" id="usage-instructions"></a> 💻 Usage Instructions</h2>

Basic Run (Default Region: us-east-1)

Run the scanner entry point. If credentials are not found in en , you will be prompted securely:

Specify a Custom AWS Region

To target a specific region (e.g., ap-south-1 for Mumbai, us-west-2 for Oregon, eu-west-1 for Ireland):

Pass Credentials Line Flags

---

<h2><a class="anchor" id="s"></a> 📊 Generated Reports</h2>

Once a scan completes, consolidated reports are saved in outputs/reports/:

1. PDF Executi: outputs/reports/security_report.pdf
2. HTML Web Report: outputs/reports/security_report.html
3. JSON Raw Data: outputs/reports/security_report.json

Open security_report.pdf or security_report.html in any web browser or PDF to review the assessment.
- Sample

!image alt

---

<h2><a class="anchor" id="resources"></a> 📚 Resources</h2>

Amazon S3

Amazon IAM

Amazon CloudTrail

项目信息

开发语言：Python

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Scan your AWS account for security risks — public buckets, loose IAM policies, unencrypted resources, and more.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。