Cloud Security Posture

prowler14.9k★

Prowler scans your AWS, Azure, GCP, and Kubernetes accounts for security misconfigurations and compliance gaps, and it's free and open source. Point it at read-only credentials and it runs hundreds of checks against CIS, PCI, HIPAA, GDPR, and more, then hands you a report of what's wrong. Running it yourself is a Python CLI or a Docker container. No agents, no infrastructure, just read access to your accounts. The self-hosted version is the full engine, and it drops into CI and cron jobs cleanly. For a solo operator or a small team, that is genuinely all you need. Prowler Cloud is the paid SaaS on top: a hosted dashboard, continuous scanning, findings history, and team access without wiring up your own storage. Solo and small teams, the CLI is plenty. Larger teams that want a shared view and trend tracking without building it themselves, the hosted tier earns its keep. The catch: the report will overwhelm you on the first run. A fresh AWS account can throw hundreds of findings, most of them low priority. Budget time to tune the checks to what you actually care about, or the noise buries the signal.

steampipe8.0k★

Steampipe lets you query your cloud accounts, SaaS tools, and APIs with plain SQL. Want every S3 bucket that's public, or every IAM user without MFA? Write a SELECT statement instead of clicking through consoles or maintaining a pile of scripts. It's open source and runs as a single binary. It works through plugins, one per service, that map a provider's API to database tables, so AWS, Azure, GCP, Kubernetes, GitHub, and hundreds more become queryable. Setup is the binary plus the plugins and credentials you need. For security work, the Powerpipe benchmarks bolt on top and run CIS and compliance checks as pre-written queries. Solo and small teams get all of it for nothing. Turbot Pipes is the hosted version: a shared cloud instance, saved queries, dashboards, and team access without running your own. Solo and small teams, the CLI is the answer, maybe wired into CI. Larger teams that want a shared query workspace and dashboards, Pipes is the shortcut. The catch: SQL over live APIs is slower than you expect, and a broad query across a big account can take real time and hit rate limits. It's built for investigation and audits, not for anything that needs sub-second answers.

ScoutSuite7.8k★

ScoutSuite audits your cloud accounts for security misconfigurations and hands you an HTML report you can open in a browser. Point it at AWS, Azure, GCP, Oracle, or Alibaba Cloud and it pulls the config through read-only API calls, then flags the risky stuff: open security groups, public buckets, weak IAM. It's free and open source, built by the security consultancy NCC Group. It runs as a Python tool with no infrastructure, just credentials with read access. The output is a static report, so you run it, read it, fix things, and run it again. There's no continuous monitoring and no database, which makes it dead simple but means you own the cadence. This is a fully free tool with no paid tier to upsell you. For a one-time audit or a periodic manual check, it's excellent. Prowler covers similar ground with more compliance frameworks and a paid cloud option if you outgrow the manual approach. The catch: development has stalled. The last release shipped in May 2024, and nothing has landed on the main branch since. Cloud providers ship new services constantly, so coverage of anything newer is missing, not just lagging. It still catches the classic mistakes, but treat a clean report as "no obvious misconfigurations in what it checks," not a full audit. For ongoing use, Prowler is the actively maintained pick.

cloudquery6.5k★

CloudQuery syncs cloud configuration data into your data warehouse so you can query it with SQL. Pull from AWS, Azure, GCP, and 70+ SaaS sources, land it in Postgres, Snowflake, BigQuery, or whatever you run. Build cloud asset inventory, CSPM, FinOps, or vulnerability dashboards on top of clean tables. Run it as a CLI or scheduled job; pick a source and a destination, and CloudQuery handles the sync. Your cloud data never touches CloudQuery's servers, which matters if you're regulated. The plugin model is the differentiator vs Steampipe, which is more SQL-native and proxy-style. Pick this if you want to own your security data layer and run BI queries against it. Solo and small teams self-hosting get most of what Wiz and Lacework charge for, minus the UI polish and curated rule packs. Large teams might pay for premium plugins or the cloud version; the math is whether plugin maintenance time beats per-source cost. The catch: dashboards aren't included. You build security and FinOps views yourself in Grafana, Metabase, or Superset. If you want a turnkey security console with alerts pre-configured, you're paying Wiz.

cloudsploit3.8k★

CloudSploit scans your cloud accounts for security risks and misconfigurations, in the same family as Prowler and ScoutSuite. It checks AWS, Azure, GCP, and Oracle Cloud against a library of tests: exposed storage, permissive firewall rules, unencrypted resources, missing logging. It's open source, maintained by Aqua Security. You run it as a Node.js tool with read-only credentials, and it outputs findings you can pipe into CI or a report. Like the other open source scanners, it's stateless: run, review, remediate, repeat. No agent, no infrastructure to babysit. The repo is free. Aqua sells a broader commercial cloud security platform, but you don't need it to use the scanner. For teams choosing between open source CSPM tools: Prowler has the widest compliance mapping, ScoutSuite the cleanest report, CloudSploit sits comfortably in between. The catch: the open source project gets less attention than Aqua's commercial product, so check recent commit activity before you build a workflow around it. For a core scan it's solid; for bleeding-edge cloud coverage, the paid platforms move faster.