cloudsploit

CloudSploit scans your cloud accounts for security risks and misconfigurations, in the same family as Prowler and ScoutSuite. It checks AWS, Azure, GCP, and Oracle Cloud against a library of tests: exposed storage, permissive firewall rules, unencrypted resources, missing logging. It's open source, maintained by Aqua Security.

You run it as a Node.js tool with read-only credentials, and it outputs findings you can pipe into CI or a report. Like the other open source scanners, it's stateless: run, review, remediate, repeat. No agent, no infrastructure to babysit.

The repo is free. Aqua sells a broader commercial cloud security platform, but you don't need it to use the scanner. For teams choosing between open source CSPM tools: Prowler has the widest compliance mapping, ScoutSuite the cleanest report, CloudSploit sits comfortably in between.

The catch: the open source project gets less attention than Aqua's commercial product, so check recent commit activity before you build a workflow around it. For a core scan it's solid; for bleeding-edge cloud coverage, the paid platforms move faster.