ScoutSuite

ScoutSuite audits your cloud accounts for security misconfigurations and hands you an HTML report you can open in a browser. Point it at AWS, Azure, GCP, Oracle, or Alibaba Cloud and it pulls the config through read-only API calls, then flags the risky stuff: open security groups, public buckets, weak IAM. It's free and open source, built by the security consultancy NCC Group.

It runs as a Python tool with no infrastructure, just credentials with read access. The output is a static report, so you run it, read it, fix things, and run it again. There's no continuous monitoring and no database, which makes it dead simple but means you own the cadence.

This is a fully free tool with no paid tier to upsell you. For a one-time audit or a periodic manual check, it's excellent. Prowler covers similar ground with more compliance frameworks and a paid cloud option if you outgrow the manual approach.

The catch: development has stalled. The last release shipped in May 2024, and nothing has landed on the main branch since. Cloud providers ship new services constantly, so coverage of anything newer is missing, not just lagging. It still catches the classic mistakes, but treat a clean report as "no obvious misconfigurations in what it checks," not a full audit. For ongoing use, Prowler is the actively maintained pick.