ScoutSuite

ScoutSuite audits your cloud accounts for security misconfigurations and hands you an HTML report you can open in a browser. Point it at AWS, Azure, GCP, Oracle, or Alibaba Cloud and it pulls the config through read-only API calls, then flags the risky stuff: open security groups, public buckets, weak IAM. It's free and open source, built by the security consultancy NCC Group.

It runs as a Python tool with no infrastructure, just credentials with read access. The output is a static report, so you run it, read it, fix things, and run it again. There's no continuous monitoring and no database, which makes it dead simple but means you own the cadence.

This is a fully free tool with no paid tier to upsell you. For a one-time audit or a periodic manual check, it's excellent. Prowler covers similar ground with more compliance frameworks and a paid cloud option if you outgrow the manual approach.

The catch: development is steady but not fast, and cloud providers ship new services constantly. Coverage of the newest features can lag, so treat a clean report as no obvious misconfigurations in what it checks, not audited everything.