prowler

Prowler scans your AWS, Azure, GCP, and Kubernetes accounts for security misconfigurations and compliance gaps, and it's free and open source. Point it at read-only credentials and it runs hundreds of checks against CIS, PCI, HIPAA, GDPR, and more, then hands you a report of what's wrong.

Running it yourself is a Python CLI or a Docker container. No agents, no infrastructure, just read access to your accounts. The self-hosted version is the full engine, and it drops into CI and cron jobs cleanly. For a solo operator or a small team, that is genuinely all you need.

Prowler Cloud is the paid SaaS on top: a hosted dashboard, continuous scanning, findings history, and team access without wiring up your own storage. Solo and small teams, the CLI is plenty. Larger teams that want a shared view and trend tracking without building it themselves, the hosted tier earns its keep.

The catch: the report will overwhelm you on the first run. A fresh AWS account can throw hundreds of findings, most of them low priority. Budget time to tune the checks to what you actually care about, or the noise buries the signal.