Cloud Security Tools

# ScoutSuite installation
pip install scoutsuite

# AWS audit
scout aws --profile my-aws-profile

# Azure audit
scout azure --cli

# GCP audit (with service account key)
scout gcp --service-account /path/to/key.json

# Output
# Generates an HTML report in scoutsuite-report/scoutsuite-report.html
# Contains: findings summary, compliance mapping, IAM analysis, network analysis

# Quick assessment against CIS benchmarks
prowler aws -M html
# Generates HTML report

# Check specific service
prowler aws --services s3

# Compliance frameworks
prowler aws --compliance cis_1.4_aws
prowler aws --compliance pci_3.2
prowler aws --compliance soc2

# Output formats
prowler aws -M html,json,csv

# Continuous monitoring mode
prowler aws -M json -o /var/log/prowler/

# Scan Terraform directory
checkov -d terraform/

# Scan specific file
checkov -f main.tf

# Multi-cloud IaC scanning
checkov -d . --framework terraform,cloudformation,kubernetes

# Output formats
checkov -d terraform/ -o json > checkov-report.json

# Skip specific checks (after review)
checkov -d terraform/ --skip-check CKV_AWS_52

# Soft fail (don't exit non-zero on findings)
checkov -d terraform/ --soft-fail

# Enable AWS Config (CLI)
aws configservice put-configuration-recorder \
  --configuration-recorder name=default,roleARN=arn:aws:iam::123456789012:role/AWS_ConfigRole

# Enable recording
aws configservice start-configuration-recorder \
  --configuration-recorder-name default

# Query resource compliance
aws configservice get-compliance-details-by-config-rule \
  --config-rule-name s3-bucket-public-read-prohibited

# List non-compliant resources
aws configservice describe-compliance-by-config-rule \
  --compliance-types NON_COMPLIANT

# Custom rule (Lambda-backed)
# Example: Check if EC2 instances have specific tags
aws configservice put-config-rule \
  --config-rule '{
    "ConfigRuleName": "required-tags",
    "Source": {
      "Owner": "CUSTOM_LAMBDA",
      "SourceIdentifier": "arn:aws:lambda:us-east-1:123456789012:function:config-rule-tags"
    }
  }'

# Assign a built-in policy
az policy assignment create \
  --name "audit-sql-encryption" \
  --policy "SQL Managed Instance encryption at rest using your own key" \
  --assign-identity \
  --location eastus

# Assign a custom policy (from JSON file)
az policy definition create \
  --name "require-resource-group-tags" \
  --rules policy-definition.json \
  --display-name "Require specific tags on resource groups"

az policy assignment create \
  --name "require-tags" \
  --policy "require-resource-group-tags" \
  --params '{"tagName": {"value": "Environment"}}'

# AWS: Auto-remediate public S3 buckets with AWS Config + SSM
# 1. Config detects public S3 bucket
# 2. Config rule triggers Lambda function
# 3. Lambda applies block public access setting

# Lambda (Python) for auto-remediation: S3 Block Public Access
import boto3

def lambda_handler(event, context):
    s3 = boto3.client('s3')
    bucket_name = event['detail']['resourceId']

    # Apply block public access
    s3.put_public_access_block(
        Bucket=bucket_name,
        PublicAccessBlockConfiguration={
            'BlockPublicAcls': True,
            'IgnorePublicAcls': True,
            'BlockPublicPolicy': True,
            'RestrictPublicBuckets': True
        }
    )

    # Log the remediation
    print(f"Applied Block Public Access to {bucket_name}")
    return {"status": "remediated", "bucket": bucket_name}

# Install ScoutSuite
pip install scoutsuite

# Run against AWS
scout aws --access-keys --access-key-id AKIA... --secret-access-key ...

# Run against Azure
scout azure --cli

# Run against GCP
scout gcp --service-account /path/to/service-account.json

# Generate HTML report (automatically created after scan)
# Open: scoutsuite-report/scoutsuite-report.html

# Install Prowler
pip install prowler

# Run all checks
prowler aws

# Run specific categories
prowler aws --group iam
prowler aws --group s3
prowler aws --group ec2

# Output formats
prowler aws -o json  # Machine-readable for SIEM ingestion
prowler aws -o html  # Human-readable report
prowler aws -o csv   # Spreadsheet for compliance tracking

# Run against a specific profile
prowler aws -p production --region us-east-1

# Check specific CIS benchmark controls
prowler aws --checks "cis_1.1,cise_1.2,cise_1.3,cise_1.4,cise_1.5"

# Create an AWS Config rule that auto-remediates public S3 buckets
aws configservice put-config-rule \
  --config-rule '{
    "ConfigRuleName": "s3-bucket-public-read-prohibited",
    "Source": {
      "Owner": "AWS",
      "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
    }
  }'

# Create auto-remediation action
aws configservice put-remediation-configuration \
  --config-rule-name "s3-bucket-public-read-prohibited" \
  --remediation-configuration '{
    "TargetType": "SSM_DOCUMENT",
    "TargetId": "AWS-EnableS3BucketEncryption",
    "Parameters": {
      "AutomationAssumeRole": {"StaticValue": {"Values": ["arn:aws:iam::123456789:role/config-remediation"]}}
    },
    "Automatic": true,
    "MaximumAutomaticAttempts": 3,
    "RetryAttemptSeconds": 60
  }'

# Create an Azure Policy that blocks public network access on storage accounts
az policy definition create \
  --name "deny-storage-public-access" \
  --rules '{
    "if": {
      "allOf": [
        {"field": "type", "equals": "Microsoft.Storage/storageAccounts"},
        {"field": "Microsoft.Storage/storageAccounts/allowBlobPublicAccess", "equals": true}
      ]
    },
    "then": {"effect": "deny"}
  }'

# Assign policy at subscription scope
az policy assignment create \
  --name "deny-storage-public-access" \
  --policy "deny-storage-public-access" \
  --scope "/subscriptions/{subscription-id}"