DEV Community

Mariusz Gębala
Mariusz Gębala

Posted on • Originally published at haitmg.pl

5 Open-Source AWS Security CLI Tools Worth Trying in 2026

#aws #security #devops #opensource

TL;DR

In the context of security, even today, there's a shortage of tools for everything. Prowler has a ton of checks. Trivy is the most well-known tool for containers and clouds. CloudFox is a tool for pentesters. Heimdall focuses on IAM privilege escalation. cloud-audit correlates findings, assembles them into a single attack chain, and provides fixes for implementation via Terraform or the CLI.

There's something for everyone - it's important to choose the right one for your work style.

The landscape

Have you ever wondered that in today's technological age, a tool that could do everything for us would be useful? You know, literally everything. We'll wake up in the morning and an automatically generated list will appear on our laptop, like, "Do this project today, use this AI agent, and then we'll post it here and there - it will bring you success, fame, and money." However, I now believe that even the most refined LLM model won't replace creativity and real human needs.

Based on the above, I've concluded that security scanning in AWS isn't as straightforward as it seems. Let's answer the question together - do you know what you want to check and what to do with the results provided in the report?

There are tools that optimize the overview of our environment in terms of breadth - scanning 500+ rules across multiple clouds. Others, however, prepare information for depth optimization, searching in a smaller area but with much greater depth. Still others try to combine both horizons as optimally as possible. Is it possible to create a perfect tool that is free of noise and precisely meets the requirements of every administrator? In my opinion, no.

In this article, I'd like to present five CLI tools that I've personally tested, so I hope to provide an unbiased opinion on them (all as of April 2, 2026). If you want a deeper dive into how Prowler and ScoutSuite stack up against cloud-audit, I wrote a detailed comparison on my blog.

1. Prowler

Stars: over 13k | Checks: >550 (AWS) | Language: Python
GitHub: prowler-cloud/prowler
Install: pip install prowler

Anyone responsible for AWS environment security (and others) is likely familiar with Prowler. It's by far the most popular open-source scanner. 572 AWS checks across 84 services and 41 compliance standards (CIS, SOC 2, HIPAA, PCI-DSS, NIST 800-53, and many more). If your auditor asks, "Are you using Prowler?" - that's a sign that it's popular.

Advantages:

  • The widest range of compliance among all OSS tools
  • Multi-cloud: AWS, Azure, GCP, Kubernetes, and others
  • Active development, large community, commercial support
  • HTML, CSV, JSON-OCSF, SARIF output

Where are the shortcomings:

  • Scan time: 10-30 minutes on a standard account (572 checks take time)
  • Attack path detection exists, but requires Prowler App (self-hosted Docker Compose + Neo4j + Cartography) or paid SaaS. The standard Prowler AWS CLI provides only simple results
  • Remediation is performed using text hints, not copy-and-paste commands
  • 572 findings can be cumbersome - you need to know which ones are relevant

Best for: Compliance-focused teams that need to check the box for CIS/SOC 2/HIPAA/PCI-DSS.

pip install prowler
prowler aws
Enter fullscreen mode Exit fullscreen mode

2. Trivy

Stars: > 34k | AWS Checks: ~350-450 | Language: Go
GitHub: aquasecurity/trivy
Install: brew install trivy

This is an interesting resource. Trivy was initially designed for container vulnerability scanning, but later expanded to include cloud misconfiguration scanning. A key differentiator is the single binary that covers everything - container images, IaC files (Terraform, CloudFormation), Kubernetes, SBOM, licenses, and active AWS accounts.

What it does well:

  • A single binary covers containers + IaC + cloud + secrets + SBOM
  • Fast, Go-based
  • Huge community (34k stars)
  • CycloneDX and SPDX output for supply chain

Where it falls short:

  • AWS cloud scanning seems secondary to container scanning
  • No attack chain detection - no correlation between findings
  • Links to documentation pages for fixes, no CLI/Terraform output
  • AWS CIS compliance limited to versions 1.2 and 1.4 (not 3.0)
  • The March 2026 supply chain attack (trivy's GitHub Action was compromised for about 12 hours) raised trust issues

Best for: Teams already using Trivy for containers and want a single tool for everything.

trivy aws --region eu-central-1
Enter fullscreen mode Exit fullscreen mode

3. CloudFox

Stars: >2300 | Commands: 24 AWS enumeration modules | Language: Go
GitHub: BishopFox/cloudfox
Install: brew install cloudfox

Here we're dealing with a slightly different type of tool. This isn't a typical scanner, it's a tool for cloud penetration testers. It's a reconnaissance tool that enumerates what an attacker with given credentials can actually do - which roles to assume, which secrets to read, which instances to reach.

What it excels at:

  • An attacker's perspective, not a defender's checklist
  • Enumeration across accounts and services
  • Generates "loot files" - ready-to-use commands that an attacker could run
  • Good for red teams/penetration

Where it falls short:

  • No checks, no rules, no findings - just raw enumeration data
  • No suggestions for remediation or fixes
  • No compliance framework
  • No HTML/PDF reports - just table and CSV output
  • Requires manual analysis to connect facts to attack paths

Best for: Penetration testers and red teams assessing what can actually be accessed with permissions.

cloudfox aws --profile target-account all-checks
Enter fullscreen mode Exit fullscreen mode

4. Heimdall

Stars: >140 | Patterns: >50 IAM escalations, >85 attack chains | Language: Python
GitHub: DenizParlak/heimdall
Install: from source (pip install -e .)

Heimdall primarily focuses on IAM privilege escalation. It checks whether a user with limited privileges could accidentally become an administrator. It maps trust relationships between IAM roles, policies, and services to find multi-hop escalation paths (A assumes B, B has a PassRole to C, C is an administrator).

What it does well:

  • Focuses on a difficult problem (privilege escalation) that most scanners miss
  • Over 85 attack chain patterns with MITRE ATT&CK mapping
  • Multi-hop detection (not just direct admin access)
  • Interactive terminal user interface
  • Ability to scan Terraform before deployment

Where it falls short:

  • Last commit: December 2025 (appears outdated)
  • No pip installation - cloning and installing from source required
  • Lack of compliance frameworks (CIS, SOC 2, etc.)
  • No remediation commands
  • Small community (146 stars, 4 commits)
  • AWS only

Best for: IAM-focused security reviews where the question "who can become an admin?" needs to be answered.

git clone https://github.com/DenizParlak/heimdall
cd heimdall && pip install -e .
heimdall scan
Enter fullscreen mode Exit fullscreen mode

5. cloud-audit

Stars: >30 | Checks: 80 | Language: Python
GitHub: gebalamariusz/cloud-audit
Install: pip install cloud-audit
Website: haitmg.pl/cloud-audit

I created this tool. I tried to gather everything I needed most for my work. I used to conduct the same security reviews at AWS, but I was missing one tool that would truly streamline my work, hence the idea. I needed a scanner that would show how findings connect to actual attack paths, not just a flat list.

What it does well:

  • 20 attack chain rules that correlate findings (e.g., public SG + IMDSv1 + admin role = account takeover path)
  • Each finding includes AWS CLI + Terraform remediation code, not just descriptions
  • Compliance with AWS CIS v3.0 (62 checks) and SOC 2 Type II (43 criteria) with evidence for each check
  • Breach cost estimation per finding and attack chain (sources cited: IBM, Verizon DBIR)
  • Scan diff to track drift between runs
  • MCP server for AI agent integration (Claude, Cursor)
  • Under 60 seconds on a standard account

Where it falls short:

  • 80 checks compared to 572 in Prowler - smaller coverage
  • AWS only
  • Small community (31 stars)
  • Newer and less battle-tested
  • No multi-cloud

Best for: Teams that need fewer, high-signal findings with attack context and ready-to-paste fixes.

If you want to see it in action, here's a 4-minute walkthrough on YouTube where I scan a real AWS account and find 3 attack chains.

pip install cloud-audit
cloud-audit scan -R
Enter fullscreen mode Exit fullscreen mode

Side-by-side comparison

Prowler Trivy CloudFox Heimdall cloud-audit
AWS checks 572 ~400 24 commands 50+ patterns 80
Attack chains App only No No Yes (85+) Yes (20)
Remediation Text Doc links No No CLI + Terraform
Compliance 41 frameworks CIS 1.2/1.4 None MITRE only CIS v3.0, SOC 2
Multi-cloud Yes (12+) Yes Yes (3) No No
Scan time 10-30 min 2-5 min 1-3 min 1-2 min <60 sec
Output HTML, CSV, SARIF, JSON Table, SARIF, SPDX Table, CSV, JSON SARIF, CSV, JSON HTML, SARIF, JSON, MD
Cost estimation No No No No Yes

What I would actually use

For a compliance audit: Prowler. Nothing else comes close on framework coverage.

For a pentest: CloudFox. It thinks like an attacker.

For container + cloud in one pipeline: Trivy. Single binary, single CI step.

For a quick "what can an attacker actually do with my account": cloud-audit or Heimdall. Depends on whether you want IAM escalation depth (Heimdall) or broader attack chains with fixes (cloud-audit).

There is no reason to pick just one. I run Prowler for compliance evidence and cloud-audit for the attack chain context and fix code. They complement each other.

If you're looking for a more detailed breakdown of how these tools compare on specific AWS security checks, I covered that in my AWS Security Scanners Compared article. And if you're setting up security scanning in CI/CD, check out the AWS Security Audit Checklist for a step-by-step approach.

Tools and star counts verified as of April 2026. Check each project's GitHub for the latest.

Top comments (0)