All Checks
cloud-audit runs 110 checks across 25 AWS services, plus 10 Threat Feed detectors for active-abuse patterns (run separately via cloud-audit threat-feed).
By Category
- Security: 98 checks
- Cost: 5 checks
- Reliability: 7 checks
By Service
| Service | Checks | Check IDs |
|---|---|---|
| IAM | 18 | aws-iam-001 through aws-iam-018 |
| CloudWatch | 16 | aws-cw-001 through aws-cw-016 |
| CloudTrail | 8 | aws-ct-001 through aws-ct-008 |
| S3 | 7 | aws-s3-001 through aws-s3-007 |
| Bedrock AgentCore | 6 | aws-agc-001 through aws-agc-006 |
| EC2 | 6 | aws-ec2-001 through aws-ec2-006 |
| VPC | 6 | aws-vpc-001 through aws-vpc-006 |
| Data Perimeter | 5 | aws-dp-001 through aws-dp-005 |
| Config | 4 | aws-cfg-001 through aws-cfg-004 |
| RDS | 4 | aws-rds-001 through aws-rds-004 |
| Lambda | 3 | aws-lambda-001 through aws-lambda-003 |
| SSM | 3 | aws-ssm-001 through aws-ssm-003 |
| ECS | 3 | aws-ecs-001 through aws-ecs-003 |
| SageMaker | 3 | aws-sagemaker-001 through aws-sagemaker-003 |
| DynamoDB | 3 | aws-ddb-001, aws-ddb-002, aws-ddb-003 |
| GuardDuty | 2 | aws-gd-001, aws-gd-002 |
| KMS | 2 | aws-kms-001, aws-kms-002 |
| Secrets Manager | 2 | aws-sm-001, aws-sm-002 |
| Bedrock | 2 | aws-bedrock-001, aws-bedrock-002 |
| Backup | 1 | aws-backup-001 |
| Inspector | 1 | aws-inspector-001 |
| WAF | 1 | aws-waf-001 |
| Account | 1 | aws-account-001 |
| EFS | 1 | aws-efs-001 |
| EIP | 1 | aws-eip-001 |
| Security Hub | 1 | aws-sh-001 |
Data Perimeter is a cross-cutting category (S3, SNS, SQS, Secrets Manager, and Lambda resource policies), so it reuses existing services rather than adding a new one to the count of 25.
New in v2.4.0
| Check ID | Service | Description |
|---|---|---|
| aws-dp-001 .. aws-dp-005 | Data Perimeter | Resource-policy confused-deputy and cross-org exposure (S3, SNS, SQS, Secrets Manager, Lambda), evaluating condition values |
| aws-agc-001 .. aws-agc-006 | Bedrock AgentCore | AI agent platform: PUBLIC network mode, MMDSv2 enforcement, memory encryption, gateway authorizer and policy engine |
Also new: Proof Mode (cloud-audit scan --verify) confirms IAM escalation paths against the IAM policy simulator (read-only). See Proof Mode.
New in v2.3.1
| Check ID | Service | Description |
|---|---|---|
| aws-ddb-001 | DynamoDB | Encryption at rest visibility (tiered LOW/HIGH/CRITICAL) |
| aws-ddb-002 | DynamoDB | Point-in-time recovery enabled |
| aws-ddb-003 | DynamoDB | Autoscaling on PROVISIONED billing tables |
| aws-cfg-003 | Config | Recording group records all supported resource types |
| aws-cfg-004 | Config | Delivery channel exists and is properly configured |
| aws-s3-004 (enhanced) | S3 | Smart lifecycle cross-check with bucket versioning state |
New in v2.0.0
| Check ID | Service | Description |
|---|---|---|
| aws-iam-018 | IAM | IAM privilege escalation paths detected |
| aws-bedrock-001 | Bedrock | Model invocation logging disabled |
| aws-bedrock-002 | Bedrock | Guardrails not configured |
| aws-sagemaker-001 | SageMaker | Notebook instance root access enabled |
| aws-sagemaker-002 | SageMaker | Notebook instance direct internet access |
| aws-sagemaker-003 | SageMaker | Training data encryption disabled |
Design Philosophy
Every check answers one question: would an attacker exploit this?
If not, the check does not exist. cloud-audit optimizes for signal over noise: curated checks that matter are more useful than generic checks that cause alert fatigue.