Aws Security Python Packages

checkov

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

policy-sentry

IAM Least Privilege Policy Generator

cloudsplaining

Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.

cfripper

Library and CLI tool for analysing CloudFormation templates and check them for security compliance.

replimap

AWS Infrastructure Intelligence Engine — scan brownfield AWS accounts, map every dependency, and turn ClickOps into import-ready Terraform. 100% local.

plexavo

AWS Cloud Security Posture & Misconfiguration Assessment Engine

airiam

Least privilege AWS IAM Terraformer

awsherlock

Open-source AWS security scanner for misconfigurations, multi-account environments, and standalone HTML reporting.

cloud-audit

Fast, opinionated AWS security scanner. Curated checks. Zero noise. Copy-paste fixes.

c7n-kit

Test Cloud Custodian policies offline, without AWS credentials. Compliance coverage with a denominator, and a classifier for what the run could not look at.

terrascan

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

festin

FestIn - Credentialless discovery and monitoring of exposed S3-compatible cloud storage from domains, DNS and web crawling.

cyntrisec

Historical AWS analysis CLI; not a current Cyntrisec product

aws-iam-utils

Python library for examining, creating and optimising IAM policies

untrust

A TEE deployment auditor for the trust boundaries attestation forgets — audits Nitro Enclave bootstrap state, KMS attestation, IAM, and host posture (33 checks).

awsxenos

AWSXenos will list all the trust relationships in all the IAM roles, S3 buckets, and more

kinnaird-utils

IAM Least Privilege Policy Generator

awsmap

A fast, comprehensive tool for mapping and inventorying AWS resources across 150+ services and all regions.

bedrock-keys-security

Detect phantom IAM users, decode leaked AWS Bedrock and Claude Platform API keys, and prevent LLMjacking. CLI + SCPs + SIEM detection rules.

preflight-cli

Read-only, open-source AWS audit you run on your own machine.

s3-security-scanner

AWS S3 security scanner: detect public access, weak bucket policies, missing encryption and compliance gaps across your buckets. Python CLI with multi-format reports.

cloudsecure

AWS security assessment platform with AI-powered analysis

ec2-security-scanner

AWS EC2 security scanner: 46 checks across 8 categories (IMDSv2, security groups, EBS encryption, public AMIs, IAM, patching), UserData secret detection, and compliance mapping for FSBP, CIS, PCI DSS, HIPAA, SOC 2, ISO 27001 and NIST.

lambda-security-scanner

AWS Lambda security scanner: 19 checks across 5 categories, secret detection in env vars, and compliance mapping for 10 frameworks (CIS, PCI DSS, HIPAA, SOC 2, ISO 27001, NIST). Multi-threaded scans with interactive HTML dashboards.