Cis Benchmark Python Packages

prowler

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

compose-lint

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.

prowler-cloud

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

vmware-harden

AI-native VMware compliance and baseline enforcement (CIS, vSphere SCG, 等保 2.0, PCI-DSS) — sibling to vmware-* skill family

dockerdna

Layer-by-Layer Container Security DNA Analysis — secrets detection, docker-compose scanning, CIS Docker Benchmark compliance, SBOM (CycloneDX), and SARIF output.

apotrope

Offline, single-executable Windows security posture auditor. 50+ CIS-mapped checks, a 0–100 score, and a self-contained HTML report. No cloud, no agent. MIT.

ohbs-image

CIS-hardened golden image builder for Tencent Cloud CVM — config-driven CLI, 13 OS profiles (Ubuntu/RHEL/TencentOS/Windows), bundled CIS engine, Packer + Ansible

ec2-security-scanner

AWS EC2 security scanner: 46 checks across 8 categories (IMDSv2, security groups, EBS encryption, public AMIs, IAM, patching), UserData secret detection, and compliance mapping for FSBP, CIS, PCI DSS, HIPAA, SOC 2, ISO 27001 and NIST.

lambda-security-scanner

AWS Lambda security scanner: 19 checks across 5 categories, secret detection in env vars, and compliance mapping for 10 frameworks (CIS, PCI DSS, HIPAA, SOC 2, ISO 27001, NIST). Multi-threaded scans with interactive HTML dashboards.

sar-aws-faultline

Find the security gaps in your AWS account, ranked by what to fix first.

bakex

Declarative OS hardening (formerly Stratum / stratumoss) — turn a YAML blueprint into a CIS/STIG-benchmarked, multi-cloud golden image. Apache-2.0, automation- and AI-agent-friendly.

cis-image

CIS-hardened golden image builder for Tencent Cloud CVM — config-driven CLI, 13 OS profiles (Ubuntu/RHEL/TencentOS/Windows), bundled CIS engine, Packer + Ansible

stratumoss

Declarative OS hardening (formerly Stratum / stratumoss) — turn a YAML blueprint into a CIS/STIG-benchmarked, multi-cloud golden image. Apache-2.0, automation- and AI-agent-friendly.

ecs-eks-security-scanner

AWS ECS/EKS security scanner: 45 checks across 8 categories (privileged containers, secrets in task defs, public endpoints, control-plane logging, IAM), compliance mapping for 11 frameworks

iam-security-scanner

AWS IAM security scanner: 44 checks across 7 categories (privilege escalation, confused-deputy trust, MFA, key rotation, least privilege), compliance mapping for 10 frameworks

rds-security-scanner

AWS RDS/Aurora security scanner: 53 checks across 7 categories (encryption, TLS enforcement, public access, IAM auth, backups, Multi-AZ), compliance mapping for 10 frameworks

egida

Automatically deploying highly secure infraestructures with early error detection