cloud-custodian
Test Cloud Custodian policies offline, without AWS credentials. Compliance coverage with a denominator, and a classifier for what the run could not look at.