Cloud Security Python Packages

cloudsplaining

Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.

agent-bom

Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.

plexavo

AWS Cloud Security Posture & Misconfiguration Assessment Engine

vamp-k8s-audit

Kubernetes security auditor — RBAC, pods, network, CIS Benchmark YAML engine (44+ checks), kube-bench wrapper, --delta diff scan

deluluscan

AI-augmented, evidence-first security auditor for authorized testing — web, API, LLM/AI, container, cloud & source code. Pluggable AI (Claude/OpenAI/DeepSeek/Ollama), agentic exploitation, deep verification, multi-format reports. AGPL-3.0.

awsherlock

Open-source AWS security scanner for misconfigurations, multi-account environments, and standalone HTML reporting.

ventra

Cloud forensic triage for AWS, Azure, GCP and Kubernetes

cloud-audit

Fast, opinionated AWS security scanner. Curated checks. Zero noise. Copy-paste fixes.

cleancloud

The cloud hygiene platform - including AI and GPU infrastructure

stackql-mcp-server

Query, provision and operate Cloud, SaaS, API and Model Context Protocol (MCP) resources through a unified SQL-based framework for humans and AI agents.

horustrace

Open-source static security analysis for agentic systems, with dependency graphs, capability tracing, MCP analysis and attack-path detection.

consoleme

A Central Control Plane for AWS Permissions and Access

vamp-cloud-enum

VampSecure Labs — Enumerador de buckets cloud públicos (S3/Azure/GCP)

c7n-kit

Test Cloud Custodian policies offline, without AWS credentials. Compliance coverage with a denominator, and a classifier for what the run could not look at.

vamp-gcp-audit

Google Cloud Platform security auditor — IAM, GCS, GKE, Cloud Functions, Firewall, project config. REST API only, no GCP SDKs.

terrascan

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

kulshan

Local-first AWS cost analysis and evidence CLI. Read-only by construction.

vamp-azure-audit

Microsoft Azure security auditor — IAM, Storage, AKS, App Services, NSG, Key Vault, Defender. REST API only.

arnmatch

Most complete AWS ARN parser. Automatically generated from AWS docs to map 2,100+ resources to CloudFormation, Tagging API, and boto3.

kosty

Scan 30+ AWS services. Find cost waste. Detect security gaps. Map your attack surface. One command.

aws-allowlister

Automatically compile an AWS Service Control Policy that ONLY allows AWS services that are compliant with your preferred compliance frameworks.

yubel

Cloud-native, multi-target DAST orchestrator — one config runs ZAP, Nuclei, Nikto, testssl.sh, dalfox, schemathesis, kube-hunter and more against web, APIs, cloud, containers and Kubernetes. Cross-engine correlation, attack-chain synthesis, deterministic evidence trail and air-gapped mode.

chainbreak

Cloud authorization benchmark for AWS IAM/STS: permission drift, revocation and stale authority, with Terraform infrastructure and reproducible evidence.

untrust

A TEE deployment auditor for the trust boundaries attestation forgets — audits Nitro Enclave bootstrap state, KMS attestation, IAM, and host posture (33 checks).