CloudSploit is a cloud security posture management tool that scans cloud infrastructure accounts for security risks and misconfigurations.
The tool detects potential security problems across multiple cloud providers by analyzing account configurations against security best practices. It works by running a series of plugins that examine cloud resources and return findings indicating misconfigurations or risks. The tool requires only read-only access to cloud accounts and can be deployed either self-hosted or through a commercial hosted version.
CloudSploit supports Amazon Web Services, Microsoft Azure, Google Cloud Platform, Oracle Cloud Infrastructure, and GitHub. It is suitable for teams that need to audit cloud infrastructure security posture and identify configuration issues. The tool offers multiple output formats including console output, CSV, JSON, and JUnit XML, and supports compliance frameworks such as HIPAA, PCI, and CIS Benchmarks. Users can suppress specific findings, run individual plugins, and configure which checks to execute. The self-hosted version requires Node.js and can use cloud provider credentials from multiple sources including credential files, environment variables, and the AWS credential chain.
The project maintains active development with regular plugin additions and improvements. The codebase shows consistent updates to support new security checks across all supported cloud platforms. Documentation is comprehensive, covering configuration for each cloud provider and deployment options. The tool has an extensible architecture that allows users to write custom plugins for additional security checks.
