Cloud Security
Cloud Compliance Scanner
A Python/boto3 tool that audits any AWS account against CIS Benchmark controls — built once, reusable everywhere.
The problem
Every new AWS account meant re-running the same IAM, S3, CloudTrail, VPC, and KMS checks by hand, with no consistent baseline and no repeatable evidence trail for audits. Point-in-time manual review doesn't scale past one client account, and tribal knowledge about 'what to check' lived in one engineer's head instead of in code.
How it works
Architecture and flow, step by step.
- 1
Bootstrap credentials
Bootstrap credentials
The scanner assumes an IAM role (or reads a local profile) for the target AWS account — no hardcoded account IDs, so the same tool runs unmodified against any account.
- 2
Run the CIS control library
Run the CIS control library
boto3 walks each service — IAM, S3, CloudTrail, VPC, KMS — executing its CIS Benchmark checks independently, with no third-party scanning API in the loop.
- 3
Capture evidence
Capture evidence
Every check records pass/fail plus the raw API response that produced the verdict, so findings are auditable, not just asserted.
- 4
Aggregate & report
Aggregate & report
Findings roll up into a structured report grouped by severity and control category, ready to hand to a security reviewer.
- 5
Reuse on the next account
Reuse on the next account
Point the same scanner at a different AWS account and get the same baseline — no per-client forks to maintain.
Tech stack
Impact
The numbers that came out of it.
5
Control Categories
boto3 only
Scanning API
Any AWS account
Portability
CIS aligned
Benchmark
Key challenges & decisions
The non-obvious tradeoffs, and why they were made.
Account-agnostic by design
Hardcoding a role ARN or account ID would have made the tool a one-off. Assuming a role at runtime instead cost extra setup complexity, but is what made it reusable outside the original client account.
boto3-only checks over a paid scanning API
Kept the tool dependency-free and auditable line-by-line, at the cost of writing — and maintaining — each CIS control by hand instead of inheriting a vendor's rule set.
Evidence-first output
Storing the raw API response behind every finding roughly doubled report size, but turned 'the scanner says so' into something a security reviewer can actually verify.
This project's code isn't public yet.