AWS Security Auditor

A Python script that walks an AWS account and reports things that look wrong.

It checks IAM, EC2, S3, security groups, RDS, EBS, Lambda, and CloudTrail. Results go to JSON and an HTML file.

This is a lab. It is not an enterprise scanner.

Run it

Needs Python 3.8+, boto3, and AWS credentials already configured (aws configure or env vars).

pip install -r requirements.txt
python main.py --regions us-west-2 --format both

Useful flags:

python main.py --regions us-west-2,us-east-1 --checks ec2,s3,iam
python main.py --severity high --format json
python main.py --dry-run

Reports land in ./reports by default.

What it looks for

Area	Examples
EC2	public instances, open security groups
S3	public buckets, missing encryption
IAM	overly broad policies
RDS	public databases
EBS	unencrypted volumes
Lambda	risky roles
CloudTrail	logging turned off

Docker (optional)

docker build -t aws-security-auditor .
docker run -v ~/.aws:/root/.aws aws-security-auditor --regions us-west-2

No production secrets in this repo.