Uses ScoutSuite to audit AWS accounts: enumerates resources across services, detects misconfigurations, generates interactive HTML reports.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
ScoutSuite 是由 NCC Group 开发的开源多云安全审计工具，能够对 AWS 环境进行全面的安全态势评估。它通过查询 AWS API 收集所有服务的配置数据，将结果存储在本地，并生成交互式 HTML 报告以突出显示高风险区域。ScoutSuite 是无代理的，通过分析云资源的配置方式、访问方式和监控方式来工作。
Audits AWS accounts with ScoutSuite to enumerate resources, detect misconfigurations, and generate interactive HTML security reports. For cloud security assessments and audits.
Audits AWS accounts with ScoutSuite to enumerate resources, detect misconfigurations, and generate interactive HTML security reports. For cloud security assessments.
Audits AWS security posture using AWS CLI commands to check IAM policies, unused users, open security groups, public S3 buckets, encryption status, CloudTrail, and monitoring.
Share bugs, ideas, or general feedback.
ScoutSuite 是由 NCC Group 开发的开源多云安全审计工具，能够对 AWS 环境进行全面的安全态势评估。它通过查询 AWS API 收集所有服务的配置数据，将结果存储在本地，并生成交互式 HTML 报告以突出显示高风险区域。ScoutSuite 是无代理的，通过分析云资源的配置方式、访问方式和监控方式来工作。
pip install scoutsuite
scout --version
aws configure
# 或使用环境变量：
export AWS_ACCESS_KEY_ID=<your-key>
export AWS_SECRET_ACCESS_KEY=<your-secret>
export AWS_DEFAULT_REGION=us-east-1
将 AWS 托管策略 SecurityAudit 和 ViewOnlyAccess 附加到运行 ScoutSuite 的 IAM 用户或角色。如需全面扫描，可能需要自定义策略：
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"acm:Describe*",
"acm:List*",
"cloudformation:Describe*",
"cloudformation:Get*",
"cloudformation:List*",
"cloudtrail:Describe*",
"cloudtrail:Get*",
"cloudtrail:List*",
"cloudwatch:Describe*",
"cloudwatch:Get*",
"cloudwatch:List*",
"config:Describe*",
"config:Get*",
"config:List*",
"dynamodb:Describe*",
"dynamodb:List*",
"ec2:Describe*",
"ec2:Get*",
"elasticloadbalancing:Describe*",
"iam:Generate*",
"iam:Get*",
"iam:List*",
"iam:Simulate*",
"kms:Describe*",
"kms:Get*",
"kms:List*",
"lambda:Get*",
"lambda:List*",
"logs:Describe*",
"logs:Get*",
"rds:Describe*",
"rds:List*",
"redshift:Describe*",
"route53:Get*",
"route53:List*",
"s3:Get*",
"s3:List*",
"ses:Get*",
"ses:List*",
"sns:Get*",
"sns:List*",
"sqs:Get*",
"sqs:List*",
"ssm:Describe*",
"ssm:Get*",
"ssm:List*"
],
"Resource": "*"
}
]
}
scout aws
scout aws --services s3 iam ec2 rds
scout aws --regions us-east-1 us-west-2 eu-west-1
scout aws --profile target-account-profile
scout aws --skip iam ec2
scout aws --report-dir /tmp/scoutsuite-reports/
ScoutSuite 生成本地存储的交互式 HTML 报告，包含以下内容：
| 服务 | 关键检查项 |
|---|---|
| IAM | 根账户 MFA、密码策略、未使用的凭据、过度授权的策略 |
| S3 | 公开桶、未加密桶、禁用版本控制、禁用日志记录 |
| EC2 | 允许 0.0.0.0/0 的安全组、未加密 EBS 卷、公网 IP |
| RDS | 公开访问性、未加密数据库、备份保留 |
| CloudTrail | 日志记录禁用、日志文件验证、多区域禁用 |
| Lambda | 公开访问、环境变量中的密钥、VPC 配置 |
# 在 CI/CD 流水线中运行 ScoutSuite，发现危险级别时失败
scout aws --services s3 iam ec2 --no-browser --report-dir ./scout-report/
# 以编程方式解析结果
python -c "
import json
with open('./scout-report/scoutsuite-results/scoutsuite_results.json') as f:
results = json.load(f)
for service in results.get('services', {}):
findings = results['services'][service].get('findings', {})
for finding_id, finding in findings.items():
if finding.get('flagged_items', 0) > 0 and finding.get('level') == 'danger':
print(f'严重: {finding_id} - {finding.get(\"description\", \"\")}')
"
ScoutSuite 使用相同框架支持多个云提供商：
# Azure
scout azure --cli
# GCP
scout gcp --user-account
# AWS（使用特定配置文件）
scout aws --profile production