duo-labs/cloudmapper
Cloudmapper
Features
- AWS - Scans an AWS account for misconfigurations and security risks, presenting findings in an interactive graph.
- Cloud Resource Scanners - Identifies S3 buckets, ECR repositories, SQS queues, SNS topics, and Redshift clusters that are exposed to the public internet.
- Graph Relationship Modeling - Represents AWS resources and their relationships as a directed graph for visual exploration and security analysis.
- Multi-Service Public Exposure Auditors - Scans S3 buckets, ECR repos, SQS queues, SNS topics, and Redshift clusters for public exposure.
- Credential Auditors - Lists access keys and passwords that have not been used for a configurable period or have never been used.
- Data Collection Clients - Pulls account metadata and resource configurations directly through AWS SDK calls without requiring an agent.
- Cloud Infrastructure Visualization - Renders AWS resources and their relationships as an interactive graph for exploration and analysis.
- IAM Policy Auditors - Scans IAM policies against known flawed patterns and flags policies that allow unintended privilege escalation.
- IAM Policy Analyzers - Simulates policy evaluation paths to detect unintended permission chains that could allow privilege escalation.
- Static Security Auditing - Evaluates security settings by comparing collected resource states against predefined rules without runtime monitoring.
- Configuration Verifiers - Verifies that CloudTrail is enabled in all regions and that GuardDuty is active.
- Compliance and Monitoring - Checks AWS configurations against security best practices such as CloudTrail logging, GuardDuty activation, and MFA enforcement.
- Interactive Graph Visualizers - Renders the infrastructure graph in a browser using JavaScript for zooming, panning, and filtering relationships.
- Multi-Account Orchestration - Combines data from multiple AWS accounts into a unified view for cross-account security auditing.
- Compliance Checkers - Reports users who lack MFA, have password-only logins, or are protected by an incorrect MFA enforcement policy.
- Trust Policy Auditors - Warns when a role's trust policy allows assumption from any AWS account or from unexpected principals.
- AWS Security - Analysis tool for AWS environment security.
- Cloud Security - Analyzes AWS environments for security posture.
- Security Assessment Tools - Analyzes AWS environments for security and configuration issues.
