CLI Reference
Command Flags
Complete reference of all Cloudsploit command-line flags. Configure scan scope, output, performance, and advanced options.
Basic Scan Command
The basic structure of a Cloudsploit scan:
bash
1cloudsploit scan [provider] [options]
Info
Omit the provider to scan all configured cloud accounts, or specify one or more:
aws, azure, gcpScan Control Flags
| Flag | Arguments | Description |
|---|---|---|
--provider / -p | [aws|azure|gcp|all] | Cloud provider to scan (default: all configured) |
--regions / -r | comma,separated,list | Specific regions to scan (AWS/Azure/GCP) |
--exclude-regions | comma,separated,list | Regions to skip |
--services / -s | comma,separated,list | Only scan specific services (e.g., s3,ec2,iam) |
--exclude-services | comma,separated,list | Skip specified services |
--suppress | DETECTOR_ID1,DETECTOR_ID2 | Suppress specific detector IDs (comma-separated) |
--suppress-file | /path/to/file.txt | File containing detector IDs to suppress (one per line) |
--severity | critical,high,medium,low | Only report findings at or above this severity |
--output / -o | [table|json|csv|html|junit] | Output format (default: table) |
--outfile | /path/to/file.ext | Write output to specified file |
--config | /path/to/config.json | Path to custom configuration file |
--profile | profile_name | AWS/Azure profile name to use |
--account-name | "Account Label" | Friendly name for cloud account in reports |
--threads / -t | NUMBER | Number of concurrent scan threads (default: 10) |
--timeout | MILLISECONDS | API call timeout (default: 30000) |
--retry | NUMBER | Number of retries for failed API calls (default: 3) |
--rate-limit | NUMBER | API calls per second limit per region |
--quick | Run quick scan with common detectors only | |
--comprehensive | Run all detectors across all regions | |
--compliance | [cis|nist|pci|hipaa] | Run compliance-specific checks only |
--dry-run | Show what would be scanned without executing | |
--list-detectors | List all available detectors and exit | |
--list-resources | List discovered resources without scanning | |
--help / -h | Show help message | |
--version / -v | Show version number |
Global Flags
These flags apply to all Cloudsploit commands:
| Flag | Arguments | Description |
|---|---|---|
--verbose / -v | Enable verbose logging (show API calls, debug info) | |
--quiet / -q | Suppress non-essential output (only show findings) | |
--no-color | Disable colored output in terminal | |
--log-file | /path/to/cloudsploit.log | Write detailed logs to specified file |
--proxy | http://proxy:port | HTTP proxy for API calls |
--ca-cert | /path/to/cert.pem | Custom CA certificate bundle |
Common Combinations
Practical examples combining multiple flags:
Quick AWS Audit
bash
1cloudsploit scan aws --quick --output html --outfile audit.html
Fast scan with common detectors, HTML report output
Production Scan (All AWS Regions)
bash
1cloudsploit scan aws --severity high,critical --threads 20 --output json --outfile prod-scan.json
Only high/critical findings, multi-threaded, JSON output
CI/CD Pipeline Scan
bash
1cloudsploit scan aws --compliance cis --output junit --outfile results.xml --quiet
CIS compliance only, JUnit for CI integration, minimal output
Exclude Known Safe Resources
bash
1cloudsploit scan aws --suppress-file ~/cloudsploit/suppressions.txt --exclude-regions us-gov-*
Skip known false positives and government regions