API Keys & Settings

Configuration

Cloudsploit requires cloud provider credentials to scan your infrastructure. Configure authentication via environment variables, configuration files, or interactive prompts.

Configuration Methods

Cloudsploit supports multiple configuration methods, checked in this order:

1
Environment Variables
Set via AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, etc.
2
Cloudsploit Config File
~/.cloudsploit/config.json or --config flag
3
Cloud Provider Defaults
AWS CLI ~/.aws/credentials, Azure ~/.azure/credentials, GCP application default credentials

AWS Configuration

Configure AWS credentials using IAM access keys with appropriate permissions:

Method 1: Environment Variables

bash

1export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
2export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
3export AWS_REGION=us-east-1

Method 2: AWS Credentials File

Use the standard AWS credentials file at ~/.aws/credentials:

bash

1[default]
2aws_access_key_id = AKIAIOSFODNN7EXAMPLE
3aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
4region = us-east-1

Method 3: IAM Role (EC2/ECS/Lambda)

When running Cloudsploit on EC2, ECS, or Lambda, attach an IAM role with read-only permissions. No credentials needed - Cloudsploit automatically uses the instance profile.

Warning

Use read-only credentials for scans. Never use root account or admin-level credentials. Follow the principle of least privilege.

Azure Configuration

For Azure, use a service principal with Reader role at the subscription or management group level:

Create Service Principal

bash

1az ad sp create-for-rbac --name "cloudsploit-scanner" --role Reader --scopes /subscriptions/{subscription-id}

Set Environment Variables

bash

1export AZURE_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
2export AZURE_CLIENT_SECRET=your_client_secret
3export AZURE_TENANT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
4export AZURE_SUBSCRIPTION_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Or Use Azure CLI Credentials

If you're already logged in with az login, Cloudsploit will use those credentials automatically.

GCP Configuration

For Google Cloud, use a service account key with roles like Viewer, Security Viewer, or a custom role:

Create Service Account Key

bash

1gcloud iam service-accounts create cloudsploit-scanner \
2  --display-name "Cloudsploit Scanner"
3 
4gcloud projects add-iam-policy-binding {project-id} \
5  --member "serviceAccount:cloudsploit-scanner@{project-id}.iam.gserviceaccount.com" \
6  --role "roles/viewer"
7 
8gcloud iam service-accounts keys create ~/key.json \
9  --iam-account cloudsploit-scanner@{project-id}.iam.gserviceaccount.com

Set Environment Variable

bash

1export GOOGLE_APPLICATION_CREDENTIALS=~/key.json
2export GOOGLE_CLOUD_PROJECT=your-project-id

Configuration File

Create a configuration file at ~/.cloudsploit/config.json for persistent settings:

json

1{
2  "aws": {
3    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
4    "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
5    "region": "us-east-1",
6    "enabled": true
7  },
8  "azure": {
9    "clientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
10    "clientSecret": "your_secret",
11    "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
12    "subscriptionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
13    "enabled": false
14  },
15  "gcp": {
16    "keyFile": "/path/to/key.json",
17    "projectId": "your-project-id",
18    "enabled": false
19  },
20  "scan": {
21    "regions": ["us-east-1", "us-west-2"],
22    "services": ["s3", "ec2", "iam", "rds"],
23    "output": "json",
24    "suppress": ["S3_BUCKET_PUBLIC_READ"]
25  }
26}

Multiple Cloud Accounts

Scan multiple AWS accounts using organization-wide access or multiple credential sets:

bash

1# Using multiple profiles
2cloudsploit scan aws --profile prod-account
3cloudsploit scan aws --profile dev-account
4 
5# Or specify credentials directly
6AWS_ACCESS_KEY_ID=key1 AWS_SECRET_ACCESS_KEY=secret1 cloudsploit scan aws --account-name "Production"
7AWS_ACCESS_KEY_ID=key2 AWS_SECRET_ACCESS_KEY=secret2 cloudsploit scan aws --account-name "Development"

Next: Running Scans