Security Check Reference

Detector Reference

Complete reference of all Cloudsploit security detectors. Each detector checks for a specific cloud misconfiguration and provides remediation guidance.

Understanding Detectors

Each Cloudsploit detector:

Checks a specific resource: Scans cloud resources (buckets, VMs, IAM, etc.)
Validates configuration: Compares settings against security benchmarks
Assigns severity: Critical, High, Medium, or Low based on risk
Provides remediation: Step-by-step fix instructions

Severity Levels

Critical

Immediate security risk requiring urgent attention. Public exposure, unrestricted access, or encryption disabled.

High

Significant security issue. Missing MFA, no backups, or missing logging.

Medium

Moderate risk. Configuration improvements, monitoring gaps.

Low

Informational or best practice recommendations.

Searchable Detector Table

All 35+ detectors across AWS, Azure, and GCP:

ID	Provider	Severity	Category	Description
`IAM_PASSWORD_POLICY`	AWS	HIGH	IAM	IAM password policy does not meet complexity requirements
`IAM_NO_ROOT_ACCESS_KEY`	AWS	CRITICAL	IAM	Root account has active access keys
`IAM_USERS_WITH_PASSWORD`	AWS	MEDIUM	IAM	IAM users have console passwords without MFA
`IAM_MFA_ENABLED`	AWS	HIGH	IAM	MFA not enabled for IAM users with passwords
`S3_BUCKET_PUBLIC_READ`	AWS	CRITICAL	Storage	S3 bucket allows public read access
`S3_BUCKET_PUBLIC_WRITE`	AWS	CRITICAL	Storage	S3 bucket allows public write access
`S3_BUCKET_ENCRYPTION_DISABLED`	AWS	HIGH	Storage	S3 server-side encryption not enabled
`S3_BUCKET_LOGGING_DISABLED`	AWS	LOW	Storage	S3 access logging not enabled
`EBS_VOLUME_UNENCRYPTED`	AWS	HIGH	Storage	EBS volume lacks encryption
`EC2_SECURITY_GROUP_OPEN_TO_WORLD`	AWS	HIGH	Compute	Security group allows 0.0.0.0/0
`EC2_SECURITY_GROUP_UNRESTRICTED_SSH`	AWS	HIGH	Compute	Port 22 open to internet
`EC2_SECURITY_GROUP_UNRESTRICTED_RDP`	AWS	HIGH	Compute	Port 3389 open to internet
`RDS_INSTANCE_PUBLICLY_ACCESSIBLE`	AWS	CRITICAL	Database	RDS accessible from internet
`RDS_INSTANCE_STORAGE_ENCRYPTED`	AWS	HIGH	Database	RDS storage not encrypted
`CLOUDTRAIL_ENABLED`	AWS	HIGH	Monitoring	CloudTrail not enabled
`CLOUDTRAIL_LOG_VALIDATION_ENABLED`	AWS	MEDIUM	Monitoring	CloudTrail log validation disabled
`KMS_KEY_ROTATION_ENABLED`	AWS	MEDIUM	Security	KMS key automatic rotation disabled
`AZURE_AD_PASSWORD_POLICY`	Azure	HIGH	IAM	Azure AD password policy is weak
`AZURE_AD_MFA_ENFORCEMENT`	Azure	HIGH	IAM	MFA not enforced for all users
`STORAGE_ACCOUNT_PUBLIC_ACCESS`	Azure	CRITICAL	Storage	Storage account allows public blob access
`STORAGE_ACCOUNT_SECURE_TRANSFER`	Azure	HIGH	Storage	HTTPS-only not enforced
`VM_PUBLIC_IP_ADDRESS`	Azure	MEDIUM	Compute	VM has public IP address
`VM_DISK_ENCRYPTION`	Azure	HIGH	Compute	VM disks not encrypted
`SQL_SERVER_AUDITING`	Azure	HIGH	Database	SQL Server auditing disabled
`SQL_SERVER_ENCRYPTION`	Azure	HIGH	Database	Transparent Data Encryption disabled
`KEY_VAULT_SOFT_DELETE`	Azure	HIGH	Security	Key Vault soft delete disabled
`AKS_RBAC_ENABLED`	Azure	HIGH	Kubernetes	RBAC not enabled for AKS
`GCP_IAM_PASSWORD_POLICY`	GCP	HIGH	IAM	Organization password policy missing
`GCP_IAM_2SV`	GCP	HIGH	IAM	2-Step verification not enforced
`GCS_PUBLIC_ACCESS`	GCP	CRITICAL	Storage	Cloud Storage bucket publicly accessible
`GCS_VERSIONING`	GCP	LOW	Storage	Object versioning not enabled
`GCE_PUBLIC_IP`	GCP	MEDIUM	Compute	Compute Engine has external IP
`GCE_SHIELDED_VM`	GCP	MEDIUM	Compute	Shielded VM features disabled
`CLOUD_SQL_PUBLIC_IP`	GCP	CRITICAL	Database	Cloud SQL accessible publicly
`CLOUD_FUNCTION_PUBLIC_ACCESS`	GCP	HIGH	Serverless	Cloud Function allows unauthenticated access

Custom Detectors

Write your own detectors in JavaScript to check for organization-specific requirements:

javascript

1module.exports = {
2  name: "CUSTOM_TAG_REQUIRED",
3  description: "All EC2 instances must have Owner tag",
4  category: "Compute",
5  severity: "MEDIUM",
6 
7  async run(provider) {
8    const ec2 = provider.getClient('ec2');
9    const instances = await ec2.describeInstances();
10 
11    for (const instance of instances.Reservations.flatMap(r => r.Instances)) {
12      const hasOwnerTag = instance.Tags?.some(t => t.Key === 'Owner');
13      if (!hasOwnerTag) {
14        this.addIssue(
15          'Instance ' + instance.InstanceId + ' missing Owner tag',
16          instance.InstanceId,
17          'Add Owner tag to instance'
18        );
19      }
20    }
21  }
22};

Save custom detectors to ~/.cloudsploit/detectors/ and enable with --custom-dir.

Next: Command Flags