Real-World Usage

Examples

Practical Cloudsploit commands for common security assessment scenarios. Copy, modify, and use these examples in your environment.

Common Use Cases

Complete AWS Account Audit

Scan entire AWS account across all regions with all detectors, save detailed report

bash

1cloudsploit scan aws \
2  --all-regions \
3  --output html \
4  --outfile ~/reports/aws-audit-$(date +%Y%m%d).html \
5  --account-name "Production AWS"

Runs all detectors globally
HTML report easy to share
Includes timestamp in filename

High-Risk Resource Quick Check

Fast scan for critical security issues in critical services only

bash

1cloudsploit scan aws \
2  --services s3,ec2,iam,rds \
3  --severity critical,high \
4  --threads 20 \
5  --output json

Limited to high-impact services
Only shows critical/high findings
Multi-threaded for speed

S3 Bucket Security Focus

Deep dive into S3 bucket security across all accounts

bash

1cloudsploit scan aws \
2  --services s3 \
3  --suppress S3_BUCKET_VERSIONING_DISABLED,S3_BUCKET_LOGGING_DISABLED \
4  --output csv \
5  --outfile s3-findings.csv

Focus on storage security
Suppress low-priority S3 findings
CSV for spreadsheet analysis

Azure Multi-Subscription Scan

Scan multiple Azure subscriptions with different service principal profiles

bash

1# Using Azure CLI credentials
2az login
3cloudsploit scan azure --all-subscriptions --output table
4 
5# Or using multiple profiles
6cloudsploit scan azure \
7  --profile dev-subscription \
8  --profile staging-subscription \
9  --profile production-subscription \
10  --output json --outfile azure-scan.json

Requires az CLI logged in
Can use different profiles per subscription
Consolidated report

GCP Project Compliance (CIS)

Run CIS benchmark checks only on GCP project

bash

1cloudsploit scan gcp \
2  --project-id my-gcp-project \
3  --compliance cis \
4  --output junit \
5  --outfile cis-results.xml

CIS GCP Foundations Benchmark
JUnit for CI/CD integration
Project-specific scan

CI/CD Pipeline Integration

Run in GitHub Actions/GitLab CI, fail on critical findings

bash

1#!/bin/bash
2# .github/workflows/security-scan.yml
3 
4- name: Cloud Security Scan
5  run: |
6    cloudsploit scan aws \
7      --services iam,s3,ec2 \
8      --severity critical \
9      --output json \
10      --outfile scan-results.json
11    
12    # Fail if critical issues found
13    if grep -q '"severity":"CRITICAL"' scan-results.json; then
14      echo "Critical security issues found!"
15      exit 1
16    fi

Only scan critical services
Grep JSON for critical severity
Exit non-zero to fail pipeline

Scheduled Daily Scan

Run automated daily scans with cron/Task Scheduler, email results

bash

1#!/bin/bash
2# /etc/cron.d/cloudsploit-daily
3 
40 6 * * * cloudsploit scan aws \
5  --quick \
6  --output html \
7  --outfile /var/reports/cloudsploit-$(date +%Y%m%d).html \
8  && mail -s "Daily Cloud Security Report" [email protected] < /var/reports/cloudsploit-$(date +%Y%m%d).html

Runs at 6 AM daily
Quick scan for speed
Email report to security team

Custom Detector Development

Write and test a custom detector for organization-specific policies

bash

1# 1. Create custom detector file
2cat > ~/.cloudsploit/detectors/custom-tag-check.js << 'EOF'
3module.exports = {
4  name: "REQUIRED_COST_CENTER_TAG",
5  description: "All resources must have CostCenter tag",
6  category: "Governance",
7  severity: "MEDIUM",
8  
9  async run(provider) {
10    const resources = await provider.getAllResources();
11    for (const res of resources) {
12      if (!res.tags?.CostCenter) {
13        this.addIssue(
14          `Resource ${res.id} missing CostCenter tag`,
15          res.id,
16          'Add CostCenter tag to resource'
17        );
18      }
19    }
20  }
21};
22EOF
23 
24# 2. Run scan with custom detector
25cloudsploit scan aws \
26  --custom-dir ~/.cloudsploit/detectors \
27  --services ec2,s3 \
28  --output json

JavaScript-based detector
Access to provider SDK
Can inspect any resource property

New Account Onboarding Scan

First-time scan of newly created AWS account with baseline assessment

bash

1cloudsploit scan aws \
2  --regions us-east-1,us-west-2,eu-west-1 \
3  --services iam,s3,ec2,cloudtrail,kms \
4  --output html \
5  --outfile onboarding-report.html \
6  --account-name "New AWS Account" \
7  --threads 5

Limited regions for initial assessment
Focus on foundational services
Gentle thread count to avoid API throttling

False Positive Suppression

Exclude known safe resources from scan results

bash

1# Create suppression file
2cat > ~/cloudsploit/suppressions.txt << EOF
3S3_BUCKET_PUBLIC_READ  # Public read bucket for website hosting
4EC2_SECURITY_GROUP_OPEN_TO_WORLD  # Bastion host SG
5KMS_KEY_ROTATION_ENABLED  # CMKs rotated manually
6EOF
7 
8# Run scan with suppressions
9cloudsploit scan aws \
10  --suppress-file ~/cloudsploit/suppressions.txt \
11  --output table

One detector ID per line
Comments with #
Apply across all accounts

Resource Inventory Only

List all cloud resources without running security checks

bash

1# List all AWS resources without scanning
2cloudsploit scan aws --list-resources --output json > inventory.json
3 
4# Or just list what would be scanned
5cloudsploit scan aws --dry-run

Useful for asset inventory
No detector execution
Can pipe to jq for analysis

Multi-Account Scanning

Manage scans across multiple cloud accounts with a single command:

bash

1# Scan AWS accounts from config file
2cat > ~/accounts.txt << EOF
3[account:prod]
4aws_access_key_id = AKIA_PRODUCTION
5aws_secret_access_key = secret_prod
6regions = us-east-1,us-west-2
7 
8[account:dev]
9aws_access_key_id = AKIA_DEVELOPMENT
10aws_secret_access_key = secret_dev
11regions = us-east-1
12EOF
13 
14cloudsploit scan --multi-account ~/accounts.txt \
15  --output combined.json

Next: Pro Tips