ScanExecution

Running Scans

Cloudsploit scans your cloud infrastructure by enumerating resources and running security checks against each one. Learn how to start scans, customize scan scope, and interpret results.

Basic Scan

The simplest scan targets all enabled cloud providers with default settings:

bash

1cloudsploit scan

This will:

Discover all accessible resources in configured cloud accounts
Run all enabled security detectors
Output results to console in table format
Save full results to ~/.cloudsploit/results/

Scan Specific Cloud Provider

Target specific cloud providers if you only want to scan one environment:

bash

1# Scan AWS only
2cloudsploit scan aws
3 
4# Scan Azure only
5cloudsploit scan azure
6 
7# Scan GCP only
8cloudsploit scan gcp
9 
10# Scan AWS and Azure (skip GCP)
11cloudsploit scan aws azure

Limit by Region

Restrict scans to specific regions to reduce scan time or focus on specific deployments:

bash

1# Scan only US regions
2cloudsploit scan aws --regions us-east-1,us-west-2,us-west-1
3 
4# Scan single region
5cloudsploit scan aws --region eu-west-1
6 
7# Exclude regions
8cloudsploit scan aws --exclude-regions cn-north-1,us-gov-west-1

Info

Region restriction only applies to region-scoped services (EC2, S3, RDS, etc.). Global services like IAM are always scanned.

Limit by Service

Focus on specific cloud services to speed up scans or target high-risk areas:

bash

1# Scan only storage services
2cloudsploit scan aws --services s3,ebs,efs
3 
4# Scan IAM and security groups
5cloudsploit scan aws --services iam,security-groups
6 
7# Exclude specific services
8cloudsploit scan aws --exclude-services cloudtrail,config

Warning

Use cloudsploit detectors --list to see all available service names.

Custom Detectors

Run only specific detectors or exclude known false positives:

bash

1# Run only S3 and IAM detectors
2cloudsploit scan aws --services s3,iam
3 
4# Skip specific detectors by ID
5cloudsploit scan aws --suppress S3_BUCKET_PUBLIC_READ,S3_BUCKET_VERSIONING_DISABLED
6 
7# Run only critical/high severity detectors
8cloudsploit scan aws --severity critical,high
9 
10# List all available detectors
11cloudsploit detectors --list

Output Formats

Export scan results in various formats for reporting or integration:

bash

1# JSON output (detailed, machine-readable)
2cloudsploit scan aws --output json --outfile scan-results.json
3 
4# CSV for spreadsheet analysis
5cloudsploit scan aws --output csv --outfile findings.csv
6 
7# HTML report with interactive filtering
8cloudsploit scan aws --output html --outfile report.html
9 
10# JUnit format for CI/CD integration
11cloudsploit scan aws --output junit --outfile results.xml
12 
13# Table format (default, console-friendly)
14cloudsploit scan aws --output table

Info

Without --outfile, output goes to console (except JSON which writes to ~/.cloudsploit/results/ by default).

Scan Modes

Cloudsploit offers different scan modes for various use cases:

Quick Scan

Fast scan with common detectors only. Good for daily checks.

bash

1cloudsploit scan --quick

Comprehensive Scan

All detectors, all regions, thorough enumeration. Takes longer.

bash

1cloudsploit scan --comprehensive

Compliance Mode

Run only CIS benchmark and compliance checks.

bash

1cloudsploit scan --compliance cis

Dry Run

Show what would be scanned without executing. Safe for testing config.

bash

1cloudsploit scan --dry-run

Understanding Output

Scan results show security findings with severity, description, and remediation:

bash

1[CRITICAL] S3 Bucket is publicly accessible
2  Resource: arn:aws:s3:::my-bucket
3  Region: us-east-1
4  Description: The S3 bucket has public read/write permissions via bucket policy
5  Remediation: Remove public access ACLs and block public access settings
6  Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

Severity levels:

CRITICAL: Immediate action required, high risk of compromise
HIGH: Significant security issue, address soon
MEDIUM: Potential security improvement, schedule remediation
LOW: Minor issue or informational finding

Next: AWS Scanners