CloudFox

CloudFox is a command line tool for gaining situational awareness in unfamiliar cloud environments. It helps security teams and authorized assessors map the security posture of cloud infrastructure they are responsible for, especially when working from limited read-only access.

It answers questions about AWS regions and resource counts, secrets sitting in EC2 userdata or environment variables, overly permissive roles and cross-account trusts, and endpoints or filesystems reachable from a given starting point. CloudFox is modular, and an aws all-checks command runs the other AWS commands with sane defaults.

It covers AWS, Azure, and GCP, and notably does not raise alerts or check for compliance. Instead it surfaces the information you need to understand and reduce your cloud's exposure. Install it from a binary release, with Homebrew, or build it from source with Go.