Cheap posture snapshot of the audited AWS account.

Collects:

• the account id (sts.GetCallerIdentity); this identifies the audited account and is returned in the summary

• iam.GetAccountSummary counters: Users, AccountMFAEnabled, AccountAccessKeysPresent

• the account-level S3 public access block (s3control.GetPublicAccessBlock)

Findings:

• HIGH when the root account has no MFA (AccountMFAEnabled != 1)

• MEDIUM when the account-level S3 public access block is missing or any of its four flags is disabled

Returns: Report envelope: {check, ok, findings[], scanned, summary}. scanned is 1 (one account). summary holds the collected numbers and account_id. Each finding has {check, severity, title, resource, detail} with severity one of LOW/MEDIUM/HIGH/CRITICAL.

Audit Lambda function resource policies for overly broad invoke access.

Scans every Lambda function in the region (AWS_REGION or us-east-1 when the region argument is omitted) and inspects its resource policy, if any. An Allow statement with a wildcard principal ("" or {"AWS": ""}) and no SourceArn/SourceAccount condition is HIGH: anyone can invoke the function. A service principal (for example s3.amazonaws.com) without any source condition is MEDIUM: any account's use of that service can invoke it. Service principals scoped by a SourceArn or SourceAccount condition are normal and are not flagged.

Returns a dict {check, ok, findings, scanned} where ok is true only when no findings were produced, findings is a list of normalized finding dicts (detail includes the statement sid, the principal and whether a condition exists), and scanned is the number of functions examined.

Audit CloudTrail trail posture in the account.

Checks, per trail (shadow trails included, so multi-region trails homed in another region are still seen):

• trail exists at all (zero trails is a CRITICAL finding on its own)

• the trail is actively logging (GetTrailStatus.IsLogging), CRITICAL if not

• IsMultiRegionTrail, MEDIUM if single-region

• LogFileValidationEnabled, MEDIUM if disabled

• KmsKeyId present, LOW if logs are not encrypted with a customer managed key

Args: region: AWS region to query (defaults to AWS_REGION or us-east-1).

Returns: Report envelope: {check, ok, findings[], scanned}. scanned is the number of trails inspected; ok is true only when no findings exist. Each finding has {check, severity, title, resource, detail} with severity one of LOW/MEDIUM/HIGH/CRITICAL and resource "trail/" (or "account" for the zero-trails finding).

Audit EBS volumes and snapshots for exposure risks.

Scans every EBS volume in the region (AWS_REGION or us-east-1 when the region argument is omitted) and flags unencrypted volumes as MEDIUM. Scans every snapshot owned by the account and checks its createVolumePermission attribute; a snapshot shared with the "all" group is public and is flagged CRITICAL.

Returns a dict {check, ok, findings, scanned, volumes_scanned, snapshots_scanned} where ok is true only when no findings were produced, findings is a list of normalized finding dicts, and scanned is the total number of volumes plus snapshots examined.

Audit EC2 security groups for ingress rules open to the world.

Scans every security group in the region (AWS_REGION or us-east-1 when the region argument is omitted) and flags each ingress rule whose source is 0.0.0.0/0 or ::/0. Rules allowing all traffic (protocol -1) or covering a sensitive port (SSH 22, RDP 3389, MySQL 3306, PostgreSQL 5432, Redis 6379, Elasticsearch 9200, MongoDB 27017) are HIGH; any other world-open port (for example 80 or 443) is MEDIUM.

Returns a dict {check, ok, findings, scanned} where ok is true only when no findings were produced, findings is a list of normalized finding dicts (check, severity, title, resource, detail with protocol, from_port, to_port, cidrs, group_name), and scanned is the number of security groups examined.

Run every registered audit check with default arguments and aggregate the results into a single account posture report.

Discovers all audit_*/account_* functions in the tool modules and runs each one; a failing check is recorded in errors and never aborts the rest. Returns the standard {check, ok, findings, scanned} envelope where findings is the concatenation of every sub-report's findings and scanned is the number of checks run, plus severity_counts (LOW/MEDIUM/HIGH/CRITICAL), posture_score, grade, checks_run, and errors. The score is weighted: each CRITICAL finding costs 10 points, HIGH 5, MEDIUM 2, LOW 1, and posture_score = max(0, 100 - total weight). Grades: A >= 90, B >= 75, C >= 60, D >= 40, else F.

Audit IAM users for active access keys older than max_age_days.

Scans every IAM user and flags each Active access key whose age exceeds max_age_days. Returns {check, ok, findings[], scanned} where scanned is the number of users examined. Severity is HIGH when the key's owner has no MFA device (a leaked key is the only factor), MEDIUM when the owner has MFA.

Audit IAM users that can log in to the console without MFA.

Scans every IAM user, checks which ones have a console login profile, and flags those with no MFA device as HIGH severity. Returns {check, ok, findings[], scanned} where scanned is the number of users examined; users without console access are counted but never flagged.

Audit the root account for missing MFA and active root access keys.

Reads the IAM account summary. No root MFA is a HIGH finding; any root access key present is a CRITICAL finding. Returns {check, ok, findings[], scanned} with scanned=1 (the single root identity) and the raw summary values in each finding's detail.

Audit RDS instance posture: public accessibility, storage encryption, and deletion protection.

Scans every RDS DB instance in the region. A publicly accessible instance is a HIGH finding, unencrypted storage is MEDIUM, and disabled deletion protection is LOW. Returns the {check, ok, findings[], scanned} envelope where scanned is the number of DB instances examined; each finding carries the engine, the endpoint address when public, and the raw posture flags.

Audit every S3 bucket in the account for public exposure.

For each bucket this checks: the Public Access Block configuration (missing or any of the four flags disabled yields a MEDIUM finding), the bucket policy (any Allow statement with principal "" or {"AWS": ""} yields a HIGH finding), and the bucket ACL (grants to the AllUsers or AuthenticatedUsers groups yield a HIGH finding).

Returns a dict {check, ok, findings, scanned} where ok is true only when no findings were produced, findings is a list of normalized finding dicts (check, severity, title, resource, detail), and scanned is the number of buckets examined. Buckets that raise an unexpected AWS error are skipped and reported under an extra "errors" key mapping bucket name to error code. Severity: HIGH means the bucket is likely publicly reachable right now; MEDIUM means a guardrail is missing.