AWS Security
Scanning

This simulates the real scanner output. Click Execute to run a full demo scan — S3, IAM, security groups and CloudTrail — exactly as it looks in your terminal.

How it works

Connect once, scan everything

boto3 connects to AWS, runs all four checks, outputs coloured findings sorted by severity.

The CIS benchmark is what auditors use to assess AWS environments. Level 1 is the essential baseline — every AWS account should pass all 14 controls. This tool calculates your score and tells you exactly what to fix and when.

Why CIS matters

The auditor's standard

CIS Level 1 is referenced in every enterprise AWS security assessment. Passing it means your baseline is solid.

Two levels

Level 1 vs Level 2

Level 1 is the essential baseline. Level 2 adds advanced controls like GuardDuty, VPC flow logs and Config.

When an IP appears in your AWS logs or triggers a security group rule, knowing whether it is a known attacker changes everything about how you respond. Try the demo IPs below.

How it works

Context changes response

A 97% AbuseIPDB score turns a suspicious SSH attempt into a confirmed targeted attack. That changes priority.

These are the topics that come up in cloud security interviews at both startups and large organisations. Tick what you can explain confidently.

• Explain the AWS Shared Responsibility Model

  AWS secures the infrastructure. You secure everything you put on it. Most breaches happen on the customer side.
• Explain why a public S3 bucket is dangerous

  Anyone on the internet can list and download all objects. No authentication required. This has caused major breaches.
• Describe the principle of least privilege in IAM

  Every user, role and service should have only the minimum permissions needed. Nothing more. AdministratorAccess is almost always wrong.
• Explain why SSH should never be open to 0.0.0.0/0

  Attackers scan for port 22 on every IP constantly. An exposed SSH port receives brute force attempts within minutes.
• Explain what CloudTrail does and why it matters

  Records every API call in your account. Without it, you cannot investigate who did what after an incident.
• Describe CIS AWS Foundations Benchmark Level 1

  14 essential security controls covering IAM, logging, storage and networking. The baseline auditors use to assess AWS accounts.
• Explain why access keys should be rotated every 90 days

  The older a key gets, the more chances it has had to be leaked. 90-day rotation limits the damage window.
• Describe what a security group is and how it works

  Stateful firewall rules attached to AWS resources. Controls which traffic is allowed in and out. Misconfigured groups are a top finding in cloud security assessments.
• Explain what IAM roles are and when to use them

  Temporary credentials for services and applications. Safer than static access keys because they expire automatically and leave no long-lived secret to rotate.
• Describe how to investigate a cloud security incident

  Start with CloudTrail to build a timeline of API calls. Check which credentials were used, from where, and what they accessed.
• Explain encryption at rest vs encryption in transit

  At rest: data encrypted when stored on disk. In transit: data encrypted over the network (TLS). Both are required for sensitive data.
• Describe what MFA does and why it matters for root

  Multi-factor authentication requires a second device. Root without MFA can be taken over with just a leaked password — which is catastrophic in AWS.

This is what enterprises care about. A public S3 bucket is not just a security problem — it is a financial and legal one. Adjust the sliders to estimate the real cost of a misconfiguration in your organisation.