メニュー
Perform comprehensive security posture assessment of AWS accounts using ScoutSuite to enumerate resources, identify misconfigurations, and generate actionable security reports.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
SOC 職業分類に基づく
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/xalgord/xalgorix --skill performing-aws-account-enumeration-with-scout-suiteコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.
| name | performing-aws-account-enumeration-with-scout-suite |
| description | Perform comprehensive security posture assessment of AWS accounts using ScoutSuite to enumerate resources, identify misconfigurations, and generate actionable security reports. |
| domain | cybersecurity |
| subdomain | cloud-security |
| tags | ["aws","scoutsuite","cloud-security","enumeration","misconfiguration","security-audit","cspm","nccgroup"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"] |
ScoutSuite is an open-source multi-cloud security auditing tool developed by NCC Group that enables comprehensive security posture assessment of AWS environments. It queries AWS APIs to gather configuration data across all services, stores results locally, and generates interactive HTML reports highlighting high-risk areas. ScoutSuite is agentless and works by analyzing how cloud resources are configured, accessed, and monitored.
AccessDenied/UnauthorizedOperation before trusting a "good" result - missing iam:GenerateCredentialReport or s3:GetBucketPolicy produces false greens.--regions us-east-1 misses opt-in regions and resources elsewhere. Run a full scout aws (all regions) at least once; remember IAM/S3 are global and surface under any region.cloudfox env-vars or manual aws ssm describe-parameters.aws s3api get-public-access-block (account and bucket) before concluding.--profile); one clean account says nothing about the others.scoutsuite-results/scoutsuite_results.json and look for flagged_items > 0 with level: "danger" (e.g., iam-root-no-mfa, s3-bucket-world-listable), then reproduce it with the matching CLI call.awsAccessDenied in the log, validated danger findings via direct API calls, and scanned every account in the org.pip install scoutsuite
scout --version
aws configure
# Or use environment variables:
export AWS_ACCESS_KEY_ID=<your-key>
export AWS_SECRET_ACCESS_KEY=<your-secret>
export AWS_DEFAULT_REGION=us-east-1
Attach the AWS managed policy SecurityAudit and ViewOnlyAccess to the IAM user or role running ScoutSuite. For comprehensive scanning, a custom policy may be needed:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"acm:Describe*",
"acm:List*",
"cloudformation:Describe*",
"cloudformation:Get*",
"cloudformation:List*",
"cloudtrail:Describe*",
"cloudtrail:Get*",
"cloudtrail:List*",
"cloudwatch:Describe*",
"cloudwatch:Get*",
"cloudwatch:List*",
"config:Describe*",
"config:Get*",
"config:List*",
"dynamodb:Describe*",
"dynamodb:List*",
"ec2:Describe*",
"ec2:Get*",
"elasticloadbalancing:Describe*",
"iam:Generate*",
"iam:Get*",
"iam:List*",
"iam:Simulate*",
"kms:Describe*",
"kms:Get*",
"kms:List*",
"lambda:Get*",
"lambda:List*",
"logs:Describe*",
"logs:Get*",
"rds:Describe*",
"rds:List*",
"redshift:Describe*",
"route53:Get*",
"route53:List*",
"s3:Get*",
"s3:List*",
"ses:Get*",
"ses:List*",
"sns:Get*",
"sns:List*",
"sqs:Get*",
"sqs:List*",
"ssm:Describe*",
"ssm:Get*",
"ssm:List*"
],
"Resource": "*"
}
]
}
scout aws
scout aws --services s3 iam ec2 rds
scout aws --regions us-east-1 us-west-2 eu-west-1
scout aws --profile target-account-profile
scout aws --skip iam ec2
scout aws --report-dir /tmp/scoutsuite-reports/
ScoutSuite generates an interactive HTML report stored locally. The report includes:
| Service | Critical Checks |
|---|---|
| IAM | Root account MFA, password policy, unused credentials, overprivileged policies |
| S3 | Public buckets, unencrypted buckets, versioning disabled, logging disabled |
| EC2 | Security groups with 0.0.0.0/0, unencrypted EBS volumes, public IPs |
| RDS | Public accessibility, unencrypted databases, backup retention |
| CloudTrail | Logging disabled, log file validation, multi-region disabled |
| Lambda | Public access, environment variable secrets, VPC configuration |
# Run ScoutSuite in CI/CD pipeline and fail on danger findings
scout aws --services s3 iam ec2 --no-browser --report-dir ./scout-report/
# Parse results programmatically
python -c "
import json
with open('./scout-report/scoutsuite-results/scoutsuite_results.json') as f:
results = json.load(f)
for service in results.get('services', {}):
findings = results['services'][service].get('findings', {})
for finding_id, finding in findings.items():
if finding.get('flagged_items', 0) > 0 and finding.get('level') == 'danger':
print(f'CRITICAL: {finding_id} - {finding.get(\"description\", \"\")}')
"
ScoutSuite supports multiple cloud providers using the same framework:
# Azure
scout azure --cli
# GCP
scout gcp --user-account
# AWS with specific profile
scout aws --profile production