Scout Suite v5.14 releases: Multi-Cloud Security Auditing Tool

Scout Suite is a multi-cloud security auditing tool, which enables assessing the security posture of cloud environments. Using the APIs exposed by cloud providers, Scout gathers configuration data for manual inspection and highlights risk areas. Rather than pouring through dozens of pages on the web consoles, Scout provides a clear view of the attack surface automatically.

Scout Suite is stable and actively maintained, but a number of features and internals may change. As such, please bear with us as we find time to work on, and improve the tool. Feel free to report a bug with details (please provide console output using the –debug argument), request a new feature, or send a pull request.

Support

The following cloud providers are currently supported:

• Amazon Web Services
• Microsoft Azure
• Google Cloud Platform
• Alibaba Cloud (alpha)
• Oracle Cloud Infrastructure (alpha)

Changelog v5.14

• Core
  • Refactored Docker images to split them by major cloud provider (AWS, Azure, GCP)
• AWS
  • Updated Route53 transfer lock checks to add/remove TLDs
  • Multiple finding template improvements
  • Improved logic check for EBS encryption findings
  • Improved logic check for IAM policy conditions
• Azure
  • Fixed false negatives on edge cases of Key Vault RBAC settings
  • Fixed ‘Blob Containers Allowing Public Access’ template
  • Fixed flase positives on ‘Access Keys Not Rotated’ check for Storage Accounts
• Digital Ocean
  • Added support for scanning Digital Ocean environments, including a handful of new rules and checks. Special thanks to @asifwani and @ltoroncc

Installation

Install via pip:

$ pip install scoutsuite

Install from source:

$ git clone https://github.com/nccgroup/ScoutSuite
$ cd ScoutSuite
$ virtualenv -p python3 venv
$ source venv/bin/activate
$ pip install -r requirements.txt
$ python Scout.py --help

Use

Copyright (C) 2018 nccgroup