CloudMapper is a comprehensive AWS environment analysis tool that audits security configurations, identifies risks, and generates detailed reports to enhance cloud security posture.
CloudMapper helps you analyze your Amazon Web Services (AWS) environments.
CloudMapper is primarily used by cloud security engineers and AWS administrators to audit AWS accounts for misconfigurations, identify unused resources, and assess security risks. It helps organizations maintain compliance and improve their cloud security by providing detailed reports and insights into IAM policies, network exposure, and resource usage.
The network visualization feature (`prepare` command) is no longer maintained and may not function as expected. Installation requires additional system dependencies for `jq` and `pyjq`. Users should ensure Python 3.7+ compatibility and consider running the tool within a virtual environment for dependency management. Custom private commands can be added via a dedicated directory for extended functionality.
Clone the repository: git clone https://github.com/duo-labs/cloudmapper.git
Install prerequisites for pyjq (on macOS): brew install autoconf automake awscli freetype jq libtool python3
Navigate to the cloned directory: cd cloudmapper/
Create and activate a Python virtual environment: python3 -m venv ./venv && source ./venv/bin/activate
Install Python dependencies using pip (implied but not explicitly stated)
Ensure jq is installed (https://stedolan.github.io/jq/)
Install pyjq Python library (https://github.com/doloopwhile/pyjq)audit
Check for potential misconfigurations in the AWS account.
collect
Collect metadata about an AWS account.
find_admins
Identify admin users, roles, or principals with specific privileges based on IAM policies.
find_unused
Detect unused AWS resources such as Security Groups, Elastic IPs, network interfaces, volumes, and load balancers.
prepare / webserver
Generate network visualizations (note: network visualization is no longer maintained).
public
Find public hosts and open port ranges in the AWS environment.
sg_ips
Retrieve geoip information on CIDRs trusted in Security Groups.
stats
Display counts of various AWS resources in the account.
weboftrust
Show Web Of Trust information.
report
Generate an HTML report summarizing account resources and audit findings.
iam_report
Generate an HTML report focused on IAM information of the AWS account.