CloudSploit

CloudSploit is an open-source project for finding potential misconfigurations and security risks in cloud infrastructure accounts. It uses read-only account access to collect metadata through cloud APIs, then scans that data for possible issues. Supported accounts include AWS, Microsoft Azure, Google Cloud Platform, Oracle Cloud Infrastructure, and GitHub. The self-hosted open-source version is free; a commercial version is hosted at Aqua Wave, with no price listed. Setup instructions cover installing NodeJS and running npm install, and Docker build and run commands are also provided. The CLI supports HIPAA, PCI, and CIS Level 1 and Level 2 compliance mappings. Results can be saved as CSV, JSON, or JUnit XML, or printed to the console. A non-zero exit status for non-passing results can support CI/CD workflows. AWS GovCloud and AWS China options are included. CloudSploit is licensed under GPL-3.0 and supports Linux, web, and self-hosted deployment.

CloudSploit provides a free self-hosted scanning option with multiple cloud account types and output formats. Its setup requires a local runtime or Docker, and read-only cloud access is needed for scans.

CloudSploit suits teams looking for a free, self-hosted tool to scan cloud accounts for possible configuration and security issues. Its CLI output and non-zero status option may fit teams incorporating scans into CI/CD workflows.

CloudSploit is an open-source scanner that checks cloud accounts for configuration risks. It is best suited to teams that can run command-line tools and want recurring checks across several cloud providers. Its broad account coverage and compliance mappings are useful, though it covers only part of the cloud security workload.

Overview

The scanner gathers account metadata through cloud infrastructure APIs and analyzes it for possible misconfigurations and other security issues. It supports AWS, Microsoft Azure, Google Cloud Platform, Oracle Cloud Infrastructure, and GitHub, giving teams a single tool for checks across a varied environment. Scans require read-only account permissions, which limits the access the scanner needs.

CloudSploit is an open-source project with a self-hosted version and a commercial version hosted at Aqua Wave. Its GitHub repository uses the GPL-3.0 license. The self-hosted design gives teams control over where scans run, but also means they must handle setup and execution themselves.

Key features

Compliance mappings cover HIPAA, PCI, and CIS Level 1 and Level 2. Results can be printed to the console or exported as CSV, JSON, or JUnit XML, allowing teams to review findings directly or pass them into other workflows. The CLI can return a non-zero status when it finds non-passing results, a practical way to make a CI/CD job flag issues for follow-up.

The project documents NodeJS installation followed by npm install, and also supplies Docker build and run commands. That gives teams a choice of local runtime or container, but neither removes the need to manage the scanner. AWS region options include GovCloud and China. Cloud asset inventory, Kubernetes security, and automated remediation are also included among its capabilities.

CloudSploit does not include image scanning, runtime protection, admission control, or identity security, and it is not a posture management product. Teams looking for those areas as part of a single platform will need other tools.

Pricing

Open-source CloudSploit: free. This is the self-hosted open-source version, suited to teams able to install and operate the scanner themselves. It carries no software charge; the trade-off is responsibility for local setup and use.

Hosted at Aqua Wave: custom pricing. This is the commercial hosted version. It may suit teams seeking a hosted deployment, though the price is custom.

Platforms

CloudSploit is available for Linux and is self-hosted, with a web platform classification. Its documented installation path uses NodeJS, while Docker offers another way to run it.

Who it's for

CloudSploit fits teams that need multi-cloud account checks, compliance-oriented mappings, and output they can use in scripts or CI/CD pipelines, and that have the capacity to operate a self-hosted scanner. It is less suitable for organizations that want broad runtime, image, identity, or admission security in the same product.

Pros and cons

• Pros: Supports five account types, including major cloud providers and GitHub, so teams can scan across more than one provider.
• Pros: Compliance mappings, multiple export formats, and a CI/CD-friendly exit status make findings easier to route into existing review processes.
• Pros: The self-hosted version costs nothing and requires read-only scan access.
• Cons: Teams must install and operate it through NodeJS or Docker, which adds maintenance work.
• Cons: It lacks image scanning, runtime protection, identity security, and admission control, so it cannot cover those needs on its own.
• Cons: The hosted Aqua Wave version uses custom pricing, which makes cost planning less straightforward.

Alternatives

For Kubernetes-focused tools, Fairwinds Polaris offers a free open-source policy engine aimed at small teams, while KubeArmor and Tetragon are free open-source runtime security projects. Falco is another free open-source option. These may suit readers whose priority is Kubernetes policy or runtime security rather than CloudSploit's multi-cloud account scanning.

KSPM Pro has a free plan for one Kubernetes cluster with real-time scans. Kubescape provides a free, self-hosted open-source CLI and Kubernetes operator, while Kyverno is a free open-source project. Monokle is a free open-source desktop app. Pick among these when their stated Kubernetes or desktop focus better matches the work at hand.

Browse Kubernetes Security Software, Security Configuration Management Software, Cloud Security Posture Management Software, Container Security Software, or Infrastructure Testing Tools for related categories.

Verdict

Choose CloudSploit if your team wants a free, self-hosted way to scan multiple cloud account types and feed compliance-oriented results into existing workflows. Its strongest case is breadth of account support without a software fee; look elsewhere if you need a fuller security platform with image, runtime, identity, or admission protection.