Available · Community

AWS IAM security · Terraform · CI

Go deeper on IAM security.

Review selected AWS identity risks while infrastructure changes are still in development. CloudAttack Community is a focused Go-based companion for Terraform plan JSON and CI/CD.

Explore the GitHub repository Installation guide

Community edition · Free for internal use under licence · AWS IAM focus · View licence

Illustrative finding

Terraform plan review

HIGH

TRUST RELATIONSHIP

Overly permissive trust policy

ILLUSTRATIVE POLICY FRAGMENT

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "sts:AssumeRole"
}

Role: developer-role
Principal: * (any principal)
Risk: Could allow unintended identities to assume the role, subject to AWS trust and caller-side controls.
Manual review: Confirm intended principals, conditions and trust scope.

Example for illustration; actual results depend on supported input and checks.

Community capabilities

Focused checks for identity risk.

CloudAttack works with supported AWS IAM data in Terraform plan JSON and offers a deliberately bounded set of checks and outputs.

01Plan JSON

Terraform plan analysis

Inspect Terraform plan JSON for supported AWS IAM configuration and risk patterns.

02IAM review

Selected privilege checks

Surface selected iam:PassRole risks and suspicious IAM trust relationships.

03Limited depth

Limited chain detection

Identify a shallow, one-hop privilege-escalation pattern within the community scope.

04JSON · SARIF

Structured findings

Produce JSON or SARIF output for downstream review and compatible tooling.

05CI workflow

GitHub Actions gating

Use the community Action to gate a workflow at a selected finding severity.

06Local-first

Local analysis

Run supported scans locally or in CI; current modes do not require AWS credentials.

A clear path through CI

From plan to reviewable finding.

CloudAttack analyses the plan JSON you provide. Terraform planning happens in your existing workflow.

01
Terraform plan JSON
Provide the JSON plan generated by your Terraform workflow.
02
CloudAttack analysis
Run selected checks against supported AWS IAM changes.
03
JSON or SARIF
Return structured findings for review or compatible tooling.
04
CI gate
Apply GitHub Actions severity gating in your workflow.

For developers

Try it in the workflow you already use.

Start with the repository’s installation and quick-start instructions. The public README documents supported inputs, GitHub Actions configuration and output formats.

GET STARTEDInstallation & quick start REFERENCERepository documentation

Works alongside broader IaC review

CloudAttack focuses on selected AWS IAM checks in supported inputs. Teams can use it as a specialist companion alongside broader infrastructure-as-code tools such as Checkov, each within its documented scope.

Know the boundaries

Focused by design.

CloudAttack Community covers selected AWS IAM risks and limited shallow chain detection. It does not provide full AWS effective-permission analysis, exhaustive attack-graph traversal, live AWS discovery or raw Terraform HCL scanning. It complements broader IaC review; it is not a replacement for it.

Review the project on GitHub

In development

Need deeper identity security and governance?

IC-CyberGate is developing advanced identity security and governed evidence workflows for organisations that need more than developer-level checks.

Explore Governance & Early Access