aws-audit-checklist 0.1.0

A free, read-only AWS security audit CLI — the 30-point checklist a fractional CTO runs on client accounts.

aws-audit — the AWS security checklist I run on client accounts

A free, read-only AWS security & cost audit CLI. Point it at an account and it runs the same 30-point checklist a fractional CTO uses before a paid audit, then prints a prioritized findings report. It only makes Describe/List/Get calls — nothing is ever created, modified, or deleted, and no data leaves your machine.

$ aws-audit

  AWS Security Audit  ·  aws-audit
  Account 123456789012  ·  regions: us-east-1
  ────────────────────────────────────────────────────────────────

   CRITICAL  [IAM-1] Root account MFA  — FAIL
      Root account does NOT have MFA enabled.
      fix: Enable a hardware or virtual MFA device on the root user and stop using root.

   HIGH  [IAM-2] Long-lived IAM access keys  — FAIL
      2 active access key(s) older than 90 days.
      affected: deploy-bot:7Q4A (412d), ci-user:9F1C (203d)
      fix: Rotate or delete keys older than 90 days; prefer IAM Identity Center (SSO).
  ...
  1 fail  ·  3 warn  ·  18 pass

  Want this done for you — and the issues fixed? → https://services.itsdavidg.co

Install

pipx install aws-audit-checklist     # recommended
# or
pip install aws-audit-checklist

Usage

aws-audit                       # uses your default AWS credential chain + region
aws-audit --profile myprofile   # a named profile
aws-audit --all-regions         # run regional checks in every enabled region
aws-audit --markdown report.md  # export a Markdown report
aws-audit --json                # machine-readable output
aws-audit --strict              # exit non-zero if anything FAILs (CI gate)

You only need read-only credentials. A built-in AWS managed policy like SecurityAudit or ReadOnlyAccess is more than enough. Checks you lack permission for are reported as "could-not-check" rather than failing the run.

What it checks (30-point checklist)

Area	Examples
Identity (IAM)	root MFA, access keys > 90 days, console users without MFA, password policy
Network	security groups exposing SSH/RDP to 0.0.0.0/0
Data	S3 public buckets & default encryption, EBS encryption-by-default, RDS public/encrypted/backups
Logging	multi-region CloudTrail, GuardDuty, AWS Config
Cost signals	unattached EBS volumes, unused Elastic IPs

The full human-readable checklist (with the items not yet automated — incident runbooks, multi-AZ, IaC, off-account backups) is here: the 30-point AWS Security Checklist PDF.

Why this exists

I'm David Gomez — I do fractional-CTO work and run AWS security/cost audits. I kept running this same checklist by hand on every account, so I open-sourced the automatable parts. If you want the whole thing done for you — including the manual items and actually fixing what it finds, with a guarantee — that's my AWS Complete Security Audit.

License

MIT. Use it freely. No warranty — it's a helper, not a substitute for a real review.