vamp-iac-audit

Overview

vamp-iac-audit is a static analysis security auditor for Infrastructure-as-Code files. It recursively scans directories for Terraform HCL, AWS CloudFormation, and Helm chart configurations, detecting misconfigurations and insecure defaults aligned with CIS benchmarks, MITRE ATT&CK TTPs, and cloud provider security best practices. Findings are rated CRITICAL to LOW and exported to Console (Rich), JSON, or HTML.

Features

• Terraform module (IAC-TF-001 to IAC-TF-010): security groups open to 0.0.0.0/0 (CRITICAL), public S3 ACLs (HIGH), IAM wildcard actions/resources (HIGH), publicly accessible RDS instances (HIGH), unencrypted root block devices (MEDIUM), sensitive variable names without sensitive = true (MEDIUM), hardcoded secrets (sk_, ghp_, AKIA) (CRITICAL), SSH/RDP open to the world (CRITICAL), RDS without backup retention (MEDIUM), GCP firewall open to 0.0.0.0/0 (HIGH)
• CloudFormation module (IAC-CF-001 to IAC-CF-008): security groups with protocol -1 open to 0.0.0.0/0 (CRITICAL), public S3 access control (HIGH), IAM wildcard policies (HIGH), publicly accessible RDS (HIGH), unprotected password parameters missing NoEcho (MEDIUM), SSH/RDP open security groups (CRITICAL), KMS without key rotation (LOW), S3 without bucket encryption (MEDIUM)
• Helm module (IAC-HLM-001 to IAC-HLM-008): privileged containers (CRITICAL), hostNetwork usage (HIGH), hostPID/hostIPC (HIGH), missing runAsNonRoot (MEDIUM), missing resource limits (MEDIUM), hardcoded secrets in env values (CRITICAL), auto-mounted service account tokens (LOW), dangerous Linux capabilities SYS_ADMIN/NET_ADMIN/SYS_PTRACE (HIGH)
• Auto-detection of IaC type when no explicit flag is provided
• Recursive directory scanning
• Per-file findings with line numbers and resource names
• MITRE ATT&CK and CIS Benchmark references per finding
• Rich console output: findings table per file + summary by severity, IaC type and module
• Export to JSON (machine-readable) and HTML (standalone dark-theme)
• Exit code 1 on CRITICAL/HIGH findings for CI/CD pipeline integration

Requirements

• Python 3.9 or later
• rich >= 13.7.0
• pyyaml >= 6.0

Installation

pip install vamp-iac-audit
# o con Homebrew:
brew install vampsecure-labs/labs/vamp-iac-audit

git clone https://github.com/Vampsecure-Labs/vamp-iac-audit.git
cd vamp-iac-audit
python3 -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -r requirements.txt

Usage

vamp-iac-audit scan --help

usage: vamp-iac-audit scan [-h] --path DIR
                            [--terraform] [--cloudformation] [--helm]
                            [--json FILE] [--html FILE]

Examples

# Scan all IaC types in current directory (auto-detect)
vamp-iac-audit scan --path .

# Scan only Terraform files
vamp-iac-audit scan --path ./infra --terraform

# Scan only CloudFormation templates
vamp-iac-audit scan --path ./cfn --cloudformation

# Scan only Helm charts
vamp-iac-audit scan --path ./charts --helm

# Export findings to JSON and HTML
vamp-iac-audit scan --path ./infra --json results.json --html report.html

# Scan multiple types explicitly
vamp-iac-audit scan --path ./infra --terraform --cloudformation

CLI Reference

Output Formats

Checks Reference

Terraform (IAC-TF-*)

CloudFormation (IAC-CF-*)

Helm (IAC-HLM-*)

Exit Codes

Legal Notice

Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.

Part of VampSecure Labs Toolkit

vamp-iac-audit is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:

• Portfolio: github.com/Vampsecure-Labs
• Orchestrator: github.com/Vampsecure-Labs/vamp-orchestrator

© VampSecure Studios — VampSecure Labs Security Research Division

Versión

v1.0 — VampSecure Labs Security Research Division