CloudSploit

Overview

CloudSploit scans cloud accounts for configuration risks by collecting metadata through provider APIs. It is a strong fit for teams able to run and maintain an open-source command-line scanner, especially those checking several cloud providers. Its appeal is broad account coverage at no software cost; teams needing runtime defense or identity security should choose a broader tool.

Key features

CloudSploit supports AWS, Microsoft Azure, Google Cloud Platform, Oracle Cloud Infrastructure, and GitHub accounts. It uses read-only permissions to collect account metadata and identify potential misconfigurations and other security issues. That keeps the scanner from needing write access, while teams remain responsible for deciding how to address findings.

Checks map to HIPAA, PCI, and CIS Level 1 and Level 2 requirements. Results can be printed to the console or saved as CSV, JSON, or JUnit XML. The CLI can return a non-zero status when results do not pass, giving CI/CD pipelines a way to flag findings. AWS GovCloud and China region options also make it relevant to teams operating in those environments.

The project includes cloud asset inventory, Kubernetes security, and automated remediation. Setup uses NodeJS and npm install; Docker build and run commands offer another deployment route. Those options suit teams comfortable managing their own installation. The project is licensed under GPL-3.0.

Pricing

Open-source CloudSploit: free. The self-hosted version gives teams the scanner without a software charge. It is best suited to organizations that can handle deployment and ongoing operation themselves.

Hosted at Aqua Wave: custom pricing. The commercial hosted version is an option for teams that prefer a hosted deployment. Its price is custom, so buyers should compare a quote against the effort of running the open-source version.

Platforms

CloudSploit is available for Linux, web, and self-hosted deployment. Its documented NodeJS installation and Docker commands provide workable setup paths for teams that already manage command-line tools or containers.

Who it's for

Choose CloudSploit if you need to inspect accounts across multiple cloud providers, map checks to compliance frameworks, or feed findings into CI/CD, and have the capacity to run a self-hosted tool. Its read-only scanning and machine-readable output make it practical for recurring configuration checks. It is a weaker fit for teams seeking image scanning, runtime protection, admission control, or identity security.

Pros and cons

• Pros: Supports five account types across major cloud providers and GitHub, so one scanner can cover a varied cloud estate.
• Pros: Compliance mappings and CSV, JSON, and JUnit XML output support audits and automated workflows.
• Pros: Free self-hosted use and read-only scan permissions keep software cost and required account access low.
• Cons: Self-hosting requires teams to install and operate the tool.
• Cons: No image scanning, runtime protection, admission control, or identity security; teams needing those controls will need other products.

Alternatives

For Kubernetes-focused policy checks, Fairwinds Polaris offers a free open-source policy engine aimed at small teams. Kubescape is another free self-hosted option, with a CLI and Kubernetes operator under the Apache 2.0 license. Kyverno is a free open-source project under Apache License 2.0.

Monokle is a free desktop option with an open-source MIT license. Falco is a free, open-source Linux and self-hosted option. KSPM Pro has a free tier for one Kubernetes cluster with real-time scans and CIS coverage. KubeArmor is a free open-source runtime security project. KubeLinter is a free Apache-licensed option with no paid tiers listed.

Explore Kubernetes Security Software, Cloud Security Posture Management Software, Security Configuration Management Software, Container Security Software, or Infrastructure Testing Tools for more options. LLM Evaluation Tools is another directory category.

Verdict

CloudSploit is a sensible choice for technically equipped teams that want free, self-hosted, multi-cloud configuration scanning with compliance mappings and CI/CD-friendly output. Its account coverage and flexible output are useful strengths, but its missing runtime, image, admission-control, and identity capabilities set a clear boundary: choose another product if you need protection beyond configuration checks.