CloudSploit

CloudSploit is an open-source scanner for finding cloud-account misconfigurations and security risks across multiple providers. It best suits engineering and security teams comfortable operating a self-hosted CLI and needing repeatable compliance checks. The bottom line is straightforward: it delivers broad account inspection at no software cost, but it is not a complete cloud or workload protection suite.

Overview

CloudSploit collects account metadata through cloud-infrastructure APIs and evaluates that data for potential misconfigurations, risks, and other security issues. It supports AWS, Microsoft Azure, Google Cloud Platform, Oracle Cloud Infrastructure, and GitHub accounts, making it a practical choice when one scanner must cover a mixed estate. The scanner requests read-only permissions, which limits the access granted to the tool; teams still need a separate process to investigate and fix findings, even though automated remediation is included among its capabilities.

The project began in 2015 and is published under the GPL-3.0 license. Aqua Wave also hosts a commercial version, while the documented community edition is self-hosted.

Key features

Compliance-oriented checks map to HIPAA, PCI, and CIS Level 1 and Level 2 benchmarks. That mapping gives regulated teams a defined way to organize results rather than treating every finding as an undifferentiated alert. Output can be printed to the console or written as CSV, JSON, or JUnit XML, so results can feed reports and other engineering systems.

For automation, the CLI can return a non-zero status when checks do not pass. That makes it suitable for CI/CD gates that should flag configuration drift before deployment. AWS GovCloud and AWS China options are useful for teams operating in those regional environments. Cloud asset inventory and Kubernetes security broaden its coverage beyond a narrow account checklist, and multi-cloud support avoids maintaining a different scanner for each provider.

Installation requires NodeJS followed by npm install. Docker build and run commands are documented as an alternative, which helps teams standardize execution in a container. This remains an operator-managed tool: the self-hosted model places setup, scheduling, storage, and follow-up work with your team.

Pricing

Open-source CloudSploit — free: The self-hosted open-source version includes the scanner without a software charge. It fits teams with the skills and infrastructure to run a CLI, manage read-only credentials, and process findings themselves. The trade-off is operational ownership rather than a managed service.

Hosted at Aqua Wave — custom pricing: This is the commercial hosted version.

Platforms

CloudSploit runs on Linux, is self-hosted, and provides a web presence through the hosted offering. Its documented setup is command-line and container friendly rather than a native desktop application.

Who it's for

Choose CloudSploit when you need one free scanner for AWS, Azure, Google Cloud, Oracle Cloud Infrastructure, and GitHub accounts, with compliance mappings and CI/CD-friendly output. It is particularly suited to teams that can operate NodeJS or Docker tooling and want read-only inspection across several accounts.

Look elsewhere if your requirement is image scanning, runtime protection, admission control, identity security, posture management, or managed Kubernetes. Those omissions make CloudSploit a focused configuration and inventory scanner, not an end-to-end cloud security platform.

Pros and cons

Pros

• Broad provider coverage: AWS, Azure, Google Cloud, Oracle Cloud Infrastructure, and GitHub accounts can be inspected through one project.
• Useful compliance output: HIPAA, PCI, and CIS Level 1 and Level 2 mappings give checks a recognizable control structure.
• Automation-ready formats: CSV, JSON, JUnit XML, console output, and non-zero failure status support reporting and CI/CD workflows.
• Low-permission scanning: Read-only access reduces the privileges required by the scanner.
• Free self-hosted edition: The open-source version costs nothing and can run with NodeJS or Docker.

Cons

• Self-hosting workload: Installation, execution, and finding management remain your responsibility.
• Narrow security scope: There is no image scanning, runtime protection, admission control, identity security, or posture management.
• Limited managed option clarity: The Aqua Wave hosted version uses custom pricing, with no published price or terms.

Alternatives

For Kubernetes policy checks, Fairwinds Polaris is a free, self-hosted open-source policy engine aimed at small teams. Kubescape is another free self-hosted option, offering a CLI and Kubernetes operator under Apache 2.0.

Monokle provides a free open-source desktop application, while Kyverno is a free Apache-licensed project for teams choosing that policy approach. KSPM Pro has a free web plan limited to one Kubernetes cluster with real-time scans.

For runtime-focused Kubernetes security, consider free open-source KubeArmor, Tetragon, or Falco. Browse Cloud Security Posture Management Software, Security Configuration Management Software, Kubernetes Security Software, Container Security Software, Infrastructure Testing Tools, and LLM Evaluation Tools when your selection needs extend beyond CloudSploit's account-scanning focus.

Verdict

Pick CloudSploit if you want a free, self-hosted way to inspect several cloud accounts, maintain an asset inventory, and produce compliance-oriented results for automation. Its main reason to choose it is multi-cloud breadth with machine-readable output and read-only access. Look elsewhere when you need runtime or workload defenses, identity and posture management, admission control, image scanning, or a managed Kubernetes security service.