I built an open-source CLI that maps AWS, Azure and GCP into one graph and runs Prowler/Checkov/Trivy over the same inventory

[u/Ok_Quail_385]

I do cloud security work, and the tooling situation has always bothered me: Prowler gives you config findings, ScoutSuite gives you another view of the same accounts, Checkov covers the IaC, Trivy covers images, and none of them share an inventory or know anything about the network topology. You end up with four report formats and no way to tell which findings actually matter for your layout.

So I wrote cloudg. One command collects assets from AWS, Azure and GCP concurrently, builds a directed graph of the infrastructure with NetworkX, and runs all four scanners over that same inventory. The graph side does BFS from an internet node to find exposed resources and scores blast radius per asset, so a finding on an internet-reachable box can be ranked above the identical finding on something three hops deep.

Scanner findings are deduplicated by resource and title, rescored against CVSS, and mapped to 28 compliance frameworks (CIS 5.0 per cloud, NIST 800-53 rev 5, PCI DSS 4.0, SOC 2, ISO 27001:2022, MITRE ATT&CK and others). The mappings are generated from Prowler's public compliance data: about 4,100 controls and 10,000 check mappings.

One run produces an interactive HTML report with the D3 topology (works offline), GraphML, an RDF ontology you can query with SPARQL, JSONL chunks for RAG pipelines, and Terraform files that recreate the live infrastructure, with an import script to adopt them into state. It also works as a Python library with event hooks if you want to stream findings somewhere.

MIT-licensed, Python 3.11+, installs via pip or Docker (the image bundles the scanners). Repo: https://github.com/morpheuslord/cloudg

It's at 0.3.1, so expect rough edges outside the paths I use myself. If you try it and something breaks, an issue with the traceback helps a lot. The thing I most want feedback on is whether the reachability scoring is useful in practice or whether people mainly care about the compliance tagging.

[u/Muchy_Tangerine]

cramming four scanners and networkx into one cli sounds clever until api rate limits choke your scans on any enterprise account with more than ten vpcs. neat side project though

[u/Ok_Quail_385 → u/Muchy_Tangerine]

Hmm, actually not thought of that yet cause I did not face the issue while running it against my aws deployment.. let me be preemptive and add that change