-
Notifications
You must be signed in to change notification settings - Fork 0
Home
SethBodine edited this page Apr 3, 2026
·
25 revisions
audit-tools is a container image that bundles cloud security auditing tools into a single, consistent environment. Shell in, authenticate to your cloud provider, and run assessments without managing local dependencies.
- Podman (or Docker)
- Cloud provider credentials
- Minimum 4GB RAM allocated to the container VM
xcode-select --install
brew install podmanSee the Podman Install Documentation.
podman machine init --now --cpus=4 --memory=4096 \
--timezone $(curl https://ipapi.co/timezone) --disk-size 50All arguments are optional, but a minimum of 4GB RAM is recommended. Prowler can crash with less.
podman machine start # only required if --now was not used abovetmp_fol=$(mktemp -d)
wget https://raw.githubusercontent.com/SethBodine/audit-tools/main/pm-init.sh -O ${tmp_fol}/pm-init.sh
bash ${tmp_fol}/pm-init.shtmp_fol=$(mktemp -d)
wget https://raw.githubusercontent.com/SethBodine/audit-tools/main/pm-init.sh -O ${tmp_fol}/pm-init.sh
AUDIT_OUTPUT_DIR="/tmp" bash ${tmp_fol}/pm-init.shMost tools support writing output to a file. Direct output to /output so it is available outside the container after the session ends.
# Example - Prowler HTML report
prowler aws -M html -o /output
# Example - trivy JSON report
trivy filesystem . -f json -o /output/trivy-results.jsonThe wiki command lets you browse these docs without leaving your shell.
wiki # list all pages
wiki --prowler # jump to the Prowler page
wiki --search token # search across all pages
wiki --menu # interactive arrow-key browser
wiki --update # pull latest wiki from GitHub- Set up cloud credentials - see Cloud Access and Permissions
- Authenticate via CLI - see Cloud Authentication via CLI
- Run a tool - use
wikior the sidebar to navigate to the relevant page
- Getting Started
- Cloud Access and Permissions
- Cloud Authentication via CLI
- Using Powerpipe
- Using Prowler
- Using checkov
- Using trivy
- Using poutine
- Using zizmor
- Using syft
- Using grype
- Using cazadora
- Using semgrep
- Using kubescape
- Using AzureHound
- Using BloodHound
- Using aws_list_all
- Using dockerspy
- Using ScoutSuite
- Using screen
- Using testssl.sh
- Using Trufflehog
- Using CloudFox
- Using Gitleaks
- Using betterleaks
- Using Polaris
- Using elbaph
- Other Tools