Python tools for checking synthetic AWS configurations and Terraform plans.
A Python cloud-configuration scanner with AWS-style IAM and infrastructure heuristics, Terraform-plan JSON analysis, SARIF output and repeatable hardened-fixture comparisons.
My contribution
Implemented offline Python configuration checks
Evidence / output
AWS-style and Terraform-shaped findings with 62 tests
Source code, documentation and tests are available on GitHub.
01 / CONTEXT
Project context
Configuration reviews need more than a list of best practices. I wanted to turn selected cloud-security concerns into testable code, record the exact rule and affected resource, and avoid claiming certainty where effective permissions or deployment state remain unknown.
02 / EXECUTION
What I did
Implemented Python rules for IAM trust and permission patterns, storage access and encryption, network ingress and monitoring coverage.
Added a separate Terraform-shaped JSON plan scanner with nested resources and explicit handling for unknown values.
Compared intentionally vulnerable and hardened fixtures without modifying live infrastructure.
Produced machine-readable SARIF, proposed remediation evidence and CI regression checks.
SYSTEM FLOW
Offline scanning and verification workflow
01Synthetic configuration fixturesVulnerable and hardened JSON examples
02Python rule engineIAM, storage, networking and monitoring heuristics
03Findings and SARIFRule/resource traceability with uncertainty recorded
04Regression and comparisonRepeatable tests and hardened-fixture comparisons
Synthetic AWS-style inputs and hand-authored Terraform-shaped JSON; no cloud connection or deployed resource changes.
03 / VERIFICATION
Evidence and outcomes
Detector implementations and fixture inputs are versioned in the repository.
Manual-review entries preserve uncertainty around IAM conditions and provider-computed values.
Comparisons and SARIF are reproducible; findings are traceable to rule and resource.
Selected source-backed examples from the linked repositories. Images are published from already-sanitized source files; report excerpts remain explicitly labelled.
REPOSITORY REPORT EXCERPT
Synthetic vulnerable-fixture report
15 pattern findings · 8 critical / 5 high / 2 medium
Actual committed offline scanner output for a fictional AWS-style snapshot. Flagged patterns require context and manual review.
Does a pattern match establish that a real cloud resource is exposed?
Method
A deterministic Python scanner examines synthetic AWS-style fields and hand-authored Terraform-plan-shaped JSON. It records the matched rule, resource and requested follow-up evidence.
Observed / documented
Patterns such as wildcard IAM permissions and internet-wide ingress can be surfaced and compared against hardened fixtures without changing infrastructure.
Limits of the evidence
Conditions, SCPs, boundaries, routes and effective permissions are outside parts of the simplified input. These are review prompts, not verified exploitable weaknesses.
Entirely offline and synthetic. The Terraform-shaped inputs were hand-authored; no live AWS assessment or actual remediation was performed. Zero findings is not a compliance or security attestation.
