$ ./index.js -h
                                   _     / _| |               | |/ |     | |     () |   | |    | |        | | (    | | _  | |_   | |    | |/  \| | | |/  |\ \| ' \| |/ _ \| | |   | |_| | () | || | (| |_) | |) | | () | | |     \||\/ \,|\,|/| ./||\/|_|\|                                     | |                                     |_|

CloudSploit by Aqua Security, Ltd.     Cloud security auditing for AWS, Azure, GCP, Oracle, and GitHub
usage: index.js [-h] --config CONFIG [--compliance {hipaa,cis,cis1,cis2,pci}] [--plugin PLUGIN] [--govcloud] [--china] [--csv CSV] [--json JSON] [--junit JUNIT]                   [--table] [--console {none,text,table}] [--collection COLLECTION] [--ignore-ok] [--exit-code] [--skip-paginate] [--suppress SUPPRESS]
optional arguments:     -h, --help            show this help message and exit     --config CONFIG                           The path to a cloud provider credentials file.     --compliance {hipaa,cis,cis1,cis2,pci}                           Compliance mode. Only return results applicable to the selected program.     --plugin PLUGIN       A specific plugin to run. If none provided, all plugins will be run. Obtain from the exports.js file. E.g. acmValidation     --govcloud            AWS only. Enables GovCloud mode.     --china               AWS only. Enables AWS China mode.     --csv CSV             Output: CSV file     --json JSON           Output: JSON file     --junit JUNIT         Output: Junit file     --table               Output: table     --console {none,text,table}                           Console output format. Default: table     --collection COLLECTION                           Output: full collection JSON as file     --ignore-ok           Ignore passing (OK) results     --exit-code           Exits with a non-zero status code if non-passing results are found     --skip-paginate       AWS only. Skips pagination (for debugging).     --suppress SUPPRESS   Suppress results matching the provided Regex. Format: pluginId:region:resourceId</code></pre> </details>
Compliance
CloudSploit supports mapping of its plugins to particular compliance policies. To run the compliance scan, use the --compliance flag. For example: <pre><code class="lang-">$ ./index.js --compliance=hipaa $ ./index.js --compliance=pci</code></pre>

Multiple compliance modes can be run at the same time: <pre><code class="lang-">$ ./index.js --compliance=cis1 --compliance=cis2</code></pre>
CloudSploit currently supports the following compliance mappings:
HIPAA
<pre><code class="lang-">$ ./index.js --compliance=hipaa</code></pre>
HIPAA scans map CloudSploit plugins to the Health Insurance Portability and Accountability Act of 1996.
PCI
<pre><code class="lang-">$ ./index.js --compliance=pci</code></pre>
PCI scans map CloudSploit plugins to the Payment Card Industry Data Security Standard.
CIS Benchmarks
<pre><code class="lang-">$ ./index.js --compliance=cis
$ ./index.js --compliance=cis1
$ ./index.js --compliance=cis2</code></pre>
CIS Benchmarks are supported, both for Level 1 and Level 2 controls. Passing --compliance=cis will run both level 1 and level 2 controls.

Output Formats
CloudSploit supports output in several formats for consumption by other tools. If you do not specify otherwise, CloudSploit writes output to standard output (the console) as a table.
Note: You can pass multiple output formats and combine options for further customization. For example: <pre><code class="lang-"># Print a table to the console and save a CSV file $ ./index.js --csv=file.csv --console=table
Print text to the console and save a JSON and JUnit file while ignoring passing results
$ ./index.js --json=file.json --junit=file.xml --console=text --ignore-ok</code></pre>
Console Output
By default, CloudSploit results are printed to the console in a table format (with colors). You can override this and use plain text instead, by running:
<pre><code class="lang-">$ ./index.js --console=text</code></pre>
Alternatively, you can suppress the console output entirely by running: <pre><code class="lang-">$ ./index.js --console=none</code></pre>
Ignoring Passing Results
You can ignore results from output that return an OK status by passing a --ignore-ok commandline argument.
CSV
<pre><code class="lang-">$ ./index.js --csv=file.csv</code></pre>
JSON
<pre><code class="lang-">$ ./index.js --json=file.json</code></pre>
JUnit XML
<pre><code class="lang-">$ ./index.js --junit=file.xml</code></pre>
Collection Output
CloudSploit saves the data queried from the cloud provider APIs in JSON format, which can be saved alongside other files for debugging or historical purposes.
<pre><code class="lang-">$ ./index.js --collection=file.json</code></pre>
Suppressions
Results can be suppressed by passing the --suppress flag (multiple options are supported) with the following format:
<pre><code class="lang-">--suppress pluginId:region:resourceId</code></pre>
For example: <pre><code class="lang-"># Suppress all results for the acmValidation plugin $ ./index.js --suppress acmValidation::
Suppress all us-east-1 region results
$ ./index.js --suppress :us-east-1:
Suppress all results matching the regex &quot;certificate/*&quot; in all regions for all plugins
$ ./index.js --suppress ::certificate/*</code></pre>
Running a Single Plugin
The --plugin flag can be used if you only wish to run one plugin.
<pre><code class="lang-">$ ./index.js --plugin acmValidation</code></pre>
Architecture
CloudSploit works in two phases. First, it queries the cloud infrastructure APIs for various metadata about your account, namely the "collection" phase. Once all the necessary data is collected, the result is passed to the "scanning" phase. The scan uses the collected data to search for potential misconfigurations, risks, and other security issues, which are the resulting output.
Writing a Plugin
Please see our contribution guidelines and complete guide to writing CloudSploit plugins.
Writing a remediation
The --remediate` flag can be used if you want to run remediation for the plugins mentioned as part of this argument. This takes a list of plugin names.
Please see our developing remediation guide for more details.
Other Notes
For other details about the Aqua Wave SaaS product, AWS security policies, and more, click here.