How hardik-aws/ctaudit works
ctaudit is an in-process AWS log auditor: users select a log family and scope, it reads objects from S3, analyzes records, and produces terminal/HTML reports with optional PDF output. Its five audit domains cover CloudTrail, ELB, WAF, S3 access, and VPC Flow Logs; long-running serve mode adds periodic scans and metrics/output integrations. The sampled sources show the shared scan, VPC and S3 processing, report and sink layers. Some domain-specific wiring is documented in the README but its implementation was not sampled, so those links are marked unverified.
Main entry points: main.go CLI commands · report HTML and terminal reports · serve.go Serve scanner · engine.go CloudTrail analysis
Components 32
Commands and serving
- CLI commands
cmd/ctaudit/main.go - CloudTrail command
cmd/ctaudit/cloudtrail.go - ELB command
cmd/ctaudit/elb.go - WAF command
cmd/ctaudit/waf.go - S3 command
cmd/ctaudit/s3.go - VPC command
cmd/ctaudit/vpc.go - Serve scanner
cmd/ctaudit/serve.go - Serve state
cmd/ctaudit/serve_state.go
S3 input and decoding
- S3 object source
internal/s3src/store.go - ELB log decoding
internal/elblog/elblog.go - WAF log decoding
internal/waflog/waflog.go - S3 log decoding
internal/s3log/s3log.go - Flow log decoding
internal/flowlog/flowlog.go
Audit analysis
- Shared scan engine
internal/engine/engine.go - CloudTrail analysis
internal/engine/engine.go - ELB analysis
internal/engine/elb.go - WAF analysis
internal/engine/waf.go - S3 log analysis
internal/engine/s3.go - VPC analysis
internal/engine/vpc.go - CloudTrail rules
internal/findings/rules.go - S3 findings
internal/s3rules/rules.go - WAF findings
internal/wafrules/rules.go - VPC findings
internal/vpcrules/rules.go - Domain summaries
internal/stats
Reports and exports
- HTML and terminal reports
internal/report - PDF reports
internal/report/pdf.go
Serve integrations
- Output sinks
internal/sink/lines.go - Prometheus metrics
internal/sink/metrics.go - Loki output
internal/sink/loki.go
Other components
- Auditor
- Log bucket
- HTTP clients
Connections 38
- Auditor → CLI commands: selects command
README.md - CLI commands → CloudTrail command: routes to
- CLI commands → ELB command: routes to
- CLI commands → WAF command: routes to
- CLI commands → S3 command: routes to
- CLI commands → VPC command: routes to
- Log bucket → S3 object source: serves objects
README.md - S3 object source → Shared scan engine: lists and fetches
internal/engine/engine.go - Shared scan engine → CloudTrail analysis: runs scan
internal/engine/engine.go - CloudTrail command → CloudTrail analysis: starts audit
- ELB command → ELB analysis: starts audit
- WAF command → WAF analysis: starts audit
- S3 command → S3 log analysis: starts audit
- VPC command → VPC analysis: runs audit
cmd/ctaudit/vpc.go - S3 log decoding → S3 log analysis: decodes records
internal/engine/s3.go - Flow log decoding → VPC analysis: decodes flows
internal/engine/vpc.go - ELB log decoding → ELB analysis: decodes entries
- WAF log decoding → WAF analysis: decodes requests
- CloudTrail analysis → CloudTrail rules: inspects events
internal/engine/engine.go - CloudTrail analysis → Domain summaries: aggregates records
internal/engine/engine.go - S3 log analysis → S3 findings: detects findings
internal/engine/s3.go - S3 log analysis → Domain summaries: aggregates entries
internal/engine/s3.go - VPC analysis → VPC findings: detects findings
internal/engine/vpc.go - VPC analysis → Domain summaries: aggregates flows
internal/engine/vpc.go - WAF analysis → WAF findings: detects findings
- ELB analysis → Domain summaries: aggregates traffic
- CloudTrail command → HTML and terminal reports: renders reports
README.md - ELB command → HTML and terminal reports: renders reports
README.md - WAF command → HTML and terminal reports: renders reports
README.md - S3 command → HTML and terminal reports: renders reports
README.md - VPC command → HTML and terminal reports: renders reports
cmd/ctaudit/vpc.go - HTML and terminal reports → PDF reports: optionally renders
README.md - Serve scanner → Shared scan engine: runs scans
- Serve scanner → Serve state: updates state
cmd/ctaudit/serve.go - Serve scanner → Output sinks: emits records
cmd/ctaudit/serve.go - Output sinks → Prometheus metrics: exports metrics
- Output sinks → Loki output: pushes output
- HTTP clients → Serve scanner: requests endpoints
README.md