trailsamuel/cloudsec-range

How trailsamuel/cloudsec-range works

cloudsec-range pairs an intentionally misconfigured AWS training range with a boto3 scanner evaluated against a ground-truth findings manifest. The operator deploys the range, runs a regional or multi-region scan, and receives findings plus recall scoring. The scanner entry point dispatches registered service checks; shared context and finding types support them. Terraform’s documented resource domains and all four scanner check modules are represented. Terraform’s deployment wiring and some check implementations were not excerpted, so those relationships are included only where the README documents them.

Main entry points: __main__.py Scan Runner · core.py Check Registry · checks_ec2.py EC2 Checks · checks_iam.py IAM Checks

Components 16

AWS Range

Network terraform/network.tf
IAM Resources terraform/iam.tf
S3 Resources terraform/s3.tf
EC2 Resources terraform/ec2.tf
RDS Resources terraform/rds.tf
Budget Safety terraform/safety.tf

Scanner

Scan Runner scanner/__main__.py
Check Registry scanner/core.py
EC2 Checks scanner/checks_ec2.py
IAM Checks scanner/checks_iam.py
S3 Checks scanner/checks_s3.py
CloudTrail RDS Checks scanner/checks_cloudtrail.py

Ground Truth

Expected Findings findings/expected_findings.json
Findings and Recall scanner/__main__.py

Other components

Operator
AWS Account

Connections 24

Operator → Network: deploys range README.md
Operator → Scan Runner: runs scan README.md
Network → AWS Account: provisions resources README.md
IAM Resources → AWS Account: provisions resources README.md
S3 Resources → AWS Account: provisions resources README.md
EC2 Resources → AWS Account: provisions resources README.md
RDS Resources → AWS Account: provisions resources README.md
Budget Safety → AWS Account: provisions budget alarm README.md
Scan Runner → Check Registry: gets registered checks scanner/__main__.py
Scan Runner → EC2 Checks: dispatches checks scanner/__main__.py
Scan Runner → IAM Checks: dispatches checks scanner/__main__.py
Scan Runner → S3 Checks: dispatches checks scanner/__main__.py
Scan Runner → CloudTrail RDS Checks: dispatches checks scanner/__main__.py
EC2 Checks → Check Registry: uses context and findings scanner/checks_ec2.py
IAM Checks → Check Registry: uses context and findings scanner/checks_iam.py
S3 Checks → Check Registry: uses context and findings scanner/checks_s3.py
CloudTrail RDS Checks → Check Registry: uses context and findings scanner/checks_cloudtrail.py
EC2 Checks → AWS Account: audits EC2 and IAM scanner/checks_ec2.py
IAM Checks → AWS Account: audits IAM scanner/checks_iam.py
S3 Checks → AWS Account: audits S3 scanner/checks_s3.py
CloudTrail RDS Checks → AWS Account: audits CloudTrail and RDS scanner/checks_cloudtrail.py
Scan Runner → Expected Findings: scores against scanner/__main__.py
Scan Runner → Findings and Recall: formats findings and recall scanner/__main__.py
Findings and Recall → Operator: reports results README.md

Drawn by GitDiagram on November 10, 2026 from the repository's file tree, README and source files. Read as Markdown ·