CloudSploit

Overview

CloudSploit is an open-source scanner for finding potential security problems in cloud-account configurations. It is best suited to teams able to run and maintain a self-hosted command-line tool. Its appeal is broad account coverage without a software charge; its focus is narrower than a full cloud security platform.

Key features

The scanner supports AWS, Microsoft Azure, Google Cloud Platform, Oracle Cloud Infrastructure, and GitHub. It requests read-only account permissions, gathers metadata through provider APIs, and checks that data for misconfigurations and other risks. Read-only access limits what the scanner can do to an account, but teams still need a process for acting on findings.

Its CLI maps checks to HIPAA, PCI, and CIS Level 1 and Level 2. Results can be printed to the console or exported as CSV, JSON, or JUnit XML. A non-zero exit status for non-passing results makes it possible to have CI/CD systems flag findings rather than treating every scan as informational. AWS options include GovCloud and China regions.

Cloud asset inventory and Kubernetes security are included, as is automated remediation. However, CloudSploit does not provide image scanning, runtime protection, posture management, identity security, or admission control. That boundary matters: it can help identify configuration risks, but it is not a substitute for broader workload or runtime defenses.

Pricing

Open-source CloudSploit: free. This self-hosted version fits teams that can install, operate, and integrate the scanner themselves and want to avoid software charges. The trade-off is responsibility for running it and handling findings.

Hosted at Aqua Wave: custom pricing for the commercial hosted version.

Platforms

CloudSploit is available for Linux and web use, with a self-hosted deployment model. Setup instructions call for NodeJS and npm install; Docker build and run commands provide another deployment route. The project is licensed under GPL-3.0.

Who it's for

CloudSploit suits teams responsible for several cloud accounts that need repeatable configuration checks, compliance mappings, and exportable results. Its read-only scanning model and CI/CD exit behavior are useful when checks should fit into existing workflows. Teams that need image scanning, identity security, admission control, or runtime protection should look elsewhere or pair it with other tools.

Pros and cons

Broad account coverage: AWS, Azure, Google Cloud, Oracle Cloud Infrastructure, and GitHub are supported, making it relevant to multi-cloud environments.

Practical CLI outputs: CSV, JSON, and JUnit XML exports, plus a non-zero status for failing results, support reporting and pipeline checks.

No software charge for the self-hosted version: The free plan avoids license cost, but requires teams to operate the scanner themselves.

Important scope gaps: No image scanning, runtime protection, identity security, admission control, or posture management limits its role in a security stack.

Alternatives

For Kubernetes-focused needs, Fairwinds Polaris is a free, open-source policy engine aimed at small teams. Kubescape is another free self-hosted option, with a CLI and Kubernetes operator under Apache 2.0. Kyverno is a free Apache-licensed open-source project. Monokle is a free MIT-licensed desktop option.

For runtime security, KubeArmor is a free open-source runtime security project, though workload and platform support varies by its support matrix. Red Hat Trusted Artifact Signer, bifrost security, and KSPM Pro are other options; KSPM Pro offers a free plan.

Readers comparing broader categories can browse Kubernetes Security Software, Cloud Security Posture Management Software, Container Security Software, Security Configuration Management Software, LLM Evaluation Tools, and Infrastructure Testing Tools.

Verdict

Choose CloudSploit if you want a free, self-hosted way to scan supported cloud accounts and feed configuration findings into reports or CI/CD checks. Its principal advantage is useful multi-cloud coverage without a software fee; look elsewhere if your requirements extend to image scanning, identity controls, admission control, posture management, or runtime defense.