cloudg: one CLI to map and audit AWS, Azure and GCP

Description and use

cloudg is a CLI tool that maps AWS, Azure, and GCP assets into a NetworkX graph, runs scanners, merges findings, and outputs interactive reports, compliance mappings, and Terraform exports.

Problem

Scanners like Prowler and Checkov return flat lists of misconfigurations, making it hard to understand how resources are connected and how a misconfiguration can cascade across accounts.

Outcome

cloudg produces a comprehensive, graph‑based view of cloud resources, integrates scanner findings, maps them to multiple compliance frameworks, and exports artifacts for further analysis and automation.

Workflow

• Install cloudg with desired provider extras (e.g., pip install "cloudg[aws]")
• Run cloudg map to collect inventory (e.g., cloudg map -p aws --regions all)
• Optionally run cloudg deps to explore dependencies of a specific resource
• Run cloudg run to execute the full pipeline with scanners (e.g., cloudg run -p aws --regions us-east-1)
• Review the generated reports in ./reports, including report.html, findings.json, topology.svg, and compliance maps
• If needed, merge separate scans with cloudg map --findings <file> to combine inventory and findings

Evidence

cloudg (short for cloud graphing) is the tool I built for that. It collects assets from AWS, Azure and GCP into a NetworkX graph with typed edges between them.

Source

cloudg run is the full security pipeline. It collects, builds the graph, fans out to the scanners, then merges and deduplicates their findings and maps them to 28 compliance frameworks.

Source

Everything lands in ./reports. After cloudg run, open report.html first: it has a D3 topology view next to the findings table, and it works offline because Chart.js and D3 are embedded in the page.

Source