ScoutSuite is an open-source, multi-cloud security auditing tool developed and maintained by NCC Group. It is written in Python and works by using the read-only APIs provided by each cloud vendor’s SDK (such as boto3 for AWS, the Azure SDK for Python, and the Google Cloud Python client libraries) to collect configuration data from a cloud environment. It then assesses that data against a large library of built-in security rules and generates a single, interactive HTML report that visually highlights misconfigurations, weak IAM policies, publicly exposed resources, and deviations from security best practices.
ScoutSuite supports the following cloud providers:
- Amazon Web Services (AWS)
- Microsoft Azure
- Google Cloud Platform (GCP)
- Alibaba Cloud
- Oracle Cloud Infrastructure (OCI)
Key characteristics of ScoutSuite:
- Read-only by design — ScoutSuite only calls “describe”, “list”, and “get” style API operations and never modifies cloud resources, making it safe to run against production accounts (with proper authorization).
- Rule-based engine — findings are generated from a JSON-based ruleset that can be customized, extended, or filtered.
- Interactive report — the output is a self-contained HTML/JavaScript dashboard that lets an analyst drill down from a high-level dashboard into individual services, resources, and rule violations.
- Extensible — new rules, services, and providers can be added because the codebase is modular.
ScoutSuite is most commonly used during the cloud configuration review phase of an assessment, either by internal cloud security teams performing continuous audits or by external penetration testers who have been issued read-only credentials to assess a client’s cloud posture.
Installation
ScoutSuite is available on Kali Linux via the APT repository, and can also be installed from source using pip inside a virtual environment (recommended for the latest features).
Method 1: APT (Kali Linux default repositories)
sudo apt update
sudo apt install scoutsuite -y
Method 2: pip install (PyPI package)
sudo apt install python3-pip python3-venv -y
python3 -m venv scoutsuite-venv
source scoutsuite-venv/bin/activate
pip install scoutsuite
Method 3: Install from source (GitHub, latest development version)
git clone https://github.com/nccgroup/ScoutSuite.git
cd ScoutSuite
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
python3 scout.py --help
Verify installation:
scout --version
Expected output:
ScoutSuite 5.13.0
Syntax
The general syntax for invoking ScoutSuite is:
scout <provider> [options]
Where <provider> is one of: aws, azure, gcp, aliyun, oci.
Example base syntax:
scout aws [--profile PROFILE] [--report-dir DIR] [--regions REGION1 REGION2] [options]
Complete Command-Line Options Reference
Global / Provider Selection
scout aws Run ScoutSuite against an AWS account
scout azure Run ScoutSuite against an Azure subscription/tenant
scout gcp Run ScoutSuite against a GCP project
scout aliyun Run ScoutSuite against an Alibaba Cloud account
scout oci Run ScoutSuite against an Oracle Cloud Infrastructure tenancy
Authentication Options (AWS example)
--profile PROFILE Use a named AWS CLI profile from ~/.aws/credentials
--access-keys Prompt for / supply AWS access key and secret key manually
--access-key-id KEY AWS Access Key ID
--secret-access-key SECRET AWS Secret Access Key
--session-token TOKEN AWS Session Token (for temporary/STS credentials)
--mfa-serial SERIAL ARN of the MFA device, if MFA is required
--mfa-code CODE One-time MFA code
--assume-role ROLE_ARN Assume an IAM role before running the scan
--role-name NAME For use with --assume-role, source role
Authentication Options (Azure example)
--cli Use credentials from Azure CLI (az login)
--service-principal Authenticate using a service principal
--user-account Authenticate interactively as a user
--client-id ID Azure AD application (client) ID
--client-secret SECRET Azure AD application secret
--tenant-id ID Azure AD tenant ID
--subscription-ids IDS Restrict scan to specific subscription IDs
Authentication Options (GCP example)
--user-account Authenticate as a user (gcloud auth)
--service-account Authenticate using a service account key file
--service-account-key-file FILE Path to the service account JSON key
--project-id ID GCP project ID to scan
--all-projects Scan all projects accessible to the credentials
--folder-id ID Scan all projects under a GCP folder
--organization-id ID Scan all projects under a GCP organization
Scan Scope / Filtering
--regions REGION [REGION ...] Limit the scan to specific regions
--services SERVICE [SERVICE ...] Limit the scan to specific services (e.g., s3 iam ec2)
--skip-services SERVICE [...] Exclude specific services from the scan
--excluded-regions REGION [...] Exclude specific regions
Report and Output Options
--report-dir DIR Directory to save the report (default: ./scoutsuite-report)
--report-name NAME Custom name for the report
--no-browser Do not automatically open the HTML report in a browser
--force Overwrite an existing report without prompting
--timestamp Append a timestamp to the report directory name
--result-format {json,html} Output format for raw results
Rule / Finding Options
--ruleset FILE Use a custom ruleset JSON file instead of the default
--max-workers N Number of concurrent worker threads (default: 10)
--exceptions FILE Exceptions file to suppress specific findings
--fetch-local Use previously fetched/cached data instead of querying the API again
--update Update existing report data instead of overwriting
Miscellaneous
--debug Enable verbose/debug output
--quiet Suppress non-essential console output
--proxy-ip IP Route API calls through an HTTP proxy IP
--proxy-port PORT Proxy port to use with --proxy-ip
--https-proxy URL Set an HTTPS proxy URL
-h, --help Display the help menu
Basic Usage
The simplest way to run ScoutSuite against AWS using a locally configured AWS CLI profile:
scout aws --profile mycompany-readonly
Expected console output:
$ scout aws --profile mycompany-readonly
2026-07-19 10:02:11 [INFO] Launching Scout
2026-07-19 10:02:11 [INFO] AWS provider selected, using profile: mycompany-readonly
2026-07-19 10:02:12 [INFO] Fetching IAM data...
2026-07-19 10:02:15 [INFO] Fetching S3 data...
2026-07-19 10:02:20 [INFO] Fetching EC2 data...
2026-07-19 10:02:28 [INFO] Fetching VPC data...
2026-07-19 10:02:33 [INFO] Fetching CloudTrail data...
2026-07-19 10:02:40 [INFO] Running rules engine...
2026-07-19 10:02:44 [INFO] 214 checks performed, 37 findings identified
2026-07-19 10:02:44 [INFO] Report written to: scoutsuite-report/aws-mycompany-readonly/scoutsuite-results/scoutsuite_results_aws.js
2026-07-19 10:02:44 [INFO] Opening report in default browser...
The HTML report opens automatically (unless --no-browser is specified), showing a dashboard with a per-service risk score, a list of findings grouped by severity (Danger, Warning, and informational), and drill-down navigation into each AWS service.
Practical Examples with Output
Example 1: Scan AWS using a named CLI profile
scout aws --profile pentest-client
[INFO] Launching Scout
[INFO] Using AWS profile: pentest-client
[INFO] Fetching data from 12 services across 3 regions
[INFO] Report generated: scoutsuite-report/aws-pentest-client/
Example 2: Scan AWS using raw access keys (no CLI profile configured)
scout aws --access-keys --access-key-id AKIAIOSFODNN7EXAMPLE --secret-access-key wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
[INFO] Authenticating with provided access keys
[INFO] Identity confirmed: arn:aws:iam::123456789012:user/scoutsuite-audit
[INFO] Fetching IAM, S3, EC2, RDS, Lambda data...
[INFO] Report generated successfully
Example 3: Scan only specific AWS services to save time
scout aws --profile client-ro --services s3 iam cloudtrail
[INFO] Restricting scan to services: s3, iam, cloudtrail
[INFO] Fetching S3 data... 42 buckets found
[INFO] Fetching IAM data... 58 users, 14 roles found
[INFO] Fetching CloudTrail data... 3 trails found
[INFO] 89 checks performed, 11 findings identified
Example 4: Scan AWS while assuming a cross-account IAM role
scout aws --profile master-account --assume-role arn:aws:iam::987654321098:role/SecurityAuditRole
[INFO] Assuming role: arn:aws:iam::987654321098:role/SecurityAuditRole
[INFO] Temporary credentials obtained, expiring in 3600 seconds
[INFO] Fetching data from target account 987654321098...
[INFO] Report generated: scoutsuite-report/aws-987654321098/
Example 5: Scan an Azure subscription using Azure CLI authentication
az login
scout azure --cli --subscription-ids 11111111-2222-3333-4444-555555555555
[INFO] Using Azure CLI credentials
[INFO] Targeting subscription: 11111111-2222-3333-4444-555555555555
[INFO] Fetching Storage Account data...
[INFO] Fetching Network Security Group data...
[INFO] Fetching Azure AD data...
[INFO] 176 checks performed, 22 findings identified
Example 6: Scan a GCP project using a service account key
scout gcp --service-account --service-account-key-file ./gcp-audit-key.json --project-id my-gcp-project-01
[INFO] Authenticating with service account: audit@my-gcp-project-01.iam.gserviceaccount.com
[INFO] Fetching Cloud Storage bucket data...
[INFO] Fetching Compute Engine firewall data...
[INFO] Fetching IAM policy bindings...
[INFO] 143 checks performed, 19 findings identified
Example 7: Restrict a scan to specific AWS regions
scout aws --profile client-ro --regions us-east-1 eu-west-1
[INFO] Restricting scan to regions: us-east-1, eu-west-1
[INFO] Skipping 15 other available regions
[INFO] Report generated in 48 seconds
Example 8: Use a custom ruleset to focus only on public exposure findings
scout aws --profile client-ro --ruleset public-exposure-only.json
[INFO] Loading custom ruleset: public-exposure-only.json
[INFO] 24 rules loaded (filtered from default 214)
[INFO] 6 findings identified: 3 public S3 buckets, 2 public EBS snapshots, 1 open RDP security group
Example 9: Save report data as JSON for later processing without opening a browser
scout aws --profile client-ro --result-format json --no-browser --report-dir /home/kali/reports/client-2026-07-19
[INFO] Report will not open automatically (--no-browser set)
[INFO] Raw JSON results saved to /home/kali/reports/client-2026-07-19/scoutsuite-results/scoutsuite_results_aws.js
Example 10: Re-analyze previously fetched data without hitting the API again
scout aws --profile client-ro --fetch-local --report-dir /home/kali/reports/client-2026-07-19
[INFO] Using cached data from previous run
[INFO] Skipping API calls, re-running rules engine only
[INFO] Rules engine completed in 2.1 seconds
Example 11: Exclude noisy services from a scan
scout aws --profile client-ro --skip-services cloudformation elasticbeanstalk
[INFO] Excluding services: cloudformation, elasticbeanstalk
[INFO] 198 checks performed across remaining services
Example 12: Run through an HTTP proxy (useful in engagements requiring traffic inspection via Burp Suite)
scout aws --profile client-ro --proxy-ip 127.0.0.1 --proxy-port 8080
[INFO] Routing AWS API calls through proxy 127.0.0.1:8080
[INFO] Certificate warnings suppressed (verify=False)
[INFO] Fetching data through proxy... 214 checks performed
Common Use Cases
- Pre-engagement baseline audits: Establishing a snapshot of a client’s cloud security posture before a full penetration test begins.
- Continuous compliance monitoring: Running ScoutSuite on a schedule (via cron or CI/CD pipelines) to detect configuration drift over time.
- Multi-account/multi-subscription audits: Using
--assume-role(AWS) or--subscription-ids(Azure) to sweep across an entire cloud organization. - Post-incident review: Quickly identifying overly permissive IAM policies or exposed resources after a suspected breach.
- Bug bounty and external assessments: Assessing cloud assets when a client has scoped in read-only credential access.
- DevSecOps integration: Feeding JSON output into ticketing systems (Jira, ServiceNow) to auto-generate remediation tickets.
Automation with Bash
Automated multi-profile AWS scanning script:
#!/bin/bash
# scoutsuite-multi-scan.sh
# Iterates over all AWS CLI profiles and runs ScoutSuite against each
PROFILES=$(aws configure list-profiles)
REPORT_BASE="/home/kali/reports/scoutsuite-$(date +%F)"
mkdir -p "$REPORT_BASE"
for profile in $PROFILES; do
echo "[+] Starting ScoutSuite scan for profile: $profile"
scout aws --profile "$profile" \
--no-browser \
--report-dir "$REPORT_BASE/$profile" \
--result-format json \
--max-workers 15
if [ $? -eq 0 ]; then
echo "[+] Completed scan for $profile"
else
echo "[!] Scan failed for $profile" >> "$REPORT_BASE/errors.log"
fi
done
echo "[+] All scans complete. Reports saved under $REPORT_BASE"
Cron job for weekly automated audits:
# Add to crontab -e
0 3 * * 1 /home/kali/scripts/scoutsuite-multi-scan.sh >> /var/log/scoutsuite-cron.log 2>&1
Extracting only “danger” level findings from JSON output with jq:
cat scoutsuite-report/aws-client-ro/scoutsuite-results/scoutsuite_results_aws.js \
| sed 's/^scoutsuite_results = //' \
| jq '.services[] | .findings[]? | select(.level=="danger")'
Tips and Best Practices
- Always use least-privilege, read-only IAM credentials (e.g., the AWS-managed
SecurityAuditpolicy) when running ScoutSuite — it never needs write access. - Run scans outside of business-critical hours if using a large
--max-workersvalue against a very large account, to avoid unnecessary API throttling. - Use
--report-dirwith a timestamp to keep a historical archive of scans for trend analysis and diffing configuration drift over time. - Combine ScoutSuite with Prowler — ScoutSuite excels at broad, visual dashboards, while Prowler is stronger for compliance-framework-specific checks (CIS, PCI-DSS).
- Use
--exceptionsfiles to suppress known, accepted-risk findings so reports stay focused on new issues in recurring scans. - When auditing large AWS Organizations, script the assumption of the
OrganizationAccountAccessRoleor a dedicated audit role across every member account. - Store historical JSON results in version control (or an S3 bucket with versioning) to track configuration drift.
Troubleshooting
| Issue | Cause | Resolution |
|---|---|---|
NoCredentialsError | AWS credentials not found | Verify ~/.aws/credentials or pass --access-keys explicitly |
| Scan hangs on a specific service | API throttling / rate limiting | Reduce --max-workers, or add the service to --skip-services temporarily |
AccessDenied errors in report | IAM policy attached is too restrictive | Attach the AWS managed SecurityAudit or ReadOnlyAccess policy |
| Report opens blank in browser | Browser blocking local JavaScript file access | Serve the report directory with python3 -m http.server and open via http://localhost:8000 |
--assume-role fails with AccessDenied | Trust policy on target role doesn’t allow the source principal | Update the role’s trust relationship to include the auditor’s ARN |
Azure scan fails with AADSTS error | Expired or invalid Azure AD token | Re-run az login before invoking ScoutSuite |
| GCP scan returns empty results | Service account lacks roles/viewer or roles/iam.securityReviewer | Grant the appropriate read-only IAM role on the project |
References
- Official GitHub Repository: https://github.com/nccgroup/ScoutSuite
- NCC Group Official Blog: https://www.nccgroup.com/
- ScoutSuite Wiki / Documentation: https://github.com/nccgroup/ScoutSuite/wiki
- AWS Managed Policy Reference (SecurityAudit): https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SecurityAudit.html
- Kali Linux Tool Listing: https://www.kali.org/tools/scoutsuite/
