tarekcheikh/ec2-security-scanner repository overview

⁠ec2-security-scanner

A read-only AWS EC2 security and compliance scanner. It audits EC2 instances, security groups, EBS volumes, IAM instance roles, key pairs, launch templates, and account and VPC posture across one or more regions, then maps every finding to 10 compliance frameworks.

Source, full documentation, and the required IAM policy: https://github.com/TocConsulting/ec2-security-scanner⁠

⁠Image tags

• latest, 1.0.0
• Multi-architecture: linux/amd64 and linux/arm64

⁠Quick start

Scan with a mounted AWS profile and save reports to the host:

docker run --rm \
  -v ~/.aws:/root/.aws:ro \
  -v $(pwd)/output:/app/output \
  tarekcheikh/ec2-security-scanner:1.0.0 \
  security --profile default --region us-east-1

Scan with environment-variable credentials:

docker run --rm \
  -e AWS_ACCESS_KEY_ID \
  -e AWS_SECRET_ACCESS_KEY \
  -e AWS_SESSION_TOKEN \
  -v $(pwd)/output:/app/output \
  tarekcheikh/ec2-security-scanner:1.0.0 \
  security --region us-east-1

Compliance report only:

docker run --rm \
  -v ~/.aws:/root/.aws:ro \
  -v $(pwd)/output:/app/output \
  tarekcheikh/ec2-security-scanner:1.0.0 \
  security --compliance-only

Show help:

docker run --rm tarekcheikh/ec2-security-scanner:1.0.0 --help

⁠What it checks

Across 8 categories:

• Instance security: IMDSv2 enforcement and hop limit, public IPv4, IAM instance profile, virtualization type, multiple ENIs, detailed monitoring, and secret detection in UserData.
• Network security: security group rules (SSH, RDP, high-risk ports, remote admin, unauthorized ports, egress), source and destination check, default security group, VPC flow logs, network ACLs, and VPN IKEv2.
• Storage security: EBS volume encryption, account default encryption, public snapshots, public AMIs, backup coverage, and EBS snapshot block public access.
• Access control: IAM role least privilege, key pair usage, serial console, and EC2 Instance Connect endpoints.
• Logging and monitoring: CloudTrail, CloudWatch alarms, SSM managed status, and GuardDuty.
• Patch and vulnerability: SSM patch compliance, AMI age, and Amazon Inspector v2.
• Network exposure: unused Elastic IPs, launch template public IPs, subnet auto-assign, VPC Block Public Access, and Transit Gateway auto-accept.
• Tagging and inventory: required tags, long-stopped instances, and unused security groups.

⁠Compliance frameworks

AWS FSBP, CIS AWS Foundations Benchmark v5.0, PCI DSS v4.0.1, HIPAA Security Rule, SOC 2, ISO 27001:2022, ISO 27017:2015, ISO 27018:2019, GDPR, and NIST SP 800-53 Rev5. Account and region wide controls such as GuardDuty, CloudTrail, and VPC Block Public Access are evaluated once per scan rather than once per instance, so compliance percentages do not scale with fleet size.

⁠Reports

JSON, CSV, and interactive HTML output, plus a dedicated per-framework compliance report. Reports are written to /app/output inside the container, so mount a host directory there to keep them.

⁠Credentials

Provide AWS credentials by mounting ~/.aws to /root/.aws or by passing AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and optionally AWS_SESSION_TOKEN as environment variables. The scanner needs only read-only describe and get permissions; the complete IAM policy is in the GitHub README.

⁠Safety

The scanner is strictly read-only and does not modify any AWS resource. Permission errors are reported as findings rather than aborting the scan.

⁠License

MIT