cloudtoolkit

CloudToolKit

English | 简体中文

Multi-cloud defensive validation toolkit for CSPM / CNAPP detection, telemetry, and investigation workflows in authorized environments.

CloudToolKit gives security teams a practical way to verify whether cloud controls are discoverable, detectable, alertable, and investigable before those gaps matter in production.

Why CloudToolKit

Capability Matrix

Every provider supports cloudlist asset enumeration. Asset categories include host / database / bucket / domain / account / log / sms / balance where the cloud has a native equivalent.

Validation payload coverage:

Legend: iam = user lifecycle · bucket = object visibility · event = audit log review · cmd = instance command telemetry · rds = database account lifecycle · role = privilege binding change · acl = storage exposure · cred = long-lived credential lifecycle. — = no native equivalent or pending validation.

Quick Start

go build --ldflags "-s -w" -trimpath -o ctk cmd/main.go
./ctk                                    # interactive REPL
./ctk <provider> <action> [args] [flags] # headless one-shot

Try demo inside the REPL to drive any provider against an in-memory replay (no live cloud calls).

Responsible Use

Use only on owned, lab, internal, or explicitly authorized customer environments to verify detection coverage, telemetry quality, investigation workflow, and control effectiveness. CloudToolKit is not a stealth, bypass, or unauthorized intrusion utility and must not be used against third-party environments without permission.

Documentation

• Wiki — usage, payload references, replay walkthroughs

Acknowledgements

• c-bata/go-prompt
• projectdiscovery/cloudlist