cloudcomply

A lightweight, interactive CLI/TUI for assessing AWS Organizations against NIST SP 800-53 controls. Designed to run directly in AWS CloudShell with zero installation — drop in a single static binary and go.

---

Features

• Org-wide visibility — enumerate all accounts and OUs across an AWS Organization
• NIST 800-53 compliance scoring — aggregated findings from AWS Security Hub mapped to control families (AC, AU, CM, IA, SC, SI, and more)
• Interactive findings browser — filter by control family, see pass/fail status, severity, and accounts affected
• RMF alignment — findings tagged to the relevant RMF step (Categorize, Select, Implement, Assess, Authorize, Monitor)
• DoD Cloud Computing SRG Impact Level filtering — filter findings and view a compliance score scoped to the minimum DoD CC SRG Impact Level (IL2/IL4/IL5/IL6) a Mission Owner (MO) is targeting
• Threat modeling — guided wizard to generate STRIDE-based threat models for AWS workloads (coming soon)
• Best practices report — custom checks beyond Security Hub standards (coming soon)
• Export-ready — Markdown and JSON output suitable for ATO evidence packages (coming soon)
• Demo mode — realistic fake data for offline use, demos, and portfolio showcases

---

Quick Start

Run in AWS CloudShell (recommended)

Download the latest static Linux binary from Releases and run it directly — no Go installation needed:

curl -LO https://github.com/yourname/cloudcomply/releases/latest/download/cloudcomply-linux-amd64
chmod +x cloudcomply-linux-amd64
./cloudcomply-linux-amd64

Build from source

Requires Go 1.21+.

git clone https://github.com/yourname/cloudcomply.git
cd cloudcomply
go build -ldflags="-s -w" -o cloudcomply .
./cloudcomply

Cross-compile a static binary for CloudShell

CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o cloudcomply-linux-amd64 .

See CLI.md for the full command reference, including headless report nist usage for CI/scripting.

---

Navigation

Key	Action
↑ / k	Move up
↓ / j	Move down
← / h	Previous control family filter
→ / l	Next control family filter
[	Previous DoD SRG impact level filter
]	Next DoD SRG impact level filter
Enter	Select / open
Esc / q	Back / quit
Ctrl+C	Force quit

---

AWS Permissions

The tool requires read-only access. Run from a role in your Security Hub delegated admin account with at minimum:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "securityhub:GetFindings",
        "securityhub:GetFindingStatistics",
        "securityhub:ListFindingAggregators",
        "organizations:ListAccounts",
        "organizations:ListOrganizationalUnitsForParent",
        "organizations:DescribeOrganization",
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    }
  ]
}

For cross-account checks: add sts:AssumeRole and a trust policy in member accounts.

---

Project Status

Feature	Status
Dashboard + NIST compliance score	✅ Done
Findings browser (with family filter)	✅ Done
Demo mode (realistic fake data)	✅ Done
Cobra CLI command structure	✅ Done
Live Security Hub integration	🔲 Planned
Threat modeling wizard	🔲 Planned
Best practices custom checks	🔲 Planned
Markdown / JSON report export	🔲 Planned

---

Tech Stack

• Bubble Tea — TUI framework
• Bubbles — table, spinner, and other TUI components
• Lip Gloss — terminal styling
• AWS SDK for Go v2 — AWS API client (planned)
• Cobra — CLI command structure (planned)

---

NIST / RMF Mapping

Findings are mapped to NIST SP 800-53 Rev. 5 control families and tagged to the relevant RMF step, making them directly usable as evidence in an ATO package.

Control Family	Coverage
AC — Access Control	✅
AU — Audit and Accountability	✅
CM — Configuration Management	✅
IA — Identification and Authentication	✅
SC — System and Communications Protection	✅
SI — System and Information Integrity	✅
Additional families	Planned

---

DoD Cloud Computing SRG Impact Levels

Each finding is tagged with the lowest DoD Cloud Computing Security Requirements Guide (SRG) Impact Level at which it's required, so a Mission Owner (MO) can score compliance against the specific IL they're targeting rather than the full control catalog. Levels are cumulative — a control required at IL2 is also in scope at IL4/IL5/IL6.

Impact Level	Typical Data Sensitivity
IL2	Non-controlled unclassified information (public/low-sensitivity)
IL4	Controlled Unclassified Information (CUI)
IL5	Higher-sensitivity CUI and National Security Systems
IL6	Classified information up to SECRET

The dashboard shows a compliance score scoped to a target Impact Level, and the findings browser lets you filter to only the controls in scope for that level ([ / ] to cycle levels).

---

License

MIT