Static analysis for your Infrastructure-as-Code. Finds insecure Terraform, open S3 buckets, permissive IAM policies, missing encryption, and exposed ports before they reach production.
90+ rules across 6 critical security domains. Every misconfiguration, before it ships.
Public S3 buckets, missing server-side encryption, disabled versioning, overly permissive bucket policies, and unprotected static website hosting.
Wildcard IAM policies, missing MFA enforcement, root account usage, overly broad trust relationships, and unused access keys.
Open security groups allowing 0.0.0.0/0, exposed SSH/RDP ports, missing VPC configurations, and unrestricted egress rules.
Missing at-rest encryption on EBS, RDS, and S3. No KMS key rotation, unencrypted data in transit, and weak TLS configurations.
Missing CloudTrail logging, disabled VPC flow logs, no GuardDuty integration, and absent CloudWatch alarms for critical metrics.
Missing resource tags, no backup plans, hardcoded region strings, disabled deletion protection, and non-compliant naming conventions.
One command via ClawHub. CloudGuard plugs into your CI pipeline or runs locally against your IaC directory.
clawhub install cloudguard
Point CloudGuard at your Terraform, CloudFormation, or Kubernetes manifests. It analyzes every resource for misconfigurations.
cloudguard scan --dir ./infra
Get actionable remediation for every finding. Severity ratings, file locations, and fix suggestions in your terminal or CI output.
cloudguard fix --auto
| Feature | Free | Pro | Team |
|---|---|---|---|
| Price | $0 | $19/mo | $39/mo |
| Terraform scanning | ✓ | ✓ | ✓ |
| CloudFormation scanning | ✗ | ✓ | ✓ |
| Kubernetes manifest scanning | ✗ | ✓ | ✓ |
| Built-in rules | 30 | 90+ | 90+ |
| Custom rules | ✗ | ✓ | ✓ |
| Auto-fix suggestions | ✗ | ✓ | ✓ |
| CI/CD integration | Basic | ✓ | ✓ |
| SARIF / JSON reports | ✗ | ✓ | ✓ |
| Drift detection | ✗ | ✗ | ✓ |
| Policy-as-code enforcement | ✗ | ✗ | ✓ |
| Compliance reporting (SOC2, CIS) | ✗ | ✗ | ✓ |
| Team dashboard | ✗ | ✗ | ✓ |
| Priority support | ✗ | ✓ | ✓ |
Start scanning for free. Upgrade for full coverage and auto-fix.
No spam. One email per week max. Unsubscribe anytime.
Install CloudGuard in 30 seconds. Scan your infra before it ships. Free, fast, and thorough.