Cloud audit

The audit runs on your side, on a workstation or in CI, with your own read-only keys. CheckOps keeps no cloud key: the CLI only sends the results (check, severity, resource, advice). Each audit replaces the previous one for the account; the first detection date of a finding is kept. Results are on the Cloud audit page of the portal.

Scaleway

Read-only API key (for example the InstancesReadOnly, KubernetesReadOnly, RelationalDatabasesReadOnly, IAMReadOnly and ObjectStorageReadOnly permission sets).

SCW_SECRET_KEY=… SCW_ACCESS_KEY=… checkops cloud scan scaleway --project-id 11111111-…

Check	Severity
`scw.s3.bucket_public_list`: bucket listable without authentication (needs `SCW_ACCESS_KEY`)	critical
`scw.instance.sg_inbound_accept`: security group accepting inbound traffic by default	high
`scw.instance.sg_admin_port_world`: SSH, RDP, database… open to 0.0.0.0/0	high
`scw.rdb.acl_world`: managed database reachable from the whole Internet	high
`scw.k8s.api_world`: Kapsule Kubernetes API without an access list	medium
`scw.rdb.backup_disabled`: automatic backups disabled	medium
`scw.iam.api_key_no_expiry`: API key without expiry	medium
`scw.iam.api_key_old`: API key older than 90 days (`--key-max-age-days`)	low
`scw.rdb.not_encrypted`: managed database not encrypted	low

Default regions: fr-par,nl-ams,pl-waw (--region). Without --project-id, pass --organization-id to audit the whole organization.

OVHcloud

Create read-only API credentials (token creation) with GET /me* and GET /cloud/* rights, then:

OVH_APPLICATION_KEY=… OVH_APPLICATION_SECRET=… OVH_CONSUMER_KEY=… checkops cloud scan ovh

Check	Severity
`ovh.account.no_2fa`: two-factor authentication disabled on the account	high
`ovh.db.ip_world`: Public Cloud managed database open to 0.0.0.0/0	high
`ovh.kube.api_world`: Kubernetes API (MKS) without IP restrictions	medium
`ovh.api.credential_no_expiry`: API credential without expiry	medium
`ovh.api.credential_unused`: API credential unused for 90 days (`--unused-days`)	low

Use --endpoint ovh-ca or ovh-us for other regions.

AWS, Azure, GCP: Prowler report

Prowler (Apache 2.0) covers hundreds of checks. Run it with your own access, then send the JSON OCSF report:

prowler aws -M json-ocsf
checkops cloud import output/prowler-output-*.ocsf.json

Only failures are kept; passes are counted. One report may cover several accounts.

In CI

--dry-run prints the result without sending it. --fail-on high exits with code 1 if a finding reaches that level. A check that cannot run (missing permission) is recorded as “not run” without stopping the others; if no check could run, nothing is sent.

cloud-audit:
  image: registry.gitlab.com/clearcloud.fr/check-ops/cli:latest
  script:
    - checkops cloud scan scaleway --project-id "$SCW_DEFAULT_PROJECT_ID"
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"