A lightweight, interactive CLI/TUI for assessing AWS Organizations against NIST SP 800-53 controls. Designed to run directly in AWS CloudShell with zero installation — drop in a single static binary and go.
- Org-wide visibility — enumerate all accounts and OUs across an AWS Organization
- NIST 800-53 compliance scoring — aggregated findings from AWS Security Hub mapped to control families (AC, AU, CM, IA, SC, SI, and more)
- Interactive findings browser — filter by control family, see pass/fail status, severity, and accounts affected
- RMF alignment — findings tagged to the relevant RMF step (Categorize, Select, Implement, Assess, Authorize, Monitor)
- DoD Cloud Computing SRG Impact Level filtering — filter findings and view a compliance score scoped to the minimum DoD CC SRG Impact Level (IL2/IL4/IL5/IL6) a Mission Owner (MO) is targeting
- Threat modeling — guided wizard to generate STRIDE-based threat models for AWS workloads (coming soon)
- Best practices report — custom checks beyond Security Hub standards (coming soon)
- Export-ready — Markdown and JSON output suitable for ATO evidence packages (coming soon)
- Demo mode — realistic fake data for offline use, demos, and portfolio showcases
Download the latest static Linux binary from Releases and run it directly — no Go installation needed:
curl -LO https://github.com/yourname/cloudcomply/releases/latest/download/cloudcomply-linux-amd64
chmod +x cloudcomply-linux-amd64
./cloudcomply-linux-amd64Requires Go 1.21+.
git clone https://github.com/yourname/cloudcomply.git
cd cloudcomply
go build -ldflags="-s -w" -o cloudcomply .
./cloudcomplyCGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o cloudcomply-linux-amd64 .See CLI.md for the full command reference, including headless report nist usage for CI/scripting.
| Key | Action |
|---|---|
↑ / k | Move up |
↓ / j | Move down |
← / h | Previous control family filter |
→ / l | Next control family filter |
[ | Previous DoD SRG impact level filter |
] | Next DoD SRG impact level filter |
Enter | Select / open |
Esc / q | Back / quit |
Ctrl+C | Force quit |
The tool requires read-only access. Run from a role in your Security Hub delegated admin account with at minimum:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"securityhub:GetFindings",
"securityhub:GetFindingStatistics",
"securityhub:ListFindingAggregators",
"organizations:ListAccounts",
"organizations:ListOrganizationalUnitsForParent",
"organizations:DescribeOrganization",
"sts:GetCallerIdentity"
],
"Resource": "*"
}
]
}For cross-account checks: add sts:AssumeRole and a trust policy in member accounts.
| Feature | Status |
|---|---|
| Dashboard + NIST compliance score | ✅ Done |
| Findings browser (with family filter) | ✅ Done |
| Demo mode (realistic fake data) | ✅ Done |
| Cobra CLI command structure | ✅ Done |
| Live Security Hub integration | 🔲 Planned |
| Threat modeling wizard | 🔲 Planned |
| Best practices custom checks | 🔲 Planned |
| Markdown / JSON report export | 🔲 Planned |
- Bubble Tea — TUI framework
- Bubbles — table, spinner, and other TUI components
- Lip Gloss — terminal styling
- AWS SDK for Go v2 — AWS API client (planned)
- Cobra — CLI command structure (planned)
Findings are mapped to NIST SP 800-53 Rev. 5 control families and tagged to the relevant RMF step, making them directly usable as evidence in an ATO package.
| Control Family | Coverage |
|---|---|
| AC — Access Control | ✅ |
| AU — Audit and Accountability | ✅ |
| CM — Configuration Management | ✅ |
| IA — Identification and Authentication | ✅ |
| SC — System and Communications Protection | ✅ |
| SI — System and Information Integrity | ✅ |
| Additional families | Planned |
Each finding is tagged with the lowest DoD Cloud Computing Security Requirements Guide (SRG) Impact Level at which it's required, so a Mission Owner (MO) can score compliance against the specific IL they're targeting rather than the full control catalog. Levels are cumulative — a control required at IL2 is also in scope at IL4/IL5/IL6.
| Impact Level | Typical Data Sensitivity |
|---|---|
| IL2 | Non-controlled unclassified information (public/low-sensitivity) |
| IL4 | Controlled Unclassified Information (CUI) |
| IL5 | Higher-sensitivity CUI and National Security Systems |
| IL6 | Classified information up to SECRET |
The dashboard shows a compliance score scoped to a target Impact Level, and the findings browser lets you filter to only the controls in scope for that level ([ / ] to cycle levels).
MIT