segrep-cloud scanner

Opt-in cloud security scanner for AWS, GCP, Azure credentials, IAM, and Terraform

Opt-in cloud security scanner for Segrep that detects credential exposure, misconfigurations, and risky IAM policies across AWS, GCP, Azure, Serverless Framework, CloudFormation, Terraform, and Docker — no external binary required.

Why use segrep-cloud

Detects exposed AWS access keys, secret keys, session tokens, and environment variables across .aws/ directories, .env files, and config files.
Flags overly permissive IAM policies (wildcard Action: '*', wildcard Resource: '*', AdministratorAccess) in Terraform, CloudFormation, and Serverless Framework configs.
Catches insecure Terraform resources: public S3 buckets, publicly accessible RDS instances, unencrypted EBS volumes, open security groups.
Identifies cloud metadata access in Dockerfiles (169.254.169.254) and Kubernetes secrets with embedded cloud credentials.
Scans environment variable files for database URLs, GCP service account paths, and Azure credentials.
Runs locally with zero dependencies — no Prowler binary, no Docker, no cloud API access required.

Scanner behavior

segrep-cloud runs as an opt-in scanner.

pnpm segrep scan . --scanners segrep-cloud

It walks the scan root and applies rules against cloud-relevant files:

.aws/config, .aws/credentials
.env, .env.local, .env.production, .env.development
*.tf, *.hcl (Terraform)
*.yml, *.yaml (CloudFormation, Serverless Framework, Kubernetes)
*.json (CDK, SAM templates)
Dockerfile (cloud metadata access)
credentials, config, serverless.yml, samconfig.toml, cdk.json

Rules

AWS Credentials

Rule ID	Severity	What it detects
`cloud-aws-access-key`	critical	AWS Access Key IDs (`AKIA...`) in any file
`cloud-aws-secret-key`	critical	AWS Secret Access Key assignments
`cloud-aws-session-token`	critical	AWS Session Token assignments
`cloud-aws-config-output`	low	AWS CLI config with `output = json`

Environment Variables

Rule ID	Severity	What it detects
`cloud-env-aws-key`	critical	`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` in `.env` files
`cloud-env-gcp-key`	critical	`GOOGLE_APPLICATION_CREDENTIALS` in `.env` files
`cloud-env-azure-key`	critical	`AZURE_CLIENT_SECRET` / `ARM_ACCESS_KEY` in `.env` files
`cloud-env-database-url`	critical	`DATABASE_URL`, `REDIS_URL`, `MONGO_URI` with embedded credentials

Terraform

Rule ID	Severity	What it detects
`cloud-tf-s3-public`	high	S3 bucket with `block_public_acls = false`
`cloud-tf-s3-unencrypted`	high	S3 bucket without server-side encryption config
`cloud-tf-s3-no-versioning`	medium	S3 bucket without versioning
`cloud-tf-iam-admin`	critical	IAM policy with `Action = "*"`
`cloud-tf-iam-wildcard-resource`	high	IAM policy with `Resource = "*"`
`cloud-tf-rds-public`	critical	RDS instance with `publicly_accessible = true`
`cloud-tf-rds-unencrypted`	high	RDS instance without `storage_encrypted = true`
`cloud-tf-ebs-unencrypted`	high	EBS volume without encryption
`cloud-tf-sg-open`	high	Security group with `0.0.0.0/0` ingress
`cloud-tf-logging-disabled`	medium	S3 bucket without CloudTrail or VPC Flow Logs

CloudFormation

Rule ID	Severity	What it detects
`cloud-cf-s3-public`	high	S3 bucket with `AccessControl: PublicRead`
`cloud-cf-iam-admin`	critical	IAM policy with `AdministratorAccess`

Serverless Framework

Rule ID	Severity	What it detects
`cloud-sls-iam-admin`	critical	Serverless IAM role with `Action: ''` or `Resource: ''`
`cloud-sls-public-bucket`	high	Serverless S3 bucket with `acl: public-read`

Docker + Kubernetes

Rule ID	Severity	What it detects
`cloud-docker-expose-cloud-port`	critical	Dockerfile referencing `169.254.169.254` (cloud metadata)
`cloud-k8s-aws-iam-auth`	medium	Kubernetes using AWS IAM authenticator (prefer OIDC)
`cloud-k8s-cloud-credentials-secret`	critical	Kubernetes Secret with embedded cloud credentials

Misc

Rule ID	Severity	What it detects
`cloud-hardcoded-region`	low	Hardcoded cloud region in config (`us-east-1`, etc.)

Finding output

Each finding includes:

ruleId — the matched rule (e.g., cloud-aws-access-key)
cweId — CWE reference (e.g., CWE-798 for hardcoded credentials)
line — line number where the issue was found
snippet — the matched line (truncated to 200 chars)

Example finding:

{
  "id": "segrep-cloud:cloud-aws-access-key:.aws/credentials:2",
  "title": "AWS Access Key ID exposed in file",
  "severity": "critical",
  "filePath": ".aws/credentials",
  "scanner": "segrep-cloud",
  "category": "cloud",
  "ruleId": "cloud-aws-access-key",
  "cweId": "CWE-798",
  "line": 2,
  "snippet": "aws_access_key_id = AKIAIOSFODNN7EXAMPLE"
}

File coverage

Scanned extensions

.tf, .hcl, .yaml, .yml, .json, .env, .env.local, .env.production, .env.development, .toml, .ini, .cfg, .conf

Scanned filenames

credentials, config, serverless.yml, serverless.yaml, template.json, template.yaml, template.yml, samconfig.toml, cdk.json, Dockerfile

Special directories

.aws/ — scans credentials and config files
.env* — all environment variable files

Excluded directories

.git, node_modules, dist, build, .next, .nuxt, coverage, .nyc_output, vendor, .tox, __pycache__, .cache, .parcel-cache, tmp, .segrep

Relationship to external scanners

Scanner	Coverage	Dependency
`segrep-cloud`	AWS/GCP/Azure credentials, IAM, Terraform, CloudFormation, Serverless, Docker, K8s	None (native)
`prowler`	AWS cloud posture (200+ checks)	Prowler binary + AWS credentials
`checkov`	IaC misconfigurations (Terraform, K8s, Dockerfile)	Checkov binary

Use segrep-cloud for fast local credential and IAM scans. Use prowler for deep AWS posture checks. Use checkov for broader IaC misconfiguration coverage.

Policy integration

scanners:
  - segrep-cloud

# Allowlist known-good findings by rule ID
allowlist:
  - cloud-hardcoded-region

# Ignore test fixtures
ignore_paths:
  - "fixtures/**"
  - "**/*.test.*"

Examples

Cloud security only:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-cloud

Combine with IaC scanning:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-cloud,segrep-iac --format json

Fail CI on any critical cloud finding:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-cloud --fail-on critical

Product scan guide
Docker image reference
Add a scanner
segrep-iac — local IaC misconfiguration scanner
segrep-secrets — native secret detection