Skip to main content

AWS security findings from configuration snapshots — no credentials required

First finding on your own account in under fifteen minutes. Under five if you already run AWS Config or Steampipe.

Get Started

What you get

★ findings are configuration-graph findings — relationships between resources that single-setting scanners cannot see.

FINDINGS:

  HIGH  CTL.S3.BUCKET.VERSIONING.001
        Bucket "prod-data" does not have versioning enabled
        evidence: versioning.status = "Disabled"

  CRITICAL  CTL.CLOUDTRAIL.GHOST.DEST.001          ★ STAVE ONLY
        CloudTrail trail "prod-trail" references destination bucket
        "prod-logs-2024" which does not appear in this account snapshot
        evidence: trail.s3_bucket_name has no matching asset

Try in a sandbox

docker run --rm stave-demo

Nothing installed on your machine. Stop the container and it's gone.

Install locally

# Install (any OS)
go install github.com/sufield/stave/cmd/stave@latest

# Run against your snapshot
stave apply --observations ./my-snapshot/

macOS: brew install sufield/tap/stave