cloud-scanner-matrix

Cross-scanner cloud posture orchestrator — normalize Prowler, ScoutSuite, PMapper, Plexavo into one deduped view.

Pain: Every team compares point scanners manually, mapping different severities and JSON shapes, copy-pasting fixes. You run 4 tools, you get 11 findings, 4 are duplicates, no single SARIF to upload to GitHub. Fix: One Go binary that reads *.json from --input-dir, normalizes to common Finding{Tool, RuleID, Title, Severity, Resource, Region, Fix}, dedupes by resource+rule keeping highest severity, outputs table/SARIF/HTML/Markdown.

Sister repos

• aws-iam-paths — IAM privilege escalation path finder — 17 techniques, 9 demo paths
• aws-s3-acl-drift — S3 ACL ghost perms detector
• cloud-scanner-matrix (this) — meta-scanner normalizer — 4 tools → 7 unique

Together they form a lightweight CSPM triad: identity paths, storage drift, posture matrix.

Quickstart

go install github.com/SandwichProtector/cloud-scanner-matrix@latest

# demo — 11 raw findings from 4 tools -> 7 unique after dedup, no AWS creds
cloud-scanner-matrix analyze --demo
cloud-scanner-matrix analyze --demo --format json | jq
cloud-scanner-matrix analyze --demo --format sarif > results.sarif
cloud-scanner-matrix analyze --demo --format html > matrix.html && open matrix.html

# real dir mode — glob *.json, auto-detect tool by filename/content
cloud-scanner-matrix analyze --input-dir ./findings --dedup --format table
cloud-scanner-matrix analyze --input-dir ./findings --severity-threshold HIGH --format markdown
cloud-scanner-matrix analyze --input-dir ./findings --format sarif -o results.sarif
cloud-scanner-matrix analyze --input-dir ./findings --format html -o matrix.html

Demo output (7 unique from 11)

TOOL         RULE                           RESOURCE                                      SEVERITY   MERGED
prowler      rds_public_snapshot            rds:snapshot/my-prod-db                       HIGH       2 tools
pmapper      PassRole_EC2                   arn:aws:iam::123:user/bob                     CRITICAL
pmapper      AssumeRole_Chain               arn:aws:iam::123:user/bob                     HIGH
plexavo      kms_key_public_access          arn:aws:kms:us-east-1:123:key/abcd-1234       MEDIUM
prowler      s3_bucket_public_write         arn:aws:s3:::user-uploads-2023                CRITICAL   2 tools
prowler      iam_user_with_admin            arn:aws:iam::123:user/alice                   CRITICAL   2 tools
prowler      ec2_instance_public_ip         i-0a1b2c3d4e5f                                HIGH

MergedFrom shows same resource+rule seen by 2 tools — we keep highest severity.

Architecture

                 ┌─────────────┐
                 │  prowler    │  5 findings  ─┐
                 └─────────────┘              │
                 ┌─────────────┐              ├─► Normalize{Tool,RuleID,Title,Severity,Resource,Region,Fix}
                 │ scoutsuite  │  3 findings ─┤       │
                 └─────────────┘              │       ├─► Dedup by resource+rule (11 -> 7)
                 ┌─────────────┐              │       │        └─► Highest severity kept
                 │ pmapper     │  2 findings ─┤       │
                 └─────────────┘              │       └─► Filter --severity-threshold
                 ┌─────────────┐              │
                 │ plexavo     │  1 finding  ─┘
                 └─────────────┘
                                   │
                                   ▼
                     table | json | sarif 2.1.0 | markdown | html(dark + vis-network graph)

Why dedup matters: same S3 s3_bucket_public_write shows as CRITICAL in Prowler and HIGH in ScoutSuite — we surface once as CRITICAL with merged_from=[prowler,scoutsuite].

Formats

• table — human triage, shows MERGED column
• json — []Finding for scripting/jq
• sarif — GitHub code scanning upload, rules tagged cspm,prowler,scoutsuite
• markdown — PR comment friendly
• html — dark-theme standalone with badge counts, tool → finding graph (vis-network), demo GIFs header

Tool detection

• --input-dir globs *.json
• Detect by filename: *prowler*.json, *scout*.json, *pmapper*, *plexavo*
• Fallback by content hints: Prowler has check_id+status, ScoutSuite has services, PMapper has escalation+principal, Plexavo has plexavo
• Unknown → tries all parsers, picks first that succeeds

Topics / Tags

go cspm prowler scoutsuite pmapper cloud-security posture scanner-orchestrator sarif dedup normalization

Related threads

• S3 ACL Ghost Perms: https://old.reddit.com/r/aws/comments/1l0s7qy/someone_created_s3_bucket_without_a_proper_bucket/
• Startup CIS Light: https://old.reddit.com/r/aws/comments/1kyqu56/what_do_you_think_solo_founders_and_small_teams/
• Shadow IAM actions: https://old.reddit.com/r/aws/comments/1l23u2t/whats_the_deal_with_ssmmessages_actions/

License

MIT — Ekansh Grover 2026