← back

Aura

An AWS cloud security posture scanner, written in Go.

built
2026, over 2-3 months of research and building
stack
Go, PostgreSQL, Starlark, React, AWS (SQS, CloudTrail, Config, ECS Fargate)
coverage
24 scanners, 83 rules, 19 AWS services

Why

Cloud security platforms like Wiz are excellent, and priced for enterprises. Most smaller companies can't justify that, so they run AWS without really knowing what they have or what's exposed. That's a real risk: one leaked access key or one public bucket is enough.

So I built the foundation myself, in two layers. First, ingestion and inventory: an accurate, always-current picture of every resource in the account. Second, scanning on top of it: rules that turn that picture into findings someone can act on. Both are designed so the next layers, like a graph of how resources connect and what's actually reachable from the internet, can sit on top without a rewrite.

Screens

From connecting an account to the dashboard after the first scan. All data here is made up.

Onboarding, step 1: what you need before connecting an account
Onboarding, step 1: what you need before connecting an account
Onboarding, step 2: the account, the read-only role and the region
Onboarding, step 2: the account, the read-only role and the region
Onboarding, step 3: connected, first scan running
Onboarding, step 3: connected, first scan running
Posture: score, open findings by severity, what to fix first, risk by service, scanner health
Posture: score, open findings by severity, what to fix first, risk by service, scanner health
Findings: each one expands into its details and its full state history
Findings: each one expands into its details and its full state history
Inventory: every resource grouped by service, with tags, owner and attached findings
Inventory: every resource grouped by service, with tags, owner and attached findings
SLA breaches: what's overdue and by how long
SLA breaches: what's overdue and by how long
1 / 7

How it works

Aura architecture: AWS APIs, CloudTrail and AWS Config feed scanners, an ingestor and a drift check into a Postgres inventory; rules evaluate the inventory into findings, which go to alerts and to the API and dashboard. your AWS account AWS APIs CloudTrail AWS Config EventBridge → SQS scanners ingestor drift check read-only role, on a schedule config snapshots inventory Postgres rules Starlark findings lifecycle, SLAs alerts Slack, PagerDuty API dashboard

Rules

Rules live in their own repository and are written in Starlark, a small, sandboxed dialect of Python. That means a security engineer can add a check without touching Go or redeploying: Aura watches the rules folder and hot-reloads on change. A rule looks like this:

COMPLIANCE = {
    "cis_aws_foundations": ["2.1.1"],
    "soc2": ["CC6.1"],
    "pci_dss": ["2.2"],
    "nist_800_53": ["AC-3", "AC-6"],
}

def evaluate(resource):
    pab = resource["public_access_block"]
    if not pab["block_public_acls"] or not pab["ignore_public_acls"]:
        return finding("S3-001", "HIGH",
            "S3 bucket does not block public ACLs", ..., "s3")
    return no_finding("S3-001")

What it covers

IAM (users, roles, policies), S3, EC2 and security groups, VPC and subnets, ELB, CloudFront, RDS, Lambda, KMS, Secrets Manager, CloudTrail, AWS Config, ECR, ECS, EKS, GuardDuty, Security Hub, Inspector and IAM Access Analyzer.

Findings that don't turn into noise

Running it

How I built it

Most of the time went into research: how existing posture tools model an inventory, how they keep findings from turning into noise, and which AWS services produce the findings that matter most. Then I built it in layers: the inventory schema first, then hardened scanners, real-time ingestion, the rule library, and coverage from 5 to 19 services.

Not done yet