CloudGuard

Most AWS breaches trace back to a handful of repeated misconfigurations: over-broad IAM policies, public buckets, and security groups open to the world.

Express those checks as code that runs in a pipeline, so the failure is caught at deploy time rather than at incident time.

• 01Wrote the check set as declarative rules covering IAM, S3 and security-group exposure.
• 02Packaged with Docker so it runs identically locally and in CI.
• 03Designed the output to be machine-consumable for downstream tooling.

This is a focused tool, not a competitor to a commercial CSPM platform. Its value is that it is small enough to read end to end and drop into a pipeline in an afternoon.