Metadata-Version: 2.4
Name: vamp-iac-audit
Version: 2.7.2
Summary: Infrastructure-as-Code security auditor: Terraform, CloudFormation, Helm, Ansible, Pulumi and AWS SAM/CDK — 319 checks, 12 YAML rule files
Author-email: VampSecure Studios <contact@vampsecurestudios.com>
License: AGPL-3.0-only
Project-URL: Homepage, https://github.com/Vampsecure-Labs/vamp-iac-audit
Project-URL: Repository, https://github.com/Vampsecure-Labs/vamp-iac-audit
Keywords: security,pentest,terraform,cloudformation,helm,iac,devsecops,vampsecure,cloud
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Console
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.9
Description-Content-Type: text/markdown
Requires-Dist: rich>=13.7.0
Requires-Dist: pyyaml>=6.0

<!-- © VampSecure Studios — VampSecure Labs Security Research Division -->
<h1 align="center">vamp-iac-audit</h1>

<p align="center">
  <img src="https://img.shields.io/badge/python-3.9%2B-blue?logo=python&logoColor=white" alt="Python 3.9+"/>
  <img src="https://img.shields.io/badge/platform-linux%20%7C%20macOS%20%7C%20windows-lightgrey" alt="Platform"/>
  <img src="https://img.shields.io/badge/license-AGPL--3.0-green" alt="License AGPL-3.0"/>
  <img src="https://img.shields.io/badge/VampSecure-Labs-magenta" alt="VampSecure Labs"/>
  <img src="https://github.com/Vampsecure-Labs/vamp-iac-audit/actions/workflows/ci.yml/badge.svg" alt="CI"/>
</p>

> 🇬🇧 [English](#english) · 🇪🇸 [Español](#español)

---

<a name="english"></a>
## 🇬🇧 English

### Overview

`vamp-iac-audit` is a static analysis security auditor for Infrastructure-as-Code files. It recursively scans directories for Terraform HCL, AWS CloudFormation, and Helm chart configurations, detecting misconfigurations and insecure defaults aligned with CIS benchmarks, MITRE ATT&CK TTPs, and cloud provider security best practices. Findings are rated CRITICAL to LOW and exported to Console (Rich), JSON, or HTML.

### Features

- **Terraform module** (IAC-TF-001 to IAC-TF-010): security groups open to `0.0.0.0/0` (CRITICAL), public S3 ACLs (HIGH), IAM wildcard actions/resources (HIGH), publicly accessible RDS instances (HIGH), unencrypted root block devices (MEDIUM), sensitive variable names without `sensitive = true` (MEDIUM), hardcoded secrets (`sk_`, `ghp_`, `AKIA`) (CRITICAL), SSH/RDP open to the world (CRITICAL), RDS without backup retention (MEDIUM), GCP firewall open to `0.0.0.0/0` (HIGH)
- **CloudFormation module** (IAC-CF-001 to IAC-CF-008): security groups with protocol `-1` open to `0.0.0.0/0` (CRITICAL), public S3 access control (HIGH), IAM wildcard policies (HIGH), publicly accessible RDS (HIGH), unprotected password parameters missing `NoEcho` (MEDIUM), SSH/RDP open security groups (CRITICAL), KMS without key rotation (LOW), S3 without bucket encryption (MEDIUM)
- **Helm module** (IAC-HLM-001 to IAC-HLM-008): privileged containers (CRITICAL), hostNetwork usage (HIGH), hostPID/hostIPC (HIGH), missing `runAsNonRoot` (MEDIUM), missing resource limits (MEDIUM), hardcoded secrets in env values (CRITICAL), auto-mounted service account tokens (LOW), dangerous Linux capabilities `SYS_ADMIN`/`NET_ADMIN`/`SYS_PTRACE` (HIGH)
- Auto-detection of IaC type when no explicit flag is provided
- Recursive directory scanning
- Per-file findings with line numbers and resource names
- MITRE ATT&CK and CIS Benchmark references per finding
- Rich console output: findings table per file + summary by severity, IaC type and module
- Export to JSON (machine-readable) and HTML (standalone dark-theme)
- Exit code 1 on CRITICAL/HIGH findings for CI/CD pipeline integration

### Requirements

- Python 3.9 or later
- `rich >= 13.7.0`
- `pyyaml >= 6.0`

### Installation

```bash
pip install vamp-iac-audit
# or with Homebrew:
brew install vampsecure-labs/labs/vamp-iac-audit
```

```bash
git clone https://github.com/Vampsecure-Labs/vamp-iac-audit.git
cd vamp-iac-audit
python3 -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -r requirements.txt
```

### Usage

```
vamp-iac-audit scan --help
```

```
usage: vamp-iac-audit scan [-h] --path DIR
                            [--terraform] [--cloudformation] [--helm]
                            [--json FILE] [--html FILE]
```

### Examples

```bash
# Scan all IaC types in current directory (auto-detect)
vamp-iac-audit scan --path .

# Scan only Terraform files
vamp-iac-audit scan --path ./infra --terraform

# Scan only CloudFormation templates
vamp-iac-audit scan --path ./cfn --cloudformation

# Scan only Helm charts
vamp-iac-audit scan --path ./charts --helm

# Export findings to JSON and HTML
vamp-iac-audit scan --path ./infra --json results.json --html report.html

# Scan multiple types explicitly
vamp-iac-audit scan --path ./infra --terraform --cloudformation
```

### CLI Reference

| Flag | Default | Description |
|------|---------|-------------|
| `--path DIR` | required | Directory to scan recursively |
| `--terraform` | auto | Scan Terraform `.tf` and `.tfvars` files |
| `--cloudformation` | auto | Scan CloudFormation YAML/JSON templates |
| `--helm` | auto | Scan Helm chart `templates/*.yaml` files |
| `--json FILE` | — | Export results to JSON |
| `--html FILE` | — | Export dark-theme standalone HTML report |

### Output Formats

| Format | Flag | Description |
|--------|------|-------------|
| Console | (default) | Rich tables per file with color-coded findings by severity |
| JSON | `--json FILE` | Machine-readable full result set |
| HTML | `--html FILE` | Dark-theme standalone report |

### Checks Reference

#### Terraform (IAC-TF-*)

| ID | Check | Severity | MITRE |
|----|-------|----------|-------|
| IAC-TF-001 | `aws_security_group` with `cidr_blocks = ["0.0.0.0/0"]` on ingress | CRITICAL | T1190 |
| IAC-TF-002 | `aws_s3_bucket` with `acl = "public-read"` or `"public-read-write"` | HIGH | T1530 |
| IAC-TF-003 | `aws_iam_policy` with `Action = "*"` or `Resource = "*"` | HIGH | T1098 |
| IAC-TF-004 | `aws_db_instance` with `publicly_accessible = true` | HIGH | T1190 |
| IAC-TF-005 | `aws_instance`/`aws_launch_template` without `encrypted` on root block device | MEDIUM | T1486 |
| IAC-TF-006 | Variable with `sensitive = false` and name containing `password`/`secret`/`key`/`token` | MEDIUM | T1552 |
| IAC-TF-007 | Hardcoded secret value pattern (`sk_`, `ghp_`, `AKIA`) | CRITICAL | T1552 |
| IAC-TF-008 | `aws_security_group` with port 22 or 3389 open to `0.0.0.0/0` | CRITICAL | T1021 |
| IAC-TF-009 | `aws_rds_cluster` without `backup_retention_period` or set to 0 | MEDIUM | T1485 |
| IAC-TF-010 | `google_compute_firewall` with `source_ranges = ["0.0.0.0/0"]` | HIGH | T1190 |

#### CloudFormation (IAC-CF-*)

| ID | Check | Severity |
|----|-------|----------|
| IAC-CF-001 | SecurityGroup with `IpProtocol: "-1"` and `CidrIp: "0.0.0.0/0"` | CRITICAL |
| IAC-CF-002 | S3 with `AccessControl: PublicRead` or `PublicReadWrite` | HIGH |
| IAC-CF-003 | IAM Policy with `Action: "*"` or `Resource: "*"` | HIGH |
| IAC-CF-004 | RDS with `PubliclyAccessible: true` | HIGH |
| IAC-CF-005 | String parameter without `NoEcho: true` and name containing `password`/`secret`/`key` | MEDIUM |
| IAC-CF-006 | SecurityGroup with port 22/3389 open to `0.0.0.0/0` | CRITICAL |
| IAC-CF-007 | KMS without `EnableKeyRotation: true` | LOW |
| IAC-CF-008 | S3 without `BucketEncryption` configured | MEDIUM |

#### Helm (IAC-HLM-*)

| ID | Check | Severity |
|----|-------|----------|
| IAC-HLM-001 | `securityContext.privileged: true` | CRITICAL |
| IAC-HLM-002 | `hostNetwork: true` | HIGH |
| IAC-HLM-003 | `hostPID: true` or `hostIPC: true` | HIGH |
| IAC-HLM-004 | Missing `securityContext.runAsNonRoot: true` | MEDIUM |
| IAC-HLM-005 | Missing `resources.limits` in containers | MEDIUM |
| IAC-HLM-006 | Env value with hardcoded secret pattern (`sk_`, `ghp_`, `AKIA`, `ey...`) | CRITICAL |
| IAC-HLM-007 | `serviceAccount.automountServiceAccountToken: true` (default) | LOW |
| IAC-HLM-008 | `capabilities.add` with `SYS_ADMIN`, `NET_ADMIN`, or `SYS_PTRACE` | HIGH |

### Exit Codes

| Code | Meaning | CI/CD Behavior |
|------|---------|----------------|
| `0` | No critical or high findings | Pipeline passes |
| `1` | Critical or high findings detected | Pipeline fails — review required |
| `2` | Execution error | Pipeline fails — check configuration |

### Sample Output

```text
vamp-iac-audit v2.7.2 · path: ./infra  (auto-detect: terraform + helm)
─────────────────────────────────────────────────────────────────────────
File: infra/networking/main.tf
  [CRITICAL] IAC-TF-001  aws_security_group "web-sg": ingress port 0-65535
             from 0.0.0.0/0  line 14  resource: aws_security_group.web-sg
  [CRITICAL] IAC-TF-008  aws_security_group "bastion-sg": SSH (22) open to 0.0.0.0/0
             line 31  resource: aws_security_group.bastion-sg

File: infra/storage/s3.tf
  [HIGH]     IAC-TF-002  aws_s3_bucket "app-uploads": acl = "public-read"
             line 8  resource: aws_s3_bucket.app-uploads
  [MEDIUM]   IAC-TF-005  aws_instance "web-server": root_block_device not encrypted
             line 52  resource: aws_instance.web-server

File: charts/api/templates/deployment.yaml
  [CRITICAL] IAC-HLM-001 Container "api": securityContext.privileged: true
             line 39  container: api
  [HIGH]     IAC-HLM-002 Pod spec: hostNetwork: true
             line 12
  [MEDIUM]   IAC-HLM-004 Container "api": missing runAsNonRoot: true
             line 39

┌──────────────────┬────────┬──────┬────────┬──────┬──────────────┐
│ IaC type         │ Files  │ Pass │  Fail  │ Skip │ Findings     │
├──────────────────┼────────┼──────┼────────┼──────┼──────────────┤
│ Terraform        │   6    │  41  │   6    │   2  │ 3C 2H 1M     │
│ Helm             │   3    │  15  │   3    │   1  │ 1C 1H 1M     │
└──────────────────┴────────┴──────┴────────┴──────┴──────────────┘
4 CRITICAL · 3 HIGH · 2 MEDIUM   exit 1
```

---

### Why vamp-iac-audit vs. Checkov · Terrascan · KICS

| Feature | vamp-iac-audit | Checkov | Terrascan | KICS |
|---------|----------------|---------|-----------|------|
| Extensible YAML engine (no Python per rule) | ✅ 13 YAML files | ❌ Python per check | ❌ Rego (OPA) | ⚠️ JSON queries |
| Native Pulumi YAML | ✅ | ❌ | ❌ | ❌ |
| Native Ansible YAML | ✅ | ✅ | ❌ | ✅ |
| SAM / AWS Serverless | ✅ | ✅ | ⚠️ partial | ✅ |
| MITRE ATT&CK Cloud rules per finding | ✅ | ❌ | ✅ | ❌ |
| No external dependencies (only `rich` + `pyyaml`) | ✅ | ❌ multiple deps | ❌ Go binary | ❌ Node.js |
| Dark-theme standalone HTML report | ✅ | ⚠️ basic HTML | ✅ | ✅ |
| CI/CD exit codes 0/1/2 | ✅ | ✅ | ✅ | ✅ |

- **Extensible YAML engine without recompiling**: adding a check means writing 5 lines of YAML in the appropriate file — no Python code to touch, no Rego (OPA), no binary recompilation.
- **Pulumi YAML coverage**: the only open-source auditor with native Pulumi support (AWS, Azure and GCP) in an extensible engine.
- **MITRE ATT&CK Cloud traceability**: each finding carries the TTP (T1190, T1552, T1098…) in addition to the CIS reference — facilitates correlation with the SOC and threat reports.
- **Minimal installation**: `pip install vamp-iac-audit` — no Go, no Node.js, no dedicated runner; runs from scratch on any CI runner with Python 3.9+.

---

### Legal Notice

Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.

### Part of VampSecure Labs Toolkit

`vamp-iac-audit` is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:

- Portfolio: [github.com/Vampsecure-Labs](https://github.com/Vampsecure-Labs)
- Orchestrator: [github.com/Vampsecure-Labs/vamp-orchestrator](https://github.com/Vampsecure-Labs/vamp-orchestrator)

### Version History

| Version | Main changes |
|---------|-------------|
| v2.7.1 | Bilingual README (EN/ES) |
| v2.7.0 | **+54 YAML checks in 2 new files** · `ansible_extra_checks.yaml` (27: apt allow_unauthenticated, yum disable_gpg_check, npm/git/apt_key/pip TLS, docker privileged/host-network/volumes_from, docker_login no_log, s3 public ACL, RDS publicly_accessible, firewalld/ufw/SELinux disabled, postgresql_privs ALL, mysql_user `*.*`, known_hosts absent, shell non-idempotent, get_url /tmp) · `terraform_network_iam.yaml` (27: aws_security_group_rule 0.0.0.0/0, CloudWatch Logs retention/KMS, Backup plan/selection, IAM password policy, ALB deletion_protection/drop_invalid_headers, LB listener HTTP, Kinesis KMS/metrics, DynamoDB SSE/PITR/deletion, Cognito MFA/advSec, Secrets Manager KMS/recovery, RDS cluster deletion/encryption, CloudFront TLS legacy, API GW X-Ray) · **fix:** Terraform evaluator read `check_regex` but rules used `pattern` — all `present_regex` failed silently · **346 total checks** · 13 YAML files · gap vs Checkov ~3.1x |
| v2.6.0 | +54 YAML checks · CloudFormation network (27) + Helm advanced (27) · 292 total checks |
| v2.5.0 | CDK/SAM engine — 27 AWS Serverless checks · 238 total checks |
| v2.4.0 | Pulumi YAML engine — 27 AWS+Azure+GCP checks · 237 checks |
| v2.3.0 | Ansible YAML engine — 27 checks, 3 scopes, `regex_match` operator · 210 checks |
| v2.2.0 | Extensible Helm YAML engine — 27 checks |
| v2.1.0 | Extensible CloudFormation YAML engine — 45 checks |
| v2.0.0 | Extensible Terraform YAML engine — 85 HCL rules (AWS/GCP/Azure) |
| v1.0 | MVP Terraform, CloudFormation and Helm (hardcoded checks) |

---

© VampSecure Studios — VampSecure Labs Security Research Division

---
---

<a name="español"></a>
## 🇪🇸 Español

### Descripción general

`vamp-iac-audit` es un auditor de seguridad de análisis estático para ficheros de Infraestructura-como-Código. Escanea recursivamente directorios en busca de configuraciones Terraform HCL, AWS CloudFormation y charts de Helm, detectando configuraciones incorrectas y valores inseguros por defecto alineados con los benchmarks CIS, TTPs de MITRE ATT&CK y buenas prácticas de seguridad de proveedores cloud. Los hallazgos se clasifican de CRITICAL a LOW y se exportan a Consola (Rich), JSON o HTML.

### Características

- **Módulo Terraform** (IAC-TF-001 a IAC-TF-010): security groups abiertos a `0.0.0.0/0` (CRITICAL), ACLs de S3 públicas (HIGH), acciones/recursos comodín en IAM (HIGH), instancias RDS accesibles públicamente (HIGH), discos raíz sin cifrar (MEDIUM), variables sensibles sin `sensitive = true` (MEDIUM), secretos hardcodeados (`sk_`, `ghp_`, `AKIA`) (CRITICAL), SSH/RDP abierto al mundo (CRITICAL), RDS sin retención de backups (MEDIUM), firewall GCP abierto a `0.0.0.0/0` (HIGH)
- **Módulo CloudFormation** (IAC-CF-001 a IAC-CF-008): security groups con protocolo `-1` abiertos a `0.0.0.0/0` (CRITICAL), control de acceso S3 público (HIGH), políticas IAM comodín (HIGH), RDS accesible públicamente (HIGH), parámetros de contraseña sin `NoEcho` (MEDIUM), security groups SSH/RDP abiertos (CRITICAL), KMS sin rotación de claves (LOW), S3 sin cifrado de bucket (MEDIUM)
- **Módulo Helm** (IAC-HLM-001 a IAC-HLM-008): contenedores privilegiados (CRITICAL), uso de hostNetwork (HIGH), hostPID/hostIPC (HIGH), falta de `runAsNonRoot` (MEDIUM), falta de límites de recursos (MEDIUM), secretos hardcodeados en valores de env (CRITICAL), tokens de cuenta de servicio auto-montados (LOW), capacidades Linux peligrosas `SYS_ADMIN`/`NET_ADMIN`/`SYS_PTRACE` (HIGH)
- Detección automática del tipo de IaC cuando no se proporciona flag explícito
- Escaneo recursivo de directorios
- Hallazgos por fichero con números de línea y nombres de recursos
- Referencias MITRE ATT&CK y CIS Benchmark por hallazgo
- Salida Rich en consola: tabla de hallazgos por fichero + resumen por severidad, tipo IaC y módulo
- Exportación a JSON (legible por máquina) y HTML (dark-theme standalone)
- Exit code 1 en hallazgos CRITICAL/HIGH para integración en pipelines CI/CD

### Requisitos

- Python 3.9 o posterior
- `rich >= 13.7.0`
- `pyyaml >= 6.0`

### Instalación

```bash
pip install vamp-iac-audit
# o con Homebrew:
brew install vampsecure-labs/labs/vamp-iac-audit
```

```bash
git clone https://github.com/Vampsecure-Labs/vamp-iac-audit.git
cd vamp-iac-audit
python3 -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -r requirements.txt
```

### Uso

```
vamp-iac-audit scan --help
```

### Ejemplos

```bash
# Escanear todos los tipos de IaC en el directorio actual (auto-detección)
vamp-iac-audit scan --path .

# Escanear solo ficheros Terraform
vamp-iac-audit scan --path ./infra --terraform

# Escanear solo plantillas CloudFormation
vamp-iac-audit scan --path ./cfn --cloudformation

# Escanear solo charts Helm
vamp-iac-audit scan --path ./charts --helm

# Exportar hallazgos a JSON y HTML
vamp-iac-audit scan --path ./infra --json resultados.json --html informe.html

# Escanear múltiples tipos explícitamente
vamp-iac-audit scan --path ./infra --terraform --cloudformation
```

### Referencia CLI

| Flag | Por defecto | Descripción |
|------|-------------|-------------|
| `--path DIR` | obligatorio | Directorio a escanear recursivamente |
| `--terraform` | auto | Escanear ficheros Terraform `.tf` y `.tfvars` |
| `--cloudformation` | auto | Escanear plantillas CloudFormation YAML/JSON |
| `--helm` | auto | Escanear ficheros `templates/*.yaml` de charts Helm |
| `--json FILE` | — | Exportar resultados a JSON |
| `--html FILE` | — | Exportar informe HTML dark-theme standalone |

### Formatos de salida

| Formato | Flag | Descripción |
|---------|------|-------------|
| Consola | (por defecto) | Tablas Rich por fichero con hallazgos codificados por color según severidad |
| JSON | `--json FILE` | Conjunto completo de resultados legible por máquina |
| HTML | `--html FILE` | Informe dark-theme standalone |

### Referencia de checks

#### Terraform (IAC-TF-*)

| ID | Check | Severidad | MITRE |
|----|-------|-----------|-------|
| IAC-TF-001 | `aws_security_group` con `cidr_blocks = ["0.0.0.0/0"]` en ingress | CRITICAL | T1190 |
| IAC-TF-002 | `aws_s3_bucket` con `acl = "public-read"` o `"public-read-write"` | HIGH | T1530 |
| IAC-TF-003 | `aws_iam_policy` con `Action = "*"` o `Resource = "*"` | HIGH | T1098 |
| IAC-TF-004 | `aws_db_instance` con `publicly_accessible = true` | HIGH | T1190 |
| IAC-TF-005 | `aws_instance`/`aws_launch_template` sin `encrypted` en root block device | MEDIUM | T1486 |
| IAC-TF-006 | Variable con `sensitive = false` y nombre que contiene `password`/`secret`/`key`/`token` | MEDIUM | T1552 |
| IAC-TF-007 | Patrón de secreto hardcodeado (`sk_`, `ghp_`, `AKIA`) | CRITICAL | T1552 |
| IAC-TF-008 | `aws_security_group` con puerto 22 o 3389 abierto a `0.0.0.0/0` | CRITICAL | T1021 |
| IAC-TF-009 | `aws_rds_cluster` sin `backup_retention_period` o con valor 0 | MEDIUM | T1485 |
| IAC-TF-010 | `google_compute_firewall` con `source_ranges = ["0.0.0.0/0"]` | HIGH | T1190 |

#### CloudFormation (IAC-CF-*)

| ID | Check | Severidad |
|----|-------|-----------|
| IAC-CF-001 | SecurityGroup con `IpProtocol: "-1"` y `CidrIp: "0.0.0.0/0"` | CRITICAL |
| IAC-CF-002 | S3 con `AccessControl: PublicRead` o `PublicReadWrite` | HIGH |
| IAC-CF-003 | IAM Policy con `Action: "*"` o `Resource: "*"` | HIGH |
| IAC-CF-004 | RDS con `PubliclyAccessible: true` | HIGH |
| IAC-CF-005 | Parámetro String sin `NoEcho: true` y nombre que contiene `password`/`secret`/`key` | MEDIUM |
| IAC-CF-006 | SecurityGroup con puerto 22/3389 abierto a `0.0.0.0/0` | CRITICAL |
| IAC-CF-007 | KMS sin `EnableKeyRotation: true` | LOW |
| IAC-CF-008 | S3 sin `BucketEncryption` configurado | MEDIUM |

#### Helm (IAC-HLM-*)

| ID | Check | Severidad |
|----|-------|-----------|
| IAC-HLM-001 | `securityContext.privileged: true` | CRITICAL |
| IAC-HLM-002 | `hostNetwork: true` | HIGH |
| IAC-HLM-003 | `hostPID: true` o `hostIPC: true` | HIGH |
| IAC-HLM-004 | Falta `securityContext.runAsNonRoot: true` | MEDIUM |
| IAC-HLM-005 | Falta `resources.limits` en contenedores | MEDIUM |
| IAC-HLM-006 | Valor de env con patrón de secreto hardcodeado (`sk_`, `ghp_`, `AKIA`, `ey...`) | CRITICAL |
| IAC-HLM-007 | `serviceAccount.automountServiceAccountToken: true` (por defecto) | LOW |
| IAC-HLM-008 | `capabilities.add` con `SYS_ADMIN`, `NET_ADMIN`, o `SYS_PTRACE` | HIGH |

### Códigos de salida

| Código | Significado | Comportamiento CI/CD |
|--------|-------------|---------------------|
| `0` | Sin hallazgos críticos ni altos | El pipeline pasa |
| `1` | Hallazgos críticos o altos detectados | El pipeline falla — revisión requerida |
| `2` | Error de ejecución | El pipeline falla — revisar configuración |

---

### Why vamp-iac-audit vs. Checkov · Terrascan · KICS

| Característica | vamp-iac-audit | Checkov | Terrascan | KICS |
|---|---|---|---|---|
| Motor extensible YAML (sin código Python por regla) | ✅ 13 YAML ficheros | ❌ Python por check | ❌ Rego (OPA) | ⚠️ queries JSON |
| Pulumi YAML nativo | ✅ | ❌ | ❌ | ❌ |
| Ansible YAML nativo | ✅ | ✅ | ❌ | ✅ |
| SAM / AWS Serverless | ✅ | ✅ | ⚠️ parcial | ✅ |
| Reglas MITRE ATT&CK Cloud por check | ✅ | ❌ | ✅ | ❌ |
| Sin dependencias externas (solo `rich` + `pyyaml`) | ✅ | ❌ múltiples deps | ❌ Go binary | ❌ Node.js |
| Informe HTML dark-theme autónomo | ✅ | ⚠️ HTML básico | ✅ | ✅ |
| Exit codes CI/CD 0/1/2 | ✅ | ✅ | ✅ | ✅ |

- **Motor YAML extensible sin recompilar**: añadir un check es escribir 5 líneas YAML en el fichero correspondiente — sin tocar código Python, sin Rego (OPA), sin recompilar binarios.
- **Cobertura Pulumi YAML**: el único auditor open-source con soporte nativo de Pulumi (AWS, Azure y GCP) en un motor extensible.
- **Trazabilidad MITRE ATT&CK Cloud**: cada hallazgo lleva el TTP (T1190, T1552, T1098…) además de la referencia CIS — facilita la correlación con el SOC y los informes de amenaza.
- **Instalación mínima**: `pip install vamp-iac-audit` — sin Go, sin Node.js, sin runner dedicado; corre desde cero en cualquier CI runner con Python 3.9+.

---

### Aviso legal

Uso exclusivo en sistemas de tu propiedad o para los que dispongas de autorización escrita explícita del propietario. VampSecure Studios no asume responsabilidad por el uso no autorizado.

### Parte del toolkit VampSecure Labs

`vamp-iac-audit` es una herramienta del toolkit de investigación de seguridad de VampSecure Labs. Para el toolkit completo incluyendo el orquestador que ejecuta todas las herramientas en secuencia y agrega los hallazgos en un único informe de engagement, consulta:

- Portfolio: [github.com/Vampsecure-Labs](https://github.com/Vampsecure-Labs)
- Orquestador: [github.com/Vampsecure-Labs/vamp-orchestrator](https://github.com/Vampsecure-Labs/vamp-orchestrator)

### Historial de versiones

| Versión | Cambios principales |
|---------|---------------------|
| v2.7.1 | README bilingüe (EN/ES) |
| v2.7.0 | **+54 checks YAML en 2 ficheros nuevos** · `ansible_extra_checks.yaml` (27) · `terraform_network_iam.yaml` (27) · **fix:** evaluador Terraform leía `check_regex` pero reglas usaban `pattern` · **346 checks totales** · 13 ficheros YAML |
| v2.6.0 | **+54 checks YAML en 2 ficheros nuevos** · `cloudformation_network.yaml` (27) · `helm_advanced_checks.yaml` (27) · **292 checks totales** · 11 ficheros YAML |
| v2.5.0 | Motor CDK/SAM — 27 checks AWS Serverless · 238 checks totales |
| v2.4.0 | Motor Pulumi YAML — 27 checks AWS+Azure+GCP · 237 checks |
| v2.3.0 | Motor Ansible YAML — 27 checks, 3 scopes, operador `regex_match` · 210 checks |
| v2.2.0 | Motor Helm YAML extensible — 27 checks pods/containers/resources/volumes · 183 checks |
| v2.1.0 | Motor CloudFormation YAML extensible — 45 checks |
| v2.0.0 | Motor Terraform YAML extensible — 85 reglas HCL (AWS/GCP/Azure) |
| v1.0 | MVP Terraform, CloudFormation y Helm (checks hardcodeados) |

---

© VampSecure Studios — VampSecure Labs Security Research Division
