CloudShield
Get Started
CloudShield
Get Started
Scan your entire AWS account for misconfigurations in under 30 seconds. AI-planned fixes. Real-time threat monitoring. Full rollback support.
Windows v1.0.1 • Linux v1.0.2 • Free forever • Open source
CloudShield fires parallel scan threads across every AWS region simultaneously. No sequential waiting — every region, every service, all at once.
CloudShield's threat engine polls your AWS environment every 3 seconds via WebSocket. The moment something changes — a new admin user, an open security group, a public bucket — you're alerted instantly.
Every finding gets an AI-generated remediation plan. Review exactly what will change before applying. Every action is logged, reversible, and backed by a full rollback engine.
Enter your AWS Access Key & Secret Key. CloudShield is read-only — credentials are encrypted with AES-128 and never leave your machine.
CloudShield launches parallel threads across all 9 regions, scanning 52+ checks across S3, EC2, IAM, RDS, VPC, KMS, CloudTrail simultaneously.
Every finding is categorized by severity with a plain-English explanation, impacted resource, region, and a detailed remediation plan.
Apply AI-planned fixes with one click. Enable real-time monitoring for instant alerts. Roll back any action if something goes wrong.
Public access blocks, versioning, server-side encryption, access logging
14 checksSecurity groups, open ports, public IPs, EBS encryption, public snapshots
12 checksAdmin users, MFA enforcement, stale keys, wildcard policies, role trusts
10 checksPublic accessibility, encryption at rest, automated backups, deletion protection
6 checksFlow logs enabled, default VPC usage, NACL rules, route table analysis
5 checksTrail logging status, multi-region trails, log file validation, encryption
4 checksKey rotation enabled, key policies, CMK management, compliance checks
3 checksAlarm configurations, log group retention, metric filters for security events
3 checksStart for Free
Three ways to use CloudShield. Choose what works for you.
All free • Open source • No license key required
Everything you need to know about CloudShield — the free AWS security scanner.
CloudShield is a free, open-source AWS security scanner that automatically detects misconfigurations, monitors threats in real-time, and auto-remediates security issues. It performs 52+ checks across S3, EC2, IAM, RDS, VPC, KMS, CloudTrail and CloudWatch — in all 9 major AWS regions simultaneously — in under 30 seconds.
Yes — 100% free and open-source. No license key, no subscription, no feature gates. Use CloudShield as a web app at cloudshield.me, or download the desktop app for Windows (.exe) or Linux (.deb). Free forever.
CloudShield covers 8 AWS services: Amazon S3 (14 checks — public access, encryption, versioning, logging), Amazon EC2 & Security Groups (12 checks — open ports, public IPs, EBS encryption), AWS IAM (10 checks — MFA, admin users, stale access keys, wildcard policies), Amazon RDS (6 checks — public access, encryption, backup retention), Amazon VPC (5 checks — flow logs, default VPC, NACLs), AWS CloudTrail (4 checks), AWS KMS (3 checks — key rotation, policies), and Amazon CloudWatch (3 checks). 52+ checks total.
For each finding, CloudShield generates a plan showing the exact AWS API calls needed to fix the issue. You review and approve it — nothing changes without your consent. CloudShield then executes the fix, stores the full before/after state, and lets you roll back any action instantly with one click.
Yes. CloudShield covers CIS, PCI-DSS, and NIST compliance similar to AWS Security Hub, but also adds one-click auto-remediation and a full rollback engine — features Security Hub does not offer. CloudShield is also completely free. AWS Security Hub is a paid service charged per finding per region.
Yes. CloudShield encrypts AWS credentials using AES-128 Fernet encryption before storing them. In desktop mode, keys are stored only on your local machine and never transmitted anywhere. In web mode, keys are stored encrypted in a private database and never shared with third parties.