# BishopFox/cloudfox

Automating situational awareness for cloud penetration tests.

Repository: https://github.com/BishopFox/cloudfox
Canonical: https://ross.abutalabs.com/products/cloudfox
Homepage: https://bishopfox.com/blog/introducing-cloudfox
Language: Go
License: MIT
License Family: permissive
Topics: aws, cloud, cloud-security, golang, penetration-testing-tools, security
Last push: 2026-08-20T18:39:52+00:00

## Health v2 (maintenance only)
Score: 90/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 98, release rhythm 74, longevity 100
- inputs: {"age_days": 1456, "days_push": 13, "days_rel": 99, "gap_med": 34, "n_releases_24m": 8}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2563, forks 254 (observed 2026-08-28T04:07:01.030694+00:00)

## What it is
CloudFox is an open-source command line tool by Bishop Fox that automates situational awareness and enumeration in cloud environments, primarily AWS, to help penetration testers find exploitable attack paths. It runs modular checks (or an all-checks command) with limited read-only credentials and supports both white-box and black-box enumeration.

## Use cases
- enumerate aws account resources and regions during a pentest
- find secrets in ec2 userdata and environment variables
- identify overly permissive iam role trusts and cross-account assumption
- map attack paths from public internet or vpc internal starting points
- enumerate permissions of an aws principal
- discover mountable filesystems from a compromised vpc resource

## When to choose
- you are a penetration tester or red teamer assessing an unfamiliar aws environment
- you need automated enumeration of aws attack paths with read-only credentials
- you want to use found credentials for black-box cloud enumeration

## When to avoid
- you need Azure, GCP, or Kubernetes support, which is not yet implemented
- you want a cloud security posture management or compliance auditing tool rather than offensive enumeration
- you need a gui or continuous monitoring solution

## Facets
- artifact type: cli-tool
- maturity: active
- function: penetration-testing, security, cli, developer-tools
- domain: security, cloud-computing, penetration-testing, developer-tools
- platform: cli, windows, go
- tags: aws-enumeration, cloud-pentesting, attack-path-discovery, offensive-security, situational-awareness, red-team, linux, macos

## Member repositories
- BishopFox/cloudfox (main) score 90

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:01.030694+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:23:28.154832+00:00, confidence not recorded.
  - readme: https://github.com/BishopFox/cloudfox (fetched 2026-08-28T04:07:01.030694+00:00, sha 46339358ea7a)
  - homepage: https://bishopfox.com/blog/introducing-cloudfox (fetched 2026-08-29T10:05:56.367828+00:00, sha beec3375f956)
- Data as of 2026-08-30T08:39:29.467469+00:00.