Ultimate ScoutSuite Cheat Sheet

Samir KC
March 15, 2026



Ultimate ScoutSuite Cheat Sheet

Multi-Cloud security auditing for AWS, Azure, GCP, and more.

1. Installation & Basics

ScoutSuite is written in Python. It's best to run it in a virtual environment.

Standard Install

pip3 install scoutsuite

Help Menu

View list of supported providers (AWS, Azure, GCP, AliCloud, Oracle).

scout --help

2. AWS Auditing

ScoutSuite uses your local AWS CLI credentials (~/.aws/credentials).

Basic Scan

Uses the default profile configured in AWS CLI.

scout aws

Specific Profile

Audit a specific environment (e.g., 'dev' or 'prod').

scout aws --profile dev-env

Authenticate via Access Keys

If not using a profile, pass keys directly (Not recommended for logs, but useful for CI/CD).

scout aws --access-keys --access-key-id AKIA... --secret-access-key ...

3. Azure Auditing

Requires the Azure CLI (az) to be installed and logged in.

1. Login to Azure

az login

2. Run ScoutSuite

Uses the cached Azure CLI credentials.

scout azure --cli

Service Principal Auth

For automated scanning without user interaction.

scout azure --service-principal --client-id [ID] --client-secret [SECRET] --tenant [TENANT_ID]

4. GCP Auditing

Requires Google Cloud SDK (gcloud).

1. Login to GCP

gcloud auth login
gcloud auth application-default login

2. Run ScoutSuite (User Account)

scout gcp --user-account

Service Account Key

Use a JSON key file for authentication.

scout gcp --service-account key_file.json

5. Filtering & Reporting

Cloud environments are huge. Use filters to speed up scans and reduce noise.

Scan Specific Services

Only check S3 buckets and EC2 instances.

scout aws --services s3 ec2

Skip Services

Skip IAM if you don't have permissions.

scout aws --skip-services iam

Regions

Only scan specific regions.

scout aws --regions us-east-1 us-west-1

Reporting Options

Control where the HTML report is saved.

scout aws --report-dir ./audit_reports --report-name "Client_AWS_Audit"
scout aws --no-browser

6. Custom Rulesets

ScoutSuite runs based on a set of JSON rules. You can modify them.

Rule Location

Rules are stored in the library folder (e.g., ScoutSuite/providers/aws/rules/).

Disable Rules

Use the --ruleset flag to pass a custom config file that excludes certain findings.

Using a Custom Ruleset

scout aws --ruleset my-custom-rules.json
Pro Tip: ScoutSuite generates a scoutsuite-results/ folder containing an interactive HTML dashboard. This is the primary output you will analyze.
⇧