Post

CloudLint: Cloud Security Config Analyzer

Posted
By Chrissy P
3 min read
CloudLint: Cloud Security Config Analyzer

Overview

CloudLint is a client-side cloud configuration analyzer that checks JSON config files against common security misconfigurations. Paste an IAM policy, CloudFormation template, S3 bucket config, or security group definition and it runs 15 checks across IAM, storage, networking, encryption, and logging. No cloud account connection needed. Everything runs in the browser.

I built this because most cloud security misconfigs come down to the same handful of mistakes. Overly permissive IAM policies, public S3 buckets, open security groups, missing encryption. These are the findings that show up on every audit and every CSPM report, and they’re all preventable if someone checks the config before it ships. CloudLint catches those patterns before they become production findings.

What it checks

The rules engine covers 15 checks across 5 categories, mapped to CIS AWS Benchmark controls:

IAM

  • Wildcard actions (Action: *) giving full admin access
  • Wildcard resources (Resource: *) applying policies to every resource in the account
  • Sensitive actions like AssumeRole without condition constraints (no MFA, no source IP)
  • Policies with only Allow statements and no explicit Deny for defense in depth

Storage

  • Public ACLs (PublicRead, PublicReadWrite) on S3 buckets
  • Public access block settings disabled on any of the four controls
  • Versioning suspended, making accidental deletions permanent
  • No server-side encryption configuration on S3 buckets

Networking

  • SSH (port 22) open to 0.0.0.0/0
  • RDP (port 3389) open to 0.0.0.0/0
  • All-traffic rules (protocol -1) from 0.0.0.0/0, effectively disabling the security group

Encryption

  • No SecureTransport condition on S3 policies, allowing HTTP instead of HTTPS

Logging

  • No logging configuration on S3 buckets, leaving no audit trail

Each check returns a pass, warning, or fail status with an explanation of why it matters, the specific CIS reference, and a remediation step telling you exactly what to fix.

How it works

The interface is built like a code editor. The input area has line numbers, and when you run the analysis, flagged line numbers turn red so you can see exactly where in your config the problems are. The Problems panel at the bottom works like VS Code’s error output: errors first, then warnings, then passes. Click any finding to expand the fix.

Sample configs are built in so anyone can demo it without having their own files. The “risky IAM” sample has wildcard actions and resources on every statement. The “bad security group” sample has SSH, RDP, and all-traffic rules open to the internet. The “clean config” shows what a passing scan looks like with scoped permissions and a SecureTransport condition.

The tool also supports file uploads and drag-and-drop for JSON and YAML files. Paste or upload, either way it parses and runs the analysis immediately.

Why I built it this way

No cloud account connection was a hard requirement. The moment you ask someone to hook up their AWS credentials to a tool they’ve never used, you’ve lost them. Running everything client-side means there’s zero risk, zero cost, and zero friction. The trade-off is that you’re analyzing static configs instead of live infrastructure, but that’s the right scope for a pre-deployment check.

The IDE aesthetic wasn’t just a design choice. When you’re reviewing config files, you want line numbers, you want to see where the problem is in the actual document, and you want your findings panel to behave like the tools you already use. Highlighting the flagged lines ties the finding back to the specific part of the config that needs fixing instead of just listing issues generically.

Tech stack

  • Next.js (React framework)
  • Vanilla JavaScript rules engine
  • Deployed on Vercel
  • No external dependencies or API keys required

What’s next

I want to expand the rule set to cover Terraform HCL configs alongside JSON, add support for Azure Resource Manager templates, and build a report export so you can generate a PDF summary of findings for compliance documentation. The CIS benchmark mapping also opens the door for a compliance dashboard view that tracks posture over time if I add persistence through Supabase.

Stack: Next.js, JavaScript, Vercel

Projects, Security Tools
cloud-security aws iam cis-benchmarks terraform nextjs
This post is licensed under CC BY 4.0 by the author.