74 checks across 11 services
S3, IAM, EC2, RDS, CloudTrail, KMS, Lambda, DynamoDB, ELBv2, SNS and SQS. Run the general baseline, the CIS AWS Foundations Benchmark, or both. You can also scan a single service.
Apache-2.0
Self-hosted
No paid tier
Open source AWS security scanning you run yourself
Teemops finds IAM users with AdministratorAccess, S3 buckets missing
public access block, security groups open to 0.0.0.0/0 on port 22, and
unencrypted RDS instances. 74 checks across 11 AWS services, each with the
steps to fix it. It runs in your infrastructure, so findings stay in your
account.
$ bash <(curl -fsSL https://raw.githubusercontent.com/teemops/tops/develop/install.sh)
The installer pulls tagged images from Docker Hub, so the host needs no PHP, Node or Composer. To read the script before running it, the install guide shows the download-and-inspect form.
What it does
Every finding comes with the fix
A list of problems without remediation steps just moves the work to you.
Remediation on every check
All 74 checks include a fix. The 28 critical and high severity checks include step-by-step guidance with links to the AWS documentation.
No stored AWS credentials
Teemops assumes a cross-account IAM role that your administrators create with CloudFormation and can revoke at any time. No access keys are stored.
Self-hosted
It runs on your infrastructure against your own database. There is no hosted service, no telemetry and no account to create.
Findings persist across scans
A finding is one record per account, resource and rule. Mark one ignored and it stays ignored on the next scan rather than reappearing.
Apache 2.0, with a DCO
Contributions use a DCO rather than a CLA, so the licence cannot change later without every contributor agreeing. No paid tier, no features behind a licence.
How it works
From install to first scan
Install
One command on a host with Docker. The installer generates its own database credentials and pulls tagged images. There is no build step.
Connect an account
A CloudFormation stack creates the cross-account IAM role in the account you want to scan. You can read the template before you launch it.
Scan
Run the full benchmark or narrow it to specific services. Findings are grouped by severity, each with its remediation.
What it isn't
What Teemops does not do
Teemops is at v0.5.0. Here are the limits, so you can decide before you install it rather than after.
- Not runtime protection It reads configuration through the AWS API. It does not inspect traffic, block requests or sit in the request path.
- AWS only Azure and GCP are on the roadmap, not in the code.
- Not a compliance guarantee A clean scan means the checks Teemops runs found nothing. It is not an audit. The PCI profile has no rules written yet, so it is hidden rather than shown empty.
- No automated remediation Teemops reports the problem and the fix. You apply the change in your own account.
- No scheduled scans or report export Scans are run manually. Both features are on the roadmap; neither has a route or a UI today.
The full list, checked against the code rather than against intent, is in PROGRESS.md.
Get a demo
See Teemops scan an AWS account
We'll show you a scan from start to finish: connecting an account, running the checks, and working through the findings and their fixes. Then you can decide whether to install it yourself.
In the demo
- A live scan, from connecting an account to findings grouped by severity.
- How the fixes work. Every check has a remediation, and the critical and high ones come with step-by-step guidance.
- What it can reach. The cross-account IAM role, what it can read, and how your administrators revoke it.
- Getting it running on your own infrastructure, and answers to your questions about your setup.
Prefer to try it yourself?
Install it with the command at the top of this page and follow the install guide to a first scan. It's Apache 2.0, so there's no trial and no licence key.