AuditClaw Collect evidence from your cloud and identity providers
AuditClaw collects configuration and access evidence from AWS, GitHub, Azure, Google Cloud, Google Workspace and Okta through companion skills. Results are stored in your local compliance database and associated with framework controls. Choose the checks and credentials for each provider, then review findings before sharing an evidence export.
The 48 check groups below are counted from the companion registries. A group can produce several findings across resources; a finding is not another installed check.
Review provider access Read the security model Choose a compliance framework
What each integration reads and how it connects
| Provider | Evidence | Access to configure | Source |
|---|---|---|---|
| AWS | IAM, storage, encryption, logging and infrastructure configuration | The boto3 credential chain and included IAM policy. The credential-report group also requests report generation. | IAM policy |
| GitHub | Branch protection, repository security, organisation access and audit settings | GITHUB_TOKEN. Full-coverage classic scopes can include write authority; inspect the scope requirements for your selected checks. | Token requirements |
| Azure | Storage, networks, Key Vault, SQL, compute, App Service and Defender | Azure CLI or a service principal, with Reader and Security Reader at subscription scope. | Roles and checks |
| Google Cloud | Project IAM, storage, firewall, logging, encryption and database settings | Application Default Credentials or a service-account file, plus access to read the selected project's services. | Authentication and checks |
| Google Workspace | User MFA enrollment, administrator flags, activity and password indicators | A service account with domain-wide delegation for the Directory user read-only scope, acting as the configured administrator. | Directory authentication |
| Okta | MFA enrollment, password policy, inactive users and session settings | The organisation URL and OKTA_API_TOKEN. Review the token owner's permitted API access. | Okta authentication |
The Azure companion documents CIS references for storage, network and Key Vault checks. Google Cloud documents references for firewall, IAM and other groups. See each linked source for its mapping; review the applicable benchmark edition with your assessor.
An evidence record you can inspect
Example with sample data: an AWS S3 public-access finding from the collector's result format. A sweep stores the result alongside its provider and control reference in the local database.
{
"resource": "s3/sample-audit-bucket/public-access",
"status": "pass",
"detail": "All public access blocked"
}AWS Integration
Available Now15 Automated Check Groups
Connect your AWS account and AuditClaw continuously monitors your infrastructure for compliance.
IAM
Password policies, MFA, access keys
S3
Bucket encryption, public access, versioning
CloudTrail
Logging enabled, multi-region
VPC
Flow logs, security groups, NACLs
KMS
Key rotation, key policies
EC2
EBS encryption, public instances
RDS
Encryption at rest, backups, public access
SecurityHub
Findings, standards compliance
GuardDuty
Threat detection status
Lambda
Function policies, VPC config
CloudWatch
Log groups, alarms, metrics
Config
Recording status, rules
EKS/ECS
Container security, task definitions
ELB
SSL termination, access logs
Credential Report
User credential status
Setup
Use the boto3 credential chain with an attached role or selected profile. Review the included IAM policy and credential-report permission.
Mapped Frameworks
GitHub Integration
Available Now9 Automated Check Groups
Monitor your GitHub organization's security posture automatically.
Branch Protection
Protected branches, review requirements
Secret Scanning
Exposed secrets detection
Dependabot
Vulnerability alerts, auto-updates
Two-Factor Auth
Organization 2FA enforcement
Deploy Keys
Key management and rotation
Audit Log
Activity monitoring
Webhooks
Webhook security configuration
CODEOWNERS
Code review ownership
CI/CD
Actions workflow security
Setup
Configure GITHUB_TOKEN for the selected repository and organisation checks. Review the documented token scopes.
Mapped Frameworks
Azure Integration
Available Now7 Automated Check Groups
Monitor your Azure subscription for storage, networking, Key Vault, and Defender compliance.
Storage
Blob encryption, HTTPS-only, access tiers
Network
NSG rules, open ports, flow logs
Key Vault
Soft delete, purge protection, access policies
SQL
TDE encryption, auditing, firewall rules
Compute
Disk encryption, extensions, managed identity
App Service
HTTPS-only, TLS version, authentication
Defender
Security Center recommendations, secure score
Setup
Create a Service Principal with Reader + Security Reader roles.
Mapped Frameworks
Google Cloud
Available Now9 Automated Check Groups
Cloud Storage
Bucket encryption, public access, uniform access
Firewall
Open ports, default deny, VPC rules
IAM
Service account keys, over-privileged roles
Logging
Audit logs enabled, log sinks configured
KMS
Key rotation, key ring policies
DNS
DNSSEC enabled, zone configuration
BigQuery
Dataset access controls, encryption
Compute
Instance metadata, serial port access
Cloud SQL
SSL enforcement, public IP, backups
Identity Providers
Available Now8 Check Groups: Google Workspace + Okta
Google MFA
MFA enrollment status across all users
Google Admins
Admin role audit, super admin count
Google Inactive
Inactive user detection, last login
Google Passwords
Password policy compliance
Okta MFA
MFA factor enrollment status
Okta Passwords
Password policy strength
Okta Inactive
Inactive user accounts
Okta Sessions
Session lifetime, idle timeout
How integrations work
Three steps from zero to continuous compliance monitoring.
Register
add integration --provider aws --name "Production"Register the provider, then configure the credential route its companion actually uses. Review provider access before running a sweep.
Sync
AuditClaw collects evidence automatically on your schedule. Daily, hourly, or on-demand.
Monitor
Drift detection alerts you to any configuration regressions before auditors find them.
Integration health
Real-time visibility into the status of every connected integration.
AWS Production
Healthy
GitHub Main Org
Healthy
Azure Subscription
Healthy
Google Cloud
Healthy
Identity Providers
Healthy
Connect your first integration
Start with the 48 check groups across AWS, GitHub, Azure, Google Cloud and identity providers. Review access, connect your chosen companion and inspect the first sweep.
AuditClaw is MIT licensed software, built by AvanSaber Inc.