Misconfiguration scanner
Find and fix AWS misconfigurations before they become breaches
Most cloud breaches start with a misconfiguration, not a hacker. An open security group, an access key that never expires or a bucket someone made public for a quick test. bearhug audits your AWS configuration continuously, so these mistakes are caught soon after they appear, not months later.
The misconfigurations we see in almost every AWS account
-
Public S3 buckets
Anyone on the internet can read files that were never meant to be shared.
How bearhug helps: One-click Fix enables Block Public Access, with rollback. Read more about AWS S3 bucket security.
-
Over-permissive IAM
Users with admin rights, unused access keys and a root account without MFA turn one leaked credential into a full account compromise.
How bearhug helps: Findings identify the users and keys involved, with step-by-step guidance to tighten access.
-
Security groups open to the world
SSH (port 22) or RDP (port 3389) reachable from
0.0.0.0/0invites constant automated attacks.How bearhug helps: One-click Fix removes the unrestricted rules and keeps the ports your applications actually need.
-
Logging switched off
Without CloudTrail or VPC Flow Logs there is no record of what happened, which makes an incident almost impossible to investigate.
How bearhug helps: One-click Fix enables CloudTrail logging.
-
Unencrypted databases and volumes
RDS databases and EBS volumes without encryption at rest leave data readable if snapshots or storage are exposed.
How bearhug helps: Findings explain which resources are affected, with step-by-step guidance to enable encryption.
Which checks appear depends on the AWS Security Hub standards you have enabled.
Why misconfigurations are the biggest cloud risk
Cloud platforms are secure by design, but they are also flexible, and that flexibility is where mistakes happen. Every new service, deployment or quick test adds settings that someone has to get right. In a small team, the person making a change is often also the person reviewing it, and there is rarely time to check the security side.
Attackers know this. Automated tools scan the internet constantly for open ports, public buckets and leaked keys, so a misconfiguration can be found by someone else long before your next review.
The good news is that misconfigurations are also the most fixable kind of risk. Unlike a zero-day vulnerability, the fix is usually a single setting, once you know where to look.
A cloud misconfiguration audit that never stops
A one-off audit is out of date the next time someone deploys. bearhug receives new findings from Security Hub in real time and emails you when a critical issue appears.
Daily trend tracking shows whether your misconfiguration count is going up or down, which gives you evidence of progress for customers, auditors and investors. See how real-time AWS security alerts work.
Fix, do not just find
Finding a misconfiguration is only half the job. bearhug gives supported findings a Fix button that applies the change for you, such as blocking public access on an S3 bucket, closing open and insecure ports or enabling CloudTrail logging, with rollback if anything behaves unexpectedly.
For findings that need a human decision, bearhug gives step-by-step remediation guidance generated with Amazon Bedrock. Read more about one-click AWS remediation.
How to run a manual AWS misconfiguration audit
If you want to see where you stand before connecting any tool, these steps cover the most common misconfigurations in a single AWS account.
- Enable AWS Security Hub and a security standard such as AWS Foundational Security Best Practices in each region you use, then review the critical and high findings.
- Review IAM credentials. Generate the IAM credential report. It is built in the background, so run the first command again until it returns
"State": "COMPLETE". Then download the report, decode it to CSV and look for unused access keys and users without MFA:aws iam generate-credential-report aws iam get-credential-report --query Content --output text | base64 --decode > credential-report.csv - Find security groups open to the internet over IPv4 and IPv6:
aws ec2 describe-security-groups --filters Name=ip-permission.cidr,Values=0.0.0.0/0 aws ec2 describe-security-groups --filters Name=ip-permission.ipv6-cidr,Values=::/0 - Confirm CloudTrail is logging. List your trails, then check each one reports
"IsLogging": true:aws cloudtrail describe-trails aws cloudtrail get-trail-status --name example-trail - Check S3 public access at account and bucket level, as described on our S3 bucket security page.
- Repeat for every account and region, and again after every significant change.
Misconfiguration audit, penetration test or CSPM?
| Misconfiguration audit | Penetration test | bearhug CSPM | |
|---|---|---|---|
| What it checks | Configuration at a point in time | Whether an attacker can break in | Configuration and threats, continuously |
| How often | Once, or once a year | Once, or once a year | All the time |
| Who does it | An engineer or consultant | A specialist tester | Automated, with plain-English results |
| What you get | A report | A report | Prioritised findings, fixes and trends |
The three are complementary. A penetration test is still valuable before a major launch, while continuous CSPM keeps the basics right in between.
What happens after you connect
Once the CloudFormation stack is deployed, your dashboard fills with findings from the Security Hub standards you have enabled as their first checks complete (most begin within 25 minutes and all within two hours), grouped by severity and by resource. Each misconfiguration has a plain-English explanation and either a Fix button or step-by-step guidance.
Most teams start by clearing the critical and high findings, which are usually a small number of public buckets, open ports and missing logs. After that, bearhug keeps watching. New misconfigurations appear as soon as AWS reports them, and critical ones trigger an email alert, so the work you have done stays done.
Related guides
Read our guides: The 3 AWS misconfigurations we see in every account and 5 AWS security checks you can run right now.
Misconfiguration scanner questions
No. A penetration test simulates an attacker at a point in time. bearhug checks your configuration continuously. The two complement each other.
AWS only. bearhug focuses on one cloud so it can go deeper on it.
Continuously. Findings stream in from AWS Security Hub and Amazon GuardDuty as AWS raises them.
Only when you ask it to. bearhug proposes a fix, and nothing changes until you review it and click. You also decide when to grant the remediation role that fixes need.
bearhug costs $100 per AWS account per month, however many resources the account holds. It is billed in USD through AWS Marketplace, with every feature included.
Connect in five minutes and start your first AWS misconfiguration scan
14-day free trial. The paid plan is $100 per AWS account per month, billed through AWS Marketplace.
No credit card. No procurement. Starts from your AWS console.