# Scout Suite: multi-cloud configuration auditing

> How to install and run Scout Suite, how its HTML report differs from Prowler output, and why Tandera runs both.

`Scout Suite` collects configuration from a cloud account through its APIs and produces a navigable HTML report with findings grouped by service. Where Prowler gives you a stream of check results, Scout Suite gives you a browsable model of the account.

## Install

```bash
pipx install scoutsuite
# or
git clone https://github.com/nccgroup/ScoutSuite && cd ScoutSuite
pip install -r requirements.txt && python scout.py --help
```

## Core commands

```bash
# AWS with a named profile
scout aws --profile client-audit

# restrict services and regions
scout aws --profile client-audit --services s3,iam,ec2 --regions us-east-1

# Azure
scout azure --cli

# GCP
scout gcp --user-account --project-id <id>

# output location
scout aws --profile client-audit --report-dir ./scout-report --no-browser
```

## Output

An HTML report plus the underlying JSON in `scoutsuite-results/`. The JSON is what you parse; the HTML is what you use while testing.

## Where it sits in Tandera

Scout Suite runs in the **static** phase of `recon_cloud`, alongside `prowler`. Both need the same authenticated access.

Running both is the same reasoning as the three subdomain producers: different check sets, different blind spots. Prowler's strength is breadth of individual checks and compliance mapping; Scout Suite's is showing how resources relate — which role can assume which, what a security group actually exposes. Tandera merges and deduplicates the findings so the client does not see the same misconfiguration twice under two tool names.

## Using it in a pentest

**Use the HTML while testing, the JSON for the report.** The browsable view is genuinely good for understanding an unfamiliar account quickly. Do not paste its screenshots into the deliverable as findings.

**IAM is where the real findings are.** Public storage is easy and everyone checks it. Over-permissive roles, trust policies that allow assumption from unexpected principals, and unused credentials with high privilege are harder to spot and matter more.

**Note the collection timestamp.** Cloud configuration changes daily. A finding is a statement about the account at a moment; date it, or the client will dispute it after their next deploy.

---

Canonical: https://tandera.io/tools/scoutsuite
This page as markdown: https://tandera.io/tools/scoutsuite.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.