Aurelian: Multi-Cloud Security Reconnaissance

Aurelian is an open-source, multi-cloud security reconnaissance framework that enumerates cloud resources, detects misconfigurations, finds secrets, and identifies privilege escalation paths across AWS, Azure, and GCP.

Overview

Aurelian is an open-source, multi-cloud security reconnaissance framework built in Go. It provides a unified command-line interface for cloud security assessments across Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP).

Where other tools require separate workflows per cloud provider, Aurelian gives you one command structure that works everywhere: aurelian [platform] recon [module]. Each module encapsulates a complex, multi-step security workflow — resource enumeration, content extraction, secrets scanning, policy analysis, access evaluation — behind a single command.

Key Capabilities

Secrets Discovery

Enumerates cloud resources, extracts content from 30+ source types (EC2 user data, Lambda code, CloudFormation templates, CloudWatch logs, ECS task definitions, environment variables, storage blobs, application configurations), and scans with Titus for hardcoded credentials, API keys, and tokens. Optional validation confirms whether discovered secrets are active.

Incremental scanning — the AWS secret scanner operates incrementally across runs. The checkpoint from the last fully successful scan is persisted (with a one-minute overlap) and passed to Aurelian at the start of each subsequent run, so resources that have not changed since the previous scan are skipped. A new checkpoint is saved only after a run completes successfully, ensuring no results are lost if a run fails partway through. This significantly reduces redundant work on large AWS environments.

Full ECS task definition scanning — the complete ECS task definition is forwarded to the secret scanner on each run. This ensures that environment variables and other configuration embedded directly in task definitions are included in the scan surface, closing a coverage gap for containerized workloads.

Public Resource Detection

Combines resource listing, property enrichment, policy fetching, and access evaluation to identify publicly accessible resources — open S3 buckets, exposed databases, public IPs, anonymous-access storage accounts, and more.

Azure public resource detection uses Azure Resource Graph queries to enumerate exposed resources across your subscription. The following resource types are covered:

Resource type	What is detected
Blob containers	Azure Storage containers configured for public blob or container access
Public IP addresses	Standalone public IP resources enumerated across the subscription
Internet-facing load balancers	Load balancers with public frontend configurations
Azure SQL databases	SQL instances reachable from the internet
Network Security Groups	NSGs with overly permissive inbound rules
App Services	App Service resources without access restrictions

Confirmed exposures are emitted as CloudResource objects with public-access properties and Risk objects, which surface in the Guard vulnerability view alongside other cloud posture findings.

IAM Privilege Escalation Analysis

Collects IAM data, evaluates effective permissions, and detects privilege escalation paths. Outputs JSON or populates a Neo4j graph database for interactive exploration.

Subdomain Takeover Detection

Checks DNS records in Route53, Azure DNS, and Cloud DNS against known cloud-specific takeover patterns — dangling CNAMEs pointing to unclaimed cloud resources.

EC2 IMDSv1 Configuration Audit

Enumerates EC2 instances across the target AWS account and flags any instance where HttpTokens=optional, indicating that the Instance Metadata Service v1 (IMDSv1) is permitted. IMDSv1 is a well-known credential-theft vector: an SSRF vulnerability in an application running on the instance is sufficient for an attacker to retrieve IAM credentials from the metadata endpoint without any additional authentication. Each flagged instance is emitted as a Medium-severity Aurelian risk and surfaces in the Guard vulnerability view alongside other cloud posture findings.

OPSEC-Aware Reconnaissance

Covert techniques that avoid CloudTrail logging. The whoami module identifies the caller ARN using APIs that leak identity in error messages without generating audit log entries.

Installation

git clone https://github.com/praetorian-inc/aurelian.git
cd aurelian
go build -o aurelian main.go

Requires Go 1.24+. Docker support is also available.

Quick Start

# Verify identity (OPSEC-safe, no CloudTrail logging)
aurelian aws recon whoami

# Find hardcoded secrets across all AWS regions
aurelian aws recon find-secrets

# Detect publicly accessible resources (AWS)
aurelian aws recon public-resources

# Detect publicly accessible resources (Azure)
aurelian azure recon public-resources

# Build IAM privilege escalation graph
aurelian aws recon graph --neo4j-uri bolt://localhost:7687

# Detect subdomain takeovers
aurelian aws recon subdomain-takeover

# Audit EC2 instances for IMDSv1 exposure
aurelian aws recon imds

Learn More

Full documentation and module reference at github.com/praetorian-inc/aurelian.