Full visibility into your AWS infrastructure. In minutes.

• Only LIST / DESCRIBE / GET calls - never create, enable, update or delete.
• Scans every region your account has opted into, so nothing is misreported as "disabled."
• Distinguishes Enabled, Disabled, No permission and Unavailable explicitly.
• Writes a timestamped .md and .txt report to your home directory.
• No third-party dependencies, no outbound calls, nothing persisted outside your account.

#!/usr/bin/env bash
set -uo pipefail
export AWS_PAGER=""

# AWS Security Baseline - READ-ONLY inventory
# ------------------------------------------------------------
# Purpose:
#   Show which key AWS security/visibility services are
#   already enabled. This script makes LIST/DESCRIBE/GET
#   calls only. It DOES NOT enable, disable, create,
#   update, or delete anything.
#
# Default:
#   Scan every AWS Region that is opted-in or enabled.
#
# Optional:
#   SCAN_ALL_REGIONS=0 REGION=eu-west-1 ./aws-...sh
#
# Output:
#   ~/aws-security-enabled-audit-YYYYmmdd-HHMMSS.md
#   ~/aws-security-enabled-audit-YYYYmmdd-HHMMSS.txt

SCAN_ALL_REGIONS="${SCAN_ALL_REGIONS:-1}"
REGION="${REGION:-${AWS_REGION:-eu-west-1}}"
TS="$(date -u +%Y%m%d-%H%M%S)"
REPORT_MD="$HOME/aws-security-enabled-audit-${TS}.md"
REPORT_TXT="$HOME/aws-security-enabled-audit-${TS}.txt"

have() { command -v "$1" >/dev/null 2>&1; }
if ! have aws; then
  echo "ERROR: AWS CLI is required."; exit 1
fi

ACCOUNT_ID="$(aws sts get-caller-identity \
  --query Account --output text 2>/dev/null)"
# ... 18 service checks across all regions follow ...