Find AWS security risks before attackers do.

GoNinja scans your AWS accounts read-only for security and compliance gaps, then reverse-engineers your live infrastructure into clean, modular Terraform — one read-only connection, mapped to CIS, SOC 2 and PCI-DSS.

CIS AWS Foundations SOC 2 PCI-DSS v4.0 Terraform Amazon Web Services
🛡️
Security & Compliance Scanning
Read-only, multi-region scans mapped to CIS, SOC 2 & PCI-DSS — with drift alerts and board-ready reports.
🏗
Terraform Generation
Reverse-engineer a live account into clean, modular Terraform — one folder per app, with import blocks that bind to live state.

🏗 Generate Terraform

Reverse-engineer the account above into clean, modular Terraform — complete with import blocks that bind the code to your live infrastructure. Uses the same read-only role as scanning; nothing is ever changed in your account.

--

Security Posture

0Critical
0High
0Medium
0Low

Everything GoNinja does

Two products, one read-only connection, one $9.95/month subscription.

🛡️ Security & Compliance

  • Read-only scanning — connects through a role you control; we can never change anything in your account.
  • CIS, SOC 2 & PCI-DSS — every finding mapped to the controls auditors ask about.
  • Prioritized findings — critical → low, each with a plain-English remediation step.
  • Drift detection — see what changed since your last scan, automatically.
  • Daily continuous monitoring — email alerts the moment a new issue appears.
  • Multi-region — scans every enabled AWS region from one place.
  • Board-ready reports — export to HTML or print to PDF.

🏗 Terraform Generation

  • Reverse-engineer live infra → clean, modular, idiomatic Terraform.
  • One folder per application — auto-grouped from your resource tags.
  • Shared networking layer — apps reference it via terraform_remote_state.
  • Live-state binding — generated import blocks aim for a zero-diff plan.
  • 30+ resource types — VPC, EC2, ECS, Lambda, RDS, DynamoDB, ALB, IAM, S3, CloudFront, Route 53, SQS/SNS, ElastiCache, API Gateway.
  • Built for big accounts — async generation, no timeouts, download as a .zip.
  • Generation history — re-download any previous run.

🔐 Platform & Trust

  • Cross-account IAM role — you grant access, and revoke it anytime.
  • Unique External ID per user — you can only ever reach accounts you onboarded.
  • Two-factor authentication — required on paid accounts.
  • Data residency — everything stays in the AWS Sydney region. 🇦🇺
  • 7-day free trial — no credit card to start.
  • One simple price — $9.95 per user / month, scanning and Terraform included.