ComplyZombie — Multi-Cloud Compliance Scanner

What it is

ComplyZombie scans a live AWS account for security misconfigurations and maps every finding to five compliance frameworks at once — SOC 2, ISO 27001, NIST CSF, PCI-DSS, and HIPAA. It runs on a schedule, stores results in S3, and a React dashboard reads that data straight from S3 to show real-time compliance posture. No mock data — the dashboard below is a live scan of my own AWS account.

ComplyZombie dashboard showing a 27% overall compliance score across SOC 2, PCI-DSS, HIPAA, ISO 27001, and NIST CSF

Architecture

EventBridge (daily 9 AM cron)
        │
        ▼
Lambda (Python / boto3) — checks IAM, S3, EC2, CloudTrail
        │
        ▼
S3 — stores timestamped reports + latest.json
        │
        ▼
React + TypeScript dashboard — fetches latest.json directly from S3

What it checks

IAM — root/user MFA enforcement, password policy strength
S3 — bucket encryption, public access blocks, versioning, logging
EC2 — security groups with overly permissive inbound rules
CloudTrail — audit logging configuration

Every control is tagged with which frameworks it satisfies, so a single check (e.g. “root account MFA enabled”) can simultaneously count toward SOC 2, ISO 27001, NIST CSF, and PCI-DSS.

Live results

A recent scan of my own account came back at a 27.0% overall compliance score (Risk Level: High) — 10 of 37 controls passing, 9 failing, 18 warnings. Framework breakdown from that scan:

Framework	Score	Passed	Failed	Warnings
SOC 2	47.6%	10	9	2
PCI-DSS	47.6%	10	9	2
HIPAA	33.3%	1	0	2
ISO 27001	27.0%	10	9	18
NIST CSF	27.0%	10	9	18

The point isn’t a clean scorecard — it’s that the scanner surfaces real gaps (weak password policy, open security groups) the same way it would in a production environment, instead of just checking boxes.

Stack

Backend: Python 3.11, boto3, AWS Lambda, EventBridge, CloudWatch
Frontend: React 18, TypeScript, Vite, Tailwind CSS, Recharts
Storage: S3 (report archive + latest.json for the dashboard to poll)

What’s next

Multi-cloud support (Azure, GCP), a FastAPI REST backend, and a RAG-powered chatbot so you can ask the dashboard “why did IAM-004 fail?” instead of digging through the control list.