guardian/fsbp-tools

fsbp-fix is a tool that automatically fixes common security misconfigurations in Amazon Web Services (AWS) environments. Instead of manually hunting down and correcting settings that leave cloud resources exposed, an engineer can run this tool to find and resolve those issues in a fraction of the time. It was built by the Guardian to help enforce the AWS Foundational Security Best Practices standard, a set of security guidelines published by AWS. The tool currently tackles two specific problems. The first involves Amazon S3, the cloud storage service where companies keep files and data. The tool finds any S3 "buckets" (the containers holding that data) that are accidentally configured to allow public access, and then locks them down so only authorized users can get in. The second involves EC2 security groups, which act like digital bouncers controlling what network traffic can flow in and out of servers. The tool finds the default security groups that have loose rules allowing unwanted traffic and strips those rules away, provided the security group isn't actively being used by a live server. Notably, the tool is careful to skip over resources managed by CloudFormation, an AWS service that uses templates to set up infrastructure, so it doesn't accidentally create conflicts with those templates. The primary users are cloud engineers, security teams, or developers responsible for keeping an AWS account safe. For example, if a company runs a security audit and discovers that several storage buckets are publicly readable, an engineer could use this tool to quickly close that exposure across all their buckets at once, rather than clicking through the AWS dashboard one by one. A practical feature of the tool is that it runs in a "dry run" mode by default. This means it will simply show the user which resources are misconfigured and what it would fix, without actually changing anything. The user has to explicitly tell the tool to execute before it makes any real changes, and even then, it asks for confirmation first. This gives teams a safe way to review the findings before committing to automated fixes.