Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Recon

List hosts and IPs across your cloud provider accounts

List assets from multiple cloud providers in one inventory.

Agent
Build a cloud asset inventoryFeed testing with real assetsFilter by service or provider

overview

What cloudlist does

cloudlist authenticates to provider APIs and lists the hostnames and IPs your accounts actually run. It is the authoritative inventory path, not an outside guess.

Point -provider-config at credentials, narrow with -provider or -service, and choose -host, -ip, or -json for the shape downstream nodes need. -exclude-private drops non-routable ranges.

Use when you hold keys. For exposed public names you do not own, use cloud-enum. Trickest runs it as a managed Recon node; wire the FILE output into httpx so probing tracks the current estate.

source github.com/projectdiscovery/cloudlist

use cases

Where cloudlist fits

Build a cloud asset inventory

Read hosts and IPs from your provider accounts to produce an authoritative list of what the organization runs, not a guess from the outside.

Feed testing with real assets

Export hostnames and pass them to a prober and scanner so security runs cover the live estate rather than a stale spreadsheet.

Filter by service or provider

Use -provider or -service to narrow the inventory to a single account or resource type when you only need part of the footprint.

Track a changing estate

Run cloudlist on a schedule and diff results to catch assets engineers add or remove over time.

reference

cloudlist inputs and flags

12 inputs
NameTypeFlagDescription
provider-configFILE-provider-configProvider credentials config file that drives the inventory.
providerSTRING-providerDisplay results for the given providers, comma-separated (aws, gcp, azure, ...).
serviceSTRING-serviceQuery and display results from the given services, comma-separated (ec2, s3, route53, ...).
hostBOOLEAN-hostDisplay only hostnames in results.
ipBOOLEAN-ipDisplay only IPs in results.
jsonBOOLEAN-jsonWrite output in JSON format.
exclude-privateBOOLEAN-exclude-privateExclude private IPs from CLI output.
idSTRING-idDisplay results for the given ids, comma-separated.

Showing key inputs. cloudlist exposes 12 inputs in total.

Full flag reference (12 inputs)
NameTypeFlagDescription
idSTRING-iddisplay results for given ids (comma-separated)
ipBOOLEAN-ipdisplay only ips in results
hostBOOLEAN-hostdisplay only hostnames in results
jsonBOOLEAN-jsonwrite output in json format
configFILE-configcloudlist flag config file
silentBOOLEAN-silentdisplay only results in output
serviceSTRING-servicequery and display results from given service, comma-separated (default ingress,ecs,eks,lambda,nomad,instance,consul,custom,service,route53,fastly,cloud-run,elb,cloudfront,cloud-function,publicip,ec2,gke,droplet,domain,s3,compute,vm,app,dns,alb,lightsail,apigateway)
verboseBOOLEAN-vdisplay verbose output
providerSTRING-providerdisplay results for given providers, comma-separated (default linode,nomad,openstack,custom,arvancloud,digitalocean,scw,cloudflare,heroku,kubernetes,aws,do,alibaba,namecheap,terraform,r1c,fastly,consul,hetzner,gcp,azure)
exclude-privateBOOLEAN-exclude-privateexclude private ips in cli output
provider-configFILE-provider-configprovider config file
disable-update-checkBOOLEAN-disable-update-checkdisable automatic cloudlist update check

example

Run cloudlist

cloudlist · command
# inventory AWS and GCP assets, drop private IPs, write resultscloudlist -provider-config providers.yaml -provider aws,gcp -exclude-private -o assets.txt
sample output
app.example.comapi.example.comstaging.example.comcdn.example.com198.51.100.24198.51.100.25203.0.113.10203.0.113.11vpn.example.com…  (218 assets across 3 providers for the real run behind this page)

guidance

Choosing cloudlist

Use cloudlist when you hold provider credentials and want a true inventory of the assets your accounts run. It reads accounts from the inside, so for finding public resources you do not own, use cloud-enum instead. It lists assets; it does not test them, so follow it with httpx.

cloud-enum

Brute-forces public cloud names from outside. cloudlist reads your own accounts via their APIs.

asnmap

Maps IP ranges from ASN data. cloudlist enumerates assets straight from cloud providers.

amass

Broad OSINT discovery from public sources. cloudlist is authoritative for accounts you control.

faq

cloudlist questions

Yes. cloudlist reads each provider's API, so you supply keys in a -provider-config file (a YAML block per account: provider name, id, and secret). It then returns the assets those accounts run. No credentials means no results.

related

More Recon tools

  1. amass

    Multi-source subdomain discovery; hand names to httpx.

  2. amass-intel

    OWASP Amass intel: map an organization's root domains and ranges.

  3. assetfinder

    Find domains and subdomains potentially related to a given domain.

  4. bbot

    Modular OSINT recon that chains modules from a seed target.

  5. bevigil

    CLI client for the BeVigil OSINT API, keyed by domain or app package.

  6. cloud-enum

    Multi-cloud public name enumeration for AWS, Azure, and GCP.

Run cloudlist yourself

A provider config feeds cloudlist, which reads the accounts' assets and passes the hostnames to httpx so only live ones land as output.

Run cloudlist in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.