A curated list of awesome cloud security related resources.
🛡️ Awesome Cloud Security Resources ⚔️
- aws_pwn: A collection of AWS penetration testing junk
- aws_ir: Python installable command line utility for mitigation of instance and key compromises.
- aws-vault: A vault for securely storing and accessing AWS credentials in development environments.
- awspx: A graph-based tool for visualizing effective access and resource relationships within AWS.
- azucar: A security auditing tool for Azure environments
- checkov: A static code analysis tool for infrastructure-as-code.
- CloudBrute: A multiple cloud enumerator.
- cloudgoat: "Vulnerable by Design" AWS deployment tool.
- Cloudmapper: Analyze your AWS environments.
- Cloudsploit Scans: Cloud security configuration checks.
- Cloud-custodian: Rules engine for cloud security, cost optimization, and governance.
- cs suite: Tool for auditing the security posture of AWS/GCP/Azure.
- diffy: Diffy is a digital forensics and incident response (DFIR) tool developed by Netflix.
- ElectricEye: Continuously monitor AWS services for configurations.
- Forseti security: GCP inventory monitoring and policy enforcement tool.
- Hammer: A multi-account cloud security tool for AWS. It identifies misconfigurations and insecure data exposures within most popular AWS resources.
- Leonidas: A framework for executing attacker actions in the cloud.
- Open policy agent: Policy-based control tool.
- pacbot: Policy as Code Bot.
- pacu: The AWS exploitation framework.
- Prowler: Command line tool for AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool.
- ScoutSuite: Multi-cloud security auditing tool.
- Security Monkey: Monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.
- TerraGoat: Bridgecrew's "Vulnerable by Design" Terraform repository.
- Terrascan: Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
- tfsec: Static analysis powered security scanner for Terraform code.
- Zeus: AWS Auditing & Hardening Tool.
- auditkube: Audit for for EKS, AKS and GKE for HIPAA/PCI/SOC2 compliance and cloud security.
- ccat: Cloud Container Attack Tool.
- Falco: Container runtime security.
- mkit: Managed kubernetes inspection tool.
- Open policy agent: Policy-based control tool.
- Function Shield: Protection/destection lib of aws lambda and gcp function.
- FestIN: S3 bucket finder and content discover.
- GCPBucketBrute: A script to enumerate Google Storage buckets.
- Lambda Guard: AWS Lambda auditing tool.
- Policy Sentry: IAM Least Privilege Policy Generator.
- S3 Inspector: Tool to check AWS S3 bucket permissions.
- Serverless Goat: A serverless application demonstrating common serverless security flaws
- AWS
- Artifact: Compliance report selfservice.
- Certificate Manager: Private CA and certificate management service.
- CloudTrail: Record and log API call on AWS.
- Config: Configuration and resources relationship monitoring.
- Detective: Analyze and visualize security data and help security investigations.
- Firewall Manager: Firewall management service.
- GuardDuty: IDS service
- CloudHSM: HSM service.
- Inspector: Vulnerability discover and assessment service.
- KMS: KMS service
- Macie: Fully managed data security and data privacy service for S3.
- Secret Manager: Credential management service.
- Security Hub: Integration service for other AWS and third-party security service.
- Shield: DDoS protection service.
- VPC Flowlog: Log of network traffic.
- WAF: Web application firewall service.
- Azure
- Application Gateway: L7 load balancer with optional WAF function.
- DDoS Protection: DDoS protection service.
- Dedicated HSM: HSM service.
- Key Vault: KMS service
- Monitor: API log and monitoring related service.
- Security Center: Integration service for other Azure and third-party security service.
- Sentinel: SIEM service.
- GCP
- Access Transparency: Transparency log and control of GCP.
- Apigee Sense: API security monitoring, detection, mitigation.
- Armor: DDoS protection and WAF service
- Asset Inventory: Asset monitoring service.
- Audit Logs: API logs.
- Cloud HSM: HSM service
- Context-aware Access: Enable zero trust access to applications and infrastructure.
- DLP: DLP service:
- EKM: External key management service
- Identity-Aware Proxy: Identity-Aware Proxy for protect the internal service.
- KMS: KMS service
- Policy Intelligence: Detect the policy related risk.
- Security Command Center: Integration service for other GCP security service.
- Security Scanner: Application security scanner for GAE, GCE, GKE.
- Event Threat Detection: Threat dection service.
- VPC Service Controls: GCP service security perimeter control.
- Overiew of AWS Security
- AWS-IAM-Privilege-Escalation by RhinoSecurityLabs: A centralized source of all AWS IAM privilege escalation methods.
- MITRE ATT&CK Matrices of AWS
- AWS security workshops
- Overiew of Azure Security
- Azure security fundamentals
- MicroBurst by NetSPI: A collection of scripts for assessing Microsoft Azure security
- MITRE ATT&CK Matrices of Azure
- Cloud Security Research by RhinoSecurityLabs
- CSA cloud security guidance v4
- Appsecco provides training
See contributing