Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

awesome-aws-security

Curated list of links, references, books videos, tutorials (Free or Paid), Exploit, CTFs, Hacking Practices etc. which are related to AWS Security
https://github.com/jassics/awesome-aws-security

Last synced: 3 days ago
JSON representation

AWS Security Bulletin Important Issues
Tools of Trade
- truffleHog - Searches through git repositories for high entropy strings and secrets, digging deep into commit history
- gitleaks - Audit git repos for secrets
- AWS Security Benchmark - Open source demos, concept and guidance related to the AWS CIS Foundation framework.
- S3 Inspector - Tool to check AWS S3 bucket permissions
- Prowler - AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool.
- AWS Pentesting/Red Team Methodology - by hacktricks - A Collection for AWS environment penetration testing methodology.
- AWS Pentesting/Red Team Methodology - by hackingthe.cloud - A collection of attacks/tactics/techniques that can use by offensive security professionals during cloud exploitation.
- AWS Security Products - Official - Few Important tools that you should consider are:
- conformance packs on github
- Arsenal of AWS Security Tools - Collection of all security category tools and products
- AWS Security Automation - Collection of scripts and resources for DevSecOps and Automated Incident Response Security
- truffleHog - Searches through git repositories for high entropy strings and secrets, digging deep into commit history
- gitleaks - Audit git repos for secrets
- AWS Security Benchmark - Open source demos, concept and guidance related to the AWS CIS Foundation framework.
- ScoutSuite - Multi-Cloud Security Auditing Tool
- Prowler - AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool.
- AWS Vault - A vault for securely storing and accessing AWS credentials in development environments
- AWS PWN - A collection of AWS penetration testing junk
- Pacu - AWS Penetration Testing Toolkits
- Zeus - AWS Auditing and Hardening tool
- Cloud Mapper - Analyze your AWS environments (Python)
- ConsoleMe - A Central Control Plane for AWS Permissions and Access
- AWS Firewall Factory - Deploy, update, and stage your WAFs while managing them centrally via FMS.
- CloudFox - Automating situational awareness for cloud penetration tests
- aws-lint-iam-policies - Tool to find problems in identity-based and resource-based IAM policies
- AWS Pentesting/Red Team Methodology - by hacktricks - A Collection for AWS environment penetration testing methodology.
- S3 Inspector - Tool to check AWS S3 bucket permissions
Security Practices and CTFs
- AWS Well Architected Security Labs
- Flaws to learn common mistakes in AWS through challenge
- Flaws2 focuses on AWS security concepts through various challenge levels
- OWASP WrongSecrets - OWASP WrongSecrets is a vulnerable app which shows you how to not store secrets. It covers code, Docker, Kubernetes, and AWS cloud bad practices.
- AWS S3 CTF Challenges with solutions
- AWS CTF with practical scenario
- AWS Workshop official - This is not exactly security part, but would be helpful to understand AWS with this workshop examples.
- AWS Security Workshops
- AWS Cloud Quest: Security Role
- AWS Jam Journey: Security
- TryHackMe: Attacking and Defending AWS
- Free AWS Security Labs
- Black Sky Cloud Labs from HTB
- CloudFoxable - Create your own vulnerable by design AWS penetration testing playground
- CloudGoat By Rhino Security Labs - Vulnerable by Design AWS infrastructure setup tool
- OWASP ServerlessGoat - OWASP ServerlessGoat is a deliberately insecure realistic AWS Lambda serverless application maintained by OWASP for educational purposes.
- ThreatModel for Amazon S3 - Library of all the attack scenarios on Amazon S3 and how to mitigate them, following a risk-based approach
- OWASP WrongSecrets - OWASP WrongSecrets is a vulnerable app which shows you how to not store secrets. It covers code, Docker, Kubernetes, and AWS cloud bad practices.
AWS Security Breaches
AWS Security Podcast/Newsletter
- Cloud Security Podcast - YouTube - Weekly Interviews with Cloud Security Professionals on AWS, Azure, GCP Security for Blue Teams & Red Teams
- Cloud Security Newsletter - Weekly Cloud Security Nuggets in your inbox
AWS Whitepapers
Books
- Hands-On AWS Penetration Testing with Kali Linux by PackT
- Mastering AWS Security by PackT
- Cloud Security Automation
- Security Best Practices on AWS by PackT
- AWS Automation Cookbook
- AWS Lambda Security Best Practices - pdf - It's published by Puresec and it has a good overview on AWS Lambda Security Best Practices which we should follow
- AWS Security by Manning - Very nice book in Progress, yet to release.
- Securing DevOps - A book which has real-world examples for Cloud Security. Must read book for any Cloud Security Professionals.
- Serverless Security - An Apress book that discusses serverless security on AWS, Azure and Google Cloud.
- AWS Security Cookbook
- Practical Guide to Security in the AWS Cloud by SANS and sponsored by AWS Marketplace - pdf
- Effective IAM for AWS
- CSA Guide to Cloud Computing by Sungress
- Practical Cloud Security by O'reilly
- AWS Lambda Security Best Practices - pdf - It's published by Puresec and it has a good overview on AWS Lambda Security Best Practices which we should follow
- Hands-On AWS Penetration Testing with Kali Linux by PackT
- Security Best Practices on AWS by PackT
Videos
- The fundamentals of AWS Security - Youtube
- AWS Security by Design - Youtube
- Account Security with IAM - Youtube
- AWS Cloud Security Playlist - Youtube
- A cloud security architecture workshop by RSA - Youtube
- AWS Cloud Security - Oreilly
- Introduction to AWS Security Hub - Youtube
- Solution for flaws.cloud AWS Security Challenge - Youtube Playlist
- Hands-On With AWS Security Best Practices
- AWS re:Invent 2020: Security at scale: How Goldman Sachs manages network and access control
- AWS Cloud Security Playlist - Youtube
- Solution for flaws.cloud AWS Security Challenge - Youtube Playlist
- AWS Security Best Practice: Well-Architected way - Youtube
Online Tutorials/Blogs/Presentations
Online Courses (Paid/Free)
- AWS Certified Security Specialty - Udemy by Zeal Vora
- AWS Certified Security Specialty - From Acloud.guru
- AWS Certified Security Specialty - Udemy by Stephan Maarek
- AWS Fundamentals: Address Security Risks - Coursera
- Cloud Computing Security - Coursera
- AWS: Getting started with Cloud Security - EdX
- AWS Certified Security Specialty - From WhizLabs
- AWS Advanced Security - Udemy
- AWS Security Path - AppSecEngineer
- AWS for Architects: Advanced Security - Linkedin Learn by Lynn Langit
- Practical Event Driven Security with AWS - Acloud.guru
- Learning Path for AWS Security - Nicely designed the learning path who wants to be an AWS Security Experts from Acloud.guru
- Cloud Hacking course - From NotSoSercure
- AWS Skill Builder platform security learning plan - AWS SkillBuilder
- Cloud Security: AWS Edition Bootcamp by Pentester Academy - From Pentester Academy
- Breaking and Pwning Apps and Servers in AWS and Azure - Previously an instructor led training now released as free and open source courseware for Cloud Pentesters

Programming Languages

Python 9 Go 4 Shell 2 CSS 1 TypeScript 1 JavaScript 1 HCL 1

Ecosyste.ms: Awesome

awesome-aws-security

AWS Security Bulletin Important Issues

Tools of Trade

Security Practices and CTFs

AWS Security Breaches

AWS Security Podcast/Newsletter

AWS Whitepapers

Books

Videos

Online Tutorials/Blogs/Presentations

Online Courses (Paid/Free)