Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/zer0-kr/awesome-DevOpsSec

Archiving for DevOpsSec resources
https://github.com/zer0-kr/awesome-DevOpsSec

List: awesome-DevOpsSec

Last synced: 3 months ago
JSON representation

Archiving for DevOpsSec resources

Awesome Lists containing this project

README 

        
# Awesome DevOpsSec



This repository stores various AWS and K8s security resources



## Resources



### Blogs

> #### KR

- [CloudNet@ Blog](https://gasidaseo.notion.site/gasidaseo/CloudNet-Blog-c9dfa44a27ff431dafdd2edacc8a1863)

- [MR.ZERO](https://mr-zero.tistory.com/)

> #### EN

- [Rhino Security Labs Strategic & Technical Blog](https://rhinosecuritylabs.com/blog/?category=aws,cloud-security)

- [Hacking The Cloud](https://hackingthe.cloud/)

- [HackTricks Cloud](https://cloud.hacktricks.xyz/pentesting-cloud/aws-security)



### Documents

> #### AWS

- [AWS 보안 점검 및 보안 설정 가이드](https://rogue-gouda-f87.notion.site/AWS-de0b5749d03b464ea2e555cba3974d0b)

- [CIS Amazon Web Services Foundations Benchmark v2.0.0](https://downloads.cisecurity.org/#/)

- [AWS Foundational Security Best Practices (FSBP) standard](https://docs.aws.amazon.com/securityhub/latest/userguide/fsbp-standard.html?fbclid=IwAR1G_Me8JWLdln5QdCbtOobzLkbG5pNtZX3RhkxXWynZa6ZIMsadtE5ZkWc_aem_th_AcNTJ4ku8j1NdTdF8W3tjUKcBGe0vWbKvIQNV3ibO00ezQaBCG8PyGYu5Tf35q8mt1s)

- [AWS Cloud Security Checklist](https://securitycipher.com/aws-security-checklist/)

- [Ultimate Guide to Incident Response in AWS](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Playbooks/Playbook_Ultimate%20Guide%20to%20Incident%20Response%20in%20AWS.pdf)

> #### Kubernetes

- [CIS Kubernetes Benchmark v1.8.0](https://downloads.cisecurity.org/#/)

- [Kubernetes Hardening Guide](https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF)

- [K8s Security Checklist](https://kubernetes.io/docs/concepts/security/security-checklist/)

- [Securing a K8s Cluster](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/)

- [EKS Best Practices Guides](https://aws.github.io/aws-eks-best-practices/)



### Articles

> #### AWS

- [My AWS Pentest Methodology](https://medium.com/@MorattiSec/my-aws-pentest-methodology-14c333b7fb58)

- [AWS IAM Privilege Escalation – Methods and Mitigation](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)

- [Detailed Analysis of CloudDon, Cloud Data Breach of Korea e-commerce company](https://medium.com/s2wblog/detailed-analysis-of-clouddon-cloud-data-breach-of-korea-e-commerce-company-948c3a5df90d)

- [How I was able to access millions of ID cards on an e-commerce platform](https://sanggiero.com/posts/how-i-was-able-to-access-millions-id-cards-e-commerce/)

> #### Kubernetes

- [K8s Standard Architecture(2024)](https://github.com/sysnet4admin/_Book_k8sInfra/blob/main/docs/k8s-stnd-arch/2024/2024-k8s-stnd-arch.pdf)

- [15 Kubernetes Mistakes Side Effects Chart](https://media.licdn.com/dms/image/D5622AQEZwQUKLg0KxQ/feedshare-shrink_2048_1536/0/1692951628708?e=1720656000&v=beta&t=-3JuAClEi9lVYLEzXZ1uWfvrNiFqRqsyoEu9SexYlw0)



### Workshops

> #### AWS

- [AWS WAF 공격 및 방어 실습](https://sessin.github.io/awswafhol/)

- [AWS Well Architected Labs - Security](https://wellarchitectedlabs.com/security/)

- [AWS Incident Response Playbooks Workshop](https://catalog.us-east-1.prod.workshops.aws/workshops/43742d64-6a5e-45ea-9339-cbb3fb26944e/en-US)

> #### Kubernetes

- [Amazon EKS Workshops](https://awskrug.github.io/eks-workshop/)



### Vulnerabilities

- [CLOUDVULNDB](https://www.cloudvulndb.org/)

- [Public Cloud Security Breaches](https://www.breaches.cloud/)

- [Cloud Security Attacks](https://github.com/CyberSecurityUP/Cloud-Security-Attacks?tab=readme-ov-file)

- [aws-customer-security-incidents](https://github.com/ramimac/aws-customer-security-incidents?tab=readme-ov-file)



### Conferences

- [AWSKRUG Security Group](https://github.com/awskrug/security-group/tree/main)

- [AWS 리소스 허브](https://kr-resources.awscloud.com/)

- [Kubernetes Security Best Practices](https://www.youtube.com/watch?v=wqsUfvRyYpw&t=123s&ab_channel=CNCF%5BCloudNativeComputingFoundation%5D)



### Challenges

> #### Goats

- [CloudGoat](https://github.com/RhinoSecurityLabs/cloudgoat)

- [KubernetesGoat](https://github.com/madhuakula/kubernetes-goat)

- [TerraGoat](https://github.com/bridgecrewio/terragoat)

> #### IAM

- [IAM Vulnerable](https://github.com/BishopFox/iam-vulnerable)

- [The Big IAM Challenge](https://bigiamchallenge.com/challenge/1)

> #### Theme

- [S3 Game](http://s3game-level1.s3-website.us-east-2.amazonaws.com/level1.html)

- [EKS Game](https://eksclustergames.com/)

- [K8s Game](https://k8slanparty.com/)

> #### Misconfigured

- [flAWS](http://flaws.cloud/)

- [flAWS2](http://flaws2.cloud/)

- [Sadcloud](https://github.com/nccgroup/sadcloud)

- [Vulnmachines](https://www.vulnmachines.com/index.php)

- [CI/CDon't](https://hackingthe.cloud/aws/capture_the_flag/cicdont/)



### Trannings

- [AWS Certified Security Specialty](https://www.udemy.com/course/ultimate-aws-certified-security-specialty/)

- [Certified Kubernetes Security Specialist](https://www.youtube.com/watch?v=Jd_j2wruz6E&list=PLpbwBK0ptssx38770vYNwZEuCeGNw54CH)



### etc

- [ATT&CK](https://attack.mitre.org/#)

- [D3FEND](https://d3fend.mitre.org/)

- [RE&CT](https://atc-project.github.io/atc-react/)





## Tools

### AWS

- [prowler](https://github.com/prowler-cloud/prowler) - Security Vulnerability Scanner

- [steampipe](https://github.com/turbot/steampipe) - zero-ETL solution for getting data directly from APIs and services

- [CloudSploit](https://github.com/aquasecurity/cloudsploit) - Cloud Security Posture Management(CSPM) 

- [check_imds](https://github.com/zer0-kr/SecOpsTools/blob/main/aws/check_imds.py) - IMDSv1 Scanner

- [pacu](https://github.com/RhinoSecurityLabs/pacu) - AWS exploitation framework

- [my-arsenal-of-aws-security-tools](https://github.com/toniblyx/my-arsenal-of-aws-security-tools) - List of open source tools for AWS security



### Kubernetes

- [Trivy](https://github.com/aquasecurity/trivy) - Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes

- [kube-bench](https://github.com/aquasecurity/kube-bench) - Checks whether Kubernetes is deployed according to CIS Kubernetes Benchmark 

- [kube-hunter](https://github.com/aquasecurity/kube-hunter) - Hunt for security weaknesses in Kubernetes clusters

- [managed-kubernetes-auditing-toolkit](https://github.com/DataDog/managed-kubernetes-auditing-toolkit) - identifying common security issues in EKS

- [Kubescape](https://github.com/kubescape/kubescape) - Kubernetes security platform for your clusters, CI/CD pipelines, and IDE

- [Falco](https://github.com/falcosecurity/falco) - Cloud Native Runtime Security

- [Clair](https://github.com/quay/clair) - Vulnerability Static Analysis for Containers