Resources to learn AWS Security
This is a collection of resources to learn and practice AWS Security - both offense and defense in no particular order.
Tools
- awspx
- AWS Cloud Simulation
- Permissions.cloud
- ScoutSuite
- Prowler
- Pacu
- Cloudfox
- Pmapper
- Cloud Custodian
- stratus-red-team
- Amazon GuardDuty Tester
- aws-recon
- aws-inventory
- GrayHat Warfare
- cloud-enum
- List of AWS Exposable Resources
- Cartography
- Cloudsplaining - Publicly archieved now
- Cognito Scanner
- AWS PWN
- Redboto
- RepoKid
- Aardvark
Guides/Methodology/Cheatsheets/Blogs
- Hacking the cloud
- AWS Pentesting Guide - HTB
- Security Learning - AWS
- HackTricks - AWS
- AWS CLI Tool Cheatsheet
- Cloud penetration testing - Seth Art
- AWS Penetration Testing - Nick Jones
- Introduction to Offensive Operations in AWS
- CloudSecDocs
- https://www.secwiki.cloud/
- Internal All The Things - Swissky
- TrendMicro Knowledge Base
- Last week in AWS
- https://onecloudplease.com/
- https://awsteele.com/
- https://christophetd.fr/
- Customer security incidents
- https://chrisfariss.com
- https://breaches.cloud
- CloudSecWiki
- AWS Security Maturity Model
- AWS Security Best Practices
- Awesome AWS Security
- CloudSec Academy- Wiz
- Security Pillar AWS Well-Architected Framework
- AWS Prescriptive Guidance
- Cloud Security - Sysdig
- Cloud Threat Landscape - Wiz
- https://securitylabs.datadoghq.com/
- Permiso Blog
Labs and challenges
- Pwned Labs
- CloudFoxable
- Refining IAM Permissions
- Threat Detection and Response with Amazon GuardDuty and Amazon Detective
- Identity Round Robin
- AWS Security Workshops
- Cloudsec tidbits
- AWS Control Tower Guide
- Well Architected Labs
- flaws.cloud
- flaws2.cloud
- CloudGoat
- Damn Vulnerable Cloud Application
- AWS Detonation Lab
- SadCloud
- AWSGoat
- iam-vulnerable
Videos/Courses/Presentations
- AWS Power House - Specialty
- Security Exploration - AWS Verified Permissions
- Penetrating the Cloud: Uncovering Unknown Vulns
- fwd:CloudSec
- Cloud Security Podcast
- Cloud Village
- AWS re:Invent
- What I Wish I Knew Before Pentesting AWS Environments
- Securing AWS Discover Cloud Vulnerabilities via Pentesting
- Cloud Pentest Apocalypse Beau Bullock
- Cognito Attacks - Payatu Webinar
- IAM Privilege Escalation Labs - CYBR
- AWS Security Courses - CYBR
- Cloud Red Teaming
- Get Outta My Host and into my cloud - Chris Farris
- Welcome to the Jungle: Pentesting AWS
- Talks and Workshops - Nick Jones
Incident Response / Case Studies
This post is licensed under CC BY 4.0 by the author.