Awesome-CloudSec-Labs - Awesome free cloud native security learning labs.

项目说明

Awesome Cloud Security Labs

A list of free cloud nati learning labs. Includes CTF, self-hosted workshops, guided labs, and research labs.

Sorted by Technology and Category

| Name | Technology | Category | Author | Notes |
| :------------- |:-------------:| :-----:| :-----: | :------: |
| The Ultimate Cloud Security Championship | AWS | Author-hosted CTF Challenge | Wiz | A monthly CTF challenge, with challenges curated by a Star Wiz researcher. Challenges and leaderboard hosted by Wiz. |
| CloudFoxable | AWS | Self-hosted CTF Challenge | Seth Art | Create your own by design AWS penetration testing playground
| Pwned Labs | AWS | Author-hosted Guided Labs, CTF | Ian Austin | Requires account registration; Commercial paid subscriptions; free hosted labs for learning cloud security |
| The Big IAM Challenge | AWS | Author-hosted CTF Challenge | Wiz | CTF challenge to identify and exploit IAM misconfigurations |
| The Cloud Hunting Games | AWS | Author-hosted CTF Challenge | Wiz | CTF ransomware challenge designed to teach real-world cloud in based on TTPs seen in the wild |
| CloudSec Tidbits | AWS | Self-hosted Challenge | Doyensec | Three web app security flaws specific to AWS cloud, self-hosted with terraform |
| AWS Well-Architected Security Workshop | AWS | Self-hosted, guided labs | AWS Well-Architected | Several hands-on-labs to help you learn, measure, and improve the security of your architecture using best practices from the Security pillar of the AWS Well-Architected Framework. |
| AWS CIRT Workshop | AWS | Self-hosted, guided lab | AWS CIRT | Build with Cloudformation, explore 5 common incident response scenarios observed by AWS CIRT |
| CloudGoat | AWS | Self-hosted, guided lab | Multiple, Rhino Security Labs | Python orchestration of terraform |
| Attacking and Defending Ser Applications | AWS | Self-hosted, guided workshop | Ryan Nicholson | Attack and defend a Lambda that you build in your own AWS account with author provided terraform |
| IAM | AWS | Self-hosted, guided lab | Seth Art | IAM-focused priv esc playground with 31 pathways, create in your own AWS account using terraform, solid docs |
| flaws.cloud | AWS | Author-hosted, CTF challenge | Scott Piper | Challenge style with levels and clues |
| flaws2.cloud | AWS | Author-hosted, CTF challenge | Scott Piper | Challenge style Attacker and Defender paths |
| CI/CDon't | AWS | Self-hosted CTF walkthrough | Nick Frichette | Host with terraform in your own AWS account, CI/CD CTF infrastructure |
| AWSGoat | AWS | Self-hosted, attack and defense manuals | Multiple, ine-labs | Bring your own aws account, Build with terraform, two modules, provides attack and defense manuals |
| Sadcloud | AWS | Self-hosted | Multiple, NCC Group | Terraform code; not guided like CloudGoat |
| DVCA | AWS | Self-hosted demo lab | Maxime Leblanc | Deploy a Damn Cloud Application in your own AWS account to practice pri escalation |
| lambhack | AWS | Self-hosted lab | James Wickett | Deploy a very AWS lambda ser application in your AWS account |
| AWSCloudPentest | AWS | Self-hosted lab | Punit Darji | Deploy AWS scenarios in your account using terraform and learn how to exploit them. Companion YouTube channel. |
| EntraGoat | Azure | Self-hosted lab | Semperis | A deliberately Microsoft Entra ID infrastructure. Uses Powershell Graph SDK scripts with a nice NodeJS web UI for management. Six attack path scenarios with solutions documented. |
| BadZure | Azure | Self-hosted lab | Mauricio | Powershell Graph SDK script that spins up your own Azure AD (Entra ID) lab with attack paths. Currently no walk through or guide. |
| Broken Azure | Azure | Author-hosted, CTF challenge | Secura | Provides hints, optionally self-host in your own Azure account using terraform |
| Mandiant Azure Workshop | Azure | Self-hosted, guided commands | Multiple | by design Azure lab with two scenarios; build with terraform |
| AzureGoat | Azure | Self-hosted, attack and defense manuals | Multiple, ine-labs | Bring your own Azure tenant, Build with terraform, one module, provides attack and defense manuals |
| XMGoat | Azure | Self-hosted, guided labs | Multiple | Build with terraform, 5 scenarios, solution docs provided |
| CONVEX | Azure | Self-hosted, CTF | Multiple | Spin up three Capture the Flag en in your Azure tenant using powershell |
| GCP CTF Workshop | GCP | Self-hosted, lab guide | Marion Säckel, Marcus Hallberg | Host in your own GCP account, build with terraform using bash setup script, solution and hints provided |
| GCP Goat (Josh Jebaraj) | GCP | Self-hosted, mdbook lab guide | Josh Jebaraj | Host in your own GCP account, build with provided scripts, nice guided lab workbook |
| GCPGoat (ine-labs) | GCP | Self-hosted, attack and defense manuals| Multiple, ine-labs | Bring your own GCP account, Build with terraform, one module, provides attack and defense manuals |
| Thunder CTF | GCP | Self-hosted, CTF| Multiple | Bring your own GCP account, 6 levels, practice attacking cloud projects on GCP |
| OWASP EKS Goat| Kubernetes/EKS | Deployed into your own AWS EKS cluster | Anjali Shukla/Di Shukla | An intentionally AWS EKS en simulating real‑world misconfigurations, IAM flaws, and pod breakout paths along with aws nati. Includes 20+ attack‑defense labs you can deploy and practice hands‑on. |
| K8s Lan Party | Kubernetes | Author hosted, CTF challenge| Wiz | To dive into a network full of misconfigurations and exploit with the goal of conquering a Kubernetes cluster |
| EKS Cluster Games | Kubernetes | Author hosted, CTF challenge| Wiz | EKS pod with flag challenges across en, with leaderboard and requires registration |
| Bustakube | Kubernetes | Self-hosted, import VMs| Jay Beale | K8S cluster, Download the VMs to build cluster and import into , run it |
| Kubernetes Goat | Kubernetes | Self-hosted, multi-cloud, K3S| Madhu Akula | Create and host in your own cloud account (GKE, EKS, AKS) or K3S and attack, has a guided workbook |
| Kubecon NA 2019 CTF | Kubernetes | Self-hosted in GKE| Multiple | Create GCP account, has a guided workbook with two attack and defense scenarios plus bonus challenges|
| Kube Security Lab | Kubernetes | Local, kubernetes in docker| Rory McCune | An awesome local lab to create 14 Kubernetes clusters using Docker, Ansible, and Kind. Attack them after building, then destroy. Includes walkthroughs.|
| Container Security 101 | Container | Self-hosted, guided workshop| Jon Zeolla | A guided workshop, host in your AWS account, provided CloudFormation|
| Contained.af | Container | Self-hosted Challenge| Jessie Frazelle | A container escape challenge, break out of it and email the author|
| TerraGoat | Terraform | Self-hosted multi-cloud (AWS, Azure, GCP)| Multiple, Bridgecrew | by design terraform repository|
| PurpleCloud | Azure | Research Lab | Jason Ostrom | Using python and terraform, build your own Azure security lab|
| SimuLand | Azure | Research Lab | Roberto Rodriguez | Using Azure RM templates, create your own Azure security lab|
| CNAPPgoat | AWS, Azure, GCP | Research Lab | Ermetic Research | Using Pulumi, modularly pro components in AWS, GCP, Azure|
| CI/CD Goat | CI/CD | CTF, local docker | Palo Alto | Deliberately CI/CD en, hacking CI/CD pipelines with CTF. Host locally with docker.|
| Github Actions Goat | CI/CD | Self-hosted Github | StepSecurity | Deliberately Github Actions CI/CD en, hosted in your own Github account. Includes threat scenario descriptions mapped to .|
| PaaS Cloud Goat | PaaS | Deployed into your Salesforce account | Coalfire Research | A simulated Salesforce application, hosted in your own SF account. Simulates a deployed custom application with security tests and documentation you can use to learn.|

AWS

The Ultimate Cloud Security Championship: A monthly CTF challenge, with challenges curated by a Star Wiz researcher. Challenges and leaderboard hosted by Wiz.

CloudFoxable: Create your own by design AWS penetration testing playground.

Pwned Labs: Requires a login. Offers paid subscriptions. Free hosted labs for learning cloud security.

The Big IAM Challenge: CTF challenge to identify and exploit IAM misconfigurations.

The Cloud Hunting Games: CTF ransomware challenge designed to teach real-world cloud in based on TTPs seen in the wild.

CloudSec Tidbits: Three web app security flaws specific to AWS cloud, self-hosted with terraform.

AWS CIRT Workshop: Build in your own AWS account and explore 5 common incident response scenarios as seen by the AWS CIRT team.

CloudGoat: by design AWS security labs with guided walkthrough.

Attacking and Defending Ser Applications: Attack and defend a Lambda that you build in your own AWS account with author provided terraform and scripts. Very educational with workshop style feel.

IAM : Use Terraform to create your own by design AWS IAM pri escalation playground with 31 pri escalation attack pathways. Very solid documentation.

flaws.cloud: Challenge style with levels and clues.

flaws2.cloud: Challenge style with both Attacker and Defender paths.

CI/CDon't: A CI/CD CTF challenge hosted in your aws account with terraform. Includes a walkthrough.

AWSGoat: A damn AWS infrastructure with two attack and defense manuals.

Sadcloud: Create AWS services without a guide showing .

DVCA: Deploy a Damn Cloud Application in your own AWS account to practice pri escalation.

lambhack: Deploy a very AWS lambda ser application in your AWS account.

AWSCloudPentest: Deploy AWS scenarios in your account using terraform and learn how to exploit them. He has a companion YouTube channel[().

[AWS Well-Architected Security Workshop: Self-deployed hands-on-labs to help you learn, measure, and improve the security of your architecture using best practices from the Security pillar of the AWS Well-Architected Framework.

Azure

EntraGoat: A deliberately Microsoft Entra ID infrastructure. Uses Powershell Graph SDK scripts with a nice NodeJS web UI for management. Six attack path scenarios with solutions documented.

BadZure: Powershell Graph SDK script that spins up your own Azure AD (Entra ID) lab with attack paths. Currently no walk through or guide.

Broken Azure: A by design Azure infrastructure that you can attack.

Mandiant Azure Workshop: by design Azure lab with two scenarios that you build in your own Azure tenant.

AzureGoat: Build one module with terraform and walk through the provided attack and defense manuals.

XMGoat: Build 5 scenarios in your Azure tenant and walk through solution docs provided.

CONVEX: Spin up three Capture the Flag en in your Azure tenant using powershell.

GCP

| GCP CTF Workshop: Self-hosted, lab guide. Host in your own GCP account, build with terraform using bash setup script, solution and hints provided.

GCP Goat (Josh Jebaraj): Host in your own GCP account and build with provided scripts. It has a nice guided lab workbook.

GCPGoat (ine-labs): Bring your own GCP account and build one module with terraform. Provides attack and defense manuals.

Thunder CTF: Bring your own GCP account, 6 levels, practice attacking cloud projects on GCP.

Kubernetes

OWASP EKS Goat: An intentionally AWS EKS en simulating real‑world misconfigurations, IAM flaws, and pod breakout along with defense hands on lab. Includes 20+ attack‑defense labs you can deploy and practice hands‑on.

K8s Lan Party: To dive into a network full of misconfigurations and exploit with the goal of conquering a Kubernetes cluster, with leaderboard and requires registration.

EKS Cluster Games: EKS pod with flag challenges across en, with leaderboard and requires registration.

Bustakube: Download a K8S cluster as VMs that you can import and run locally in .

Kubernetes Goat: Create and host in your own cloud account (GKE, EKS, AKS) or K3S and attack. Includes a guided workbook.

Kubecon NA 2019 CTF: Awesome CTF that you create in your GCP account. Has a guided workbook with two attack and defense scenarios plus bonus challenges.

Kube Security Lab: An awesome local lab to create 14 Kubernetes clusters using Docker, Ansible, and Kind. Attack them after building, then destroy. Inludes walkthroughs.

Container

Container Security 101: A guided workshop that is hosted in your AWS account. Author has provided a nice lab you follow on the webpage and you build a VM with CloudFormation and then create a container.

Contained.af: A container escape challenge, break out of it and email the author.

Terraform

TerraGoat: by design terraform repository.

Research Labs

PurpleCloud: Using python and terraform, build your own Azure security lab.

SimuLand: Using Azure RM templates, create your own Azure security lab.

CNAPPgoat: Using Pulumi, modularly pro components in AWS, GCP, Azure. The are modular scenarios with no guided walkthrough existing yet.

CI/CD

CI/CD Goat: Deliberately CI/CD en, hacking CI/CD pipelines with CTF. Host locally with docker.

Github Actions Goat: Deliberately Github Actions CI/CD en, hosted in your own Github account. Includes threat scenario descriptions mapped to .

PaaS

PaaS Cloud Goat: A simulated Salesforce application, hosted in your own SF account. Simulates a deployed custom application with security tests and documentation you can use to learn.

项目信息

开发语言：未知

Star 数：2198

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Awesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。