awesome-aws-security - Curated list of links, references, books videos, t

项目说明

Awesome AWS Security ![Awesome]()

A standard curated list of links, references, books, , and tutorials (Free or
Paid), Exploit, CTFs, Hacking Practices, etc., are related to AWS Security.
_List inspired by the awesome list thing._

!Awesome AWS Security

Table of Contents

1. AWS Whitepapers
2. Books
3.
4. Online Tutorials/Blogs/Presentations
5. Online Courses (Paid/Free)
6. Tools of Trade
7. Security Practice and CTFs
8. AWS Security Bulleting Important Issues
9. AWS Security Breaches
10. Contributors

> [!NOTE]
> You can follow the below github repo as well to excel in Cloud Security
> 1. Awesome Cloud Security Learning Resources
> 2. AWS Security Study Plan
> 3. AWS Security Interview Quesitons
> 4. Cloud Security Roadmap
> 5. Cloud Security Slides Primer

AWS Whitepapers

AWS has awesome lists of whitepapers related to AWS Security. We are adding few important one here. You can anytime check more for updated or new security whitepapers here

And don't forget to bookmark AWS Security bulletin for new news from here

1. AWS O - One of the important whitepaper to understand an o of AWS
2. Introduction to AWS Security Whitepaper
3. AWS Well-Architected Security Pillar
4. Introduction to Security By Design
5. AWS Well Architected Framework
6. AWS Risk And Compliance Whitepaper
7. AWS Security Checklist
8. AWS HIPAA Compliance Whitepaper
9. AWS Cloud Adoption Framework
10. AWS Auditing Security Checklist
11. AWS CIS Foundation benchmark
12. AWS Security Incident Response
13. O of AWS Lambda Security
14. AWS KMS Best Practices
15. Encrypting File Data with Amazon Elastic File System
16. Security of AWS CloudHSM backups
17. Security o of AWS Lambda
18. NIST Cybersecurity Framework in the AWS cloud
19. NIST 800-144 Security and Privacy in Public Cloud Computing
20. Security at the Edge: Core Principles
21. AWS KMS Best Practices
22. Security O of AWS Fargate

Books

1. Hands-On AWS Penetration Testing with Kali Linux by PackT
2. Mastering AWS Security by PackT
3. Security Best Practices on AWS by PackT
4. Cloud Security Automation
5. AWS Automation Cookbook
6. AWS Lambda Security Best Practices - pdf - It's published by Puresec and it has a good o on AWS Lambda Security Best Practices which we should follow
7. AWS Security by Manning - Very nice book in Progress, yet to release.
8. Securing DevOps - A book which has real-world examples for Cloud Security. Must read book for any Cloud Security Professionals.
9. Ser Security - An Apress book that discusses ser security on AWS, Azure and Google Cloud.
10. AWS Security Cookbook
11. Practical Guide to Security in the AWS Cloud by SANS and sponsored by AWS Marketplace - pdf
12. CSA Guide to Cloud Computing by Sungress
13. Practical Cloud Security by O'reilly
14. Effective IAM for AWS
15. Amazon Bedrock in Action

1. The fundamentals of AWS Security - Youtube
2. AWS Security by Design - Youtube
3. Account Security with IAM - Youtube
4. AWS re:Inforce 2019 Security Best Practices - Youtube
5. AWS Cloud Security Playlist - Youtube
6. A cloud security architecture workshop by RSA - Youtube
7. AWS Cloud Security - Oreilly
8. Introduction to AWS Security Hub - Youtube
9. Solution for flaws.cloud AWS Security Challenge - Youtube Playlist
10. AWS Security Best Practice: Well-Architected way - Youtube
11. Hands-On With AWS Security Best Practices
12. AWS re:Invent 2020: Security at scale: How Goldman Sachs manages network and access control

Online Tutorials/Blogs/Presentations

1. AWS Security official blog
2. AWS in Plain English
3. Why the CIA trusts AWS
4. Fundamentals of AWS Security - Presentation from AWS
5. AWS Security primer - Nice o and quick run through AWS Security resources.
6. AWS Security Blog
7. How a whitehat hacker earned $1500 in 15 minutes due to AWS S3 misconfiguration - It was fun going through the blog. You can learn from this article too.
8. A deep dive into AWS S3 access control - It will give a very good grip on how S3 buckets can be exploited. Lengthy but worth to go through.
9. How Federico hacked a whole EC2 network during a penetration test
10. A short blog on hacking AWS - Examples are based on cloudgoat.
11. S3 security is flawed by design - This article will show you why you need to be extra careful when using AWS S3.
12. 51 Tips for Security AWS(pdf) - McAfee
13. The role of API gateways in API security
14. Finding SSRF via HTML Injection inside a PDF file on AWS EC2
15. Getting shell and data access in AWS by chaining
16. Hacking Ser Runtimes - Blackhat2017
17. Detailed blog on ConsoleMe: A Central Control Plane for AWS Permissions and Access by Netflix
18. Strengthen the security of sensitive data stored in Amazon S3 by using additional AWS services
19. Use IMDSv2 instead: Defense in depth
20. Managing permissions with grants in AWS Key Management Service
21. AWS IAM Exploitation
22. S3 Pentest by Rhino Security Labs
23. How an Attacker Could Use Instance Metadata to Breach Your App in AWS
24. Orca Security Research Team Discovers AWS CloudFormation
25. Orca Security Research Team Discovers AWS Glue
26. How I Discovered Thousands of Open Databases on AWS
27. C: Pri Escalation to SYSTEM in AWS
28. Downloading and Exploring AWS EBS Snapshots
29. Weaponizing AWS ECS Task Definitions to Steal Credentials From Running Containers
30. Good Read on AWS IAM Pri Escalation – Methods and Mitigation
31. One more on IAM Pri Escalation
32. *A very good repo for learning IAM based
33. AWS Penetration Testing: Step by step guide
34. AWS Interview question on SSH

Online Courses (Paid/Free)

1. AWS Fundamentals: Address Security Risks - Coursera
2. Cloud Computing Security - Coursera
3. AWS: Getting started with Cloud Security - EdX
4. AWS Certified Security Specialty - Udemy by Zeal Vora
5. AWS Certified Security Specialty - From Acloud.guru
6. AWS Certified Security Specialty - Udemy by Stephan Maarek
7. AWS Certified Security Specialty - From WhizLabs
8. AWS Ad Security - Udemy
9. AWS Security Path - AppSecEngineer
10. AWS for Architects: Ad Security - Linkedin Learn by Lynn Langit
11. Practical Event Dri with AWS - Acloud.guru
12. Learning Path for AWS Security - Nicely designed the learning path who wants to be an AWS Security Experts from Acloud.guru
13. Cloud Hacking course - From NotSoSercure
14. Breaking and Pwning Apps and Servers in AWS and Azure - Pre an instructor led training now released as free and open source courseware for Cloud Pentesters
15. AWS Skill Builder platform security learning plan - AWS SkillBuilder
16. Cloud Security: AWS Edition Bootcamp by Pentester Academy - From Pentester Academy
17. Cloud Security BootCamp by Kaizenteq - Monthly FREE Cloud Security Bootcamps From Kaizenteq
18. EKS Goat: AWS EKS Security Masterclass by Anjali and Di - FREE EKS Attack and Defense From Anjali & Di

Tools of Trade

1. AWS Security Products - Official - Few Important tools that you should consider are:
* 1.1 AWS IAM: AWS Identity and Access Management (IAM) enables you to manage access to AWS services and resources securely
* 1.2 CloudWatch: CloudWatch is the AWS monitoring tool
* 1.3 CloudTrail: AWS CloudTrail is a service that enables go, compliance, operational auditing, and risk auditing of your AWS account
* 1.4 AWS Inspector: AWS inspector is a security assessment service that does and best-practice scanning for AWS applications
* 1.5 Amazon GuardDuty: GuardDuty is a managed threat detection service that is simple to deploy, and scales with your infrastructure
* 1.6 AWS KMS: AWS KMS is a secure and resilient service that uses hardware security modules that have been under FIPS 140-2
* 1.7 AWS Shield: AWS Shield is a managed DDoS protection service. AWS Shield can protect EC2, Load balancers, CloudFront, Global Accelerator, and Route 53 resources
* 1.8 AWS Trusted Advisor: AWS Trusted Advisor is an online tool that provides you real time guidance to help you pro your resources following AWS best practices
* 1.9 AWS Config: AWS Config is a service that enables you to assess, audit, and e the configurations of your AWS resources
* 1.10 Security Hub: AWS Security Hub gives you a comprehensive view of your high-priority security alerts and security posture across your AWS accounts
* 1.11 AWS WAF: AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect a, compromise security, or consume excessi
* 1.12 AWS Macie: Macie is all about protecting data. It is a machine learning service that watches data access trends and finds anomalies to spot data leaks and unauthorized data access.
* 1.13 AWS Detective: Amazon Detecti collects log data from your AWS resources and uses machine learning, statistical analysis, and graph theory to build a linked set of data that enables you to easily conduct faster and more efficient security in.
* 1.14 AWS Conformance Packs: A conformance pack is a collection of AWS Config rules and remediation actions that can be easily deployed as a single entity in an account and a Region or across an organization in AWS Organizations. conformance packs on github
2. Arsenal of AWS Security Tools - Collection of all security category tools and products
3. AWS Security Automation - Collection of scripts and resources for De and Automated Incident Response Security
4. truffleHog - Searches through git repositories for high entropy strings and secrets, digging deep into commit history
5. gitleaks - Audit git repos for secrets
6. AWS Security Benchmark - Open source demos, concept and guidance related to the AWS CIS Foundation framework.
7. S3 Inspector - Tool to check AWS S3 bucket permissions
8. S3 Security Scanner - Comprehensive AWS S3 security scanner that analyzes bucket configurations, policies, and access controls
9. ScoutSuite - Multi-Cloud Security Auditing Tool
9. Prowler - AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool.
10. AWS Vault - A vault for securely storing and accessing AWS credentials in de en
11. AWS PWN - A collection of AWS penetration testing junk
12. Pacu - AWS Penetration Testing Toolkits
13. Zeus - AWS Auditing and Hardening tool
14. Cloud Mapper - Analyze your AWS en (Python)
15. ConsoleMe - A Central Control Plane for AWS Permissions and Access
16. AWS Firewall Factory - Deploy, update, and stage your WAFs while managing them centrally via FMS.
17. AWS Pentesting/Red Team Methodology - by hacktricks - A Collection for AWS en penetration testing methodology.
18. AWS Pentesting/Red Team Methodology - by hackingthe.cloud - A collection of attacks/tactics/techniques that can use by offensi professionals during cloud exploitation.
19. CloudFox - Automating situational awareness for cloud penetration tests
20. aws-lint-iam-policies - Tool to find problems in identity-based and resource-based IAM policies
21. IAM Activity Tracker - Ser AWS solution for tracking IAM, STS, and Console sign-in acti across all regions using E and CloudTrail
22. s3dns - Passi discovery of S3 (and other cloud) buckets by resolving CNAMEs and IPs during recon—ideal for stealthy and early identification of cloud storage exposures
22. Nubicustos - Orchestrates 20+ security tools (Prowler, ScoutSuite, Checko, Pacu, etc.) with unified findings, attack paths, and compliance
23. CloudSecure - Open-source AWS security assessment platform with AI-powered analysis, Prowler integration, and automated CIS benchmark scanning. Built ser with CDK, Lambda, and Step Functions
23. cloud-audit - Open-source AWS security scanner that detects attack chains and generates remediation code. 80+ checks, CIS/SOC 2 compliance.
24. boto3-refresh-session - A simple Python package for refreshing AWS temporary credentials in boto3 automatically. Supports MFA, IoT, and custom auth flows.
25. Cynative - Open-source framework for security agents with li access to your infrastructure (connects to AWS, GCP, Azure, self-managed Kubernetes, GitHub and GitLab).

Security Practices and CTFs

1. AWS Well Architected Security Labs
2. Flaws to learn common mistakes in AWS through challenge
3. Flaws2 focuses on AWS security concepts through challenge levels
4. CloudGoat By Rhino Security Labs - by Design AWS infrastructure setup tool
5. OWASP Ser - OWASP Ser is a deliberately insecure realistic AWS Lambda ser application maintained by OWASP for educational purposes.
6. OWASP WrongSecrets - OWASP WrongSecrets is a app which shows you how to not store secrets. It covers code, Docker, Kubernetes, and AWS cloud bad practices.
7. AWS S3 CTF Challenges with solutions
8. AWS CTF with practical scenario
9. Breaking and Pwning Apps and Servers on AWS and Azure by AppSecCo - The training covers a multitude of scenarios taken from our assessment, penetration testing and OSINT engagements which take the student through the journey of discovery, identification and exploitation of security weaknesses, misconfigurations and poor programming practices that can lead to complete compromise of the cloud infrastructure.
10. AWS Workshop official - This is not exactly security part, but would be helpful to understand AWS with this workshop examples.
11. AWS Security Workshops by AWS
12. ThreatModel for Amazon S3 - Library of all the attack scenarios on Amazon S3 and how to mitigate them, following a risk-based approach
13. AWS Cloud Quest: Security Role
14. AWS Jam Journey: Security
15. TryHackMe: Attacking and Defending AWS
16. Free AWS Security Labs
17. Black Sky Cloud Labs from HTB
18. CloudFoxable - Create your own by design AWS penetration testing playground
19. RansomLeak Cloud Security Training - Free browser-based labs on public S3 buckets, o IAM, long-li keys, instance metadata abuse, and pri containers

AWS Security Bulletin Important Issues

1. [Container Networking Security Issue ([C])]() (This issue may allow containers running on the same host, or adjacent hosts (hosts running in the same LAN or layer 2 domain), to reach TCP and UDP services bound to localhost (127.0.0.1))
2. Minimum of TLS 1.2 Required for FIPS Endpoints by March 31, 2021
3. Unencrypted md5 plaintext hash in metadata in AWS S3 Crypto SDK for golang
4. CBC padding oracle issue in AWS S3 Crypto SDK for golang : C
5. In-band key negotiation issue in AWS S3 Crypto SDK for golang : C
6. C: An Amazon Web Services (AWS) de who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.
7. How a Security Researcher found 1000s of open databases on AWS

AWS Security Breaches

1. AWS Security breaches - 2017
2. 200 million data leak - A lesson in AWS Security
3. Imper data breach on Stolen AWS API keys
4. Tesla's Amazon cloud account was hacked and used to mine cryptocurrency
5. 10 worst Amazon S3 breaches
6. Lion Air the Latest to Get Tripped Up by Misconfigured AWS S3
7. Online Fashion App 21 buttons Exposes Financial Records of Top European Influencers due to S3 misconfiguration
8. Capital One Cloud data breach due to S3 misconfiguration
9. Online Fashion App 21 buttons Exposes Financial Records of Top European Influencers
10. Utah CO testing service exposes 50,000 patients’ photo IDs, personal info on the web
11. US municipalities suffer data breach due to misconfigured Amazon S3 buckets

AWS Infra-le issues

1. Spectre and Meltdown (2018)

Impact: Affected nearly all modern CPUs (Intel, AMD, and ARM), allowing unauthorized access to sensitive data across processes, including breaking isolation between machines in cloud en.

Type: Side-channel attacks exploiting speculati.

AWS Mitigation: AWS deployed software patches (KPTI, Retpoline, etc.) and hardware microcode updates while ensuring minimal performance degradation.

2. Zenbleed (2023)

Impact: Affected AMD Zen 2 processors, leaking sensitive data like encryption keys and passwords from CPU registers at high speeds.

Type: Register file leak (caused by speculati failure).

AWS Mitigation: AWS patched affected EC2 instances through microcode updates and software mitigations.

AWS Security Podcast/Newsletter

1. Cloud Security Podcast - YouTube - Weekly Interviews with Cloud Security Professionals on AWS, Azure, GCP Security for Blue Teams & Red Teams
2. Cloud Security Newsletter - Weekly Cloud Security Nuggets in your inbox

Contributors

Please refer the guidelines at contribute.md for details.

Thanks to the following folks who made contributions to this project.

Get your name listed here

List of Contributors

项目信息

开发语言：未知

Star 数：1604

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Curated list of links, references, books videos, tutorials (Free or Paid), Exploit, CTFs, Hacking Practices etc. which are related to AWS Security展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。