Cloud Security Tools

Awesome cloud enumerator

Azure AppHunter is an open-source tool created for security researchers, red teamers and defenders to help them identify excessive privileges assigned to Service Principals

A vault for securely storing and accessing AWS credentials in development environments

A 'find' for S3 public buckets

Script to spider a website and find publicly open S3 buckets

Independently deploy customized honeyservices in AWS to trigger alerts on unauthorized access. It utilizes a dedicated CloudTrail for precise detection and notification specifically for honeyservices activity.

An evolving repository of CloudTrail events with detailed descriptions, MITRE ATT&CK insights, real-world incidents, references and security implications

StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.

A simple library to generate IAM policy statements with no need to remember all the actions APIs

Visualize your aws security groups.

Enumerate the permissions associated with AWS credential set

Tools for fingerprinting and exploiting Amazon cloud infrastructures

find dangling domains in a multi cloud environment

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

SCP management tool

Fetch all public IP addresses tied to your AWS account. Works with IPv4/IPv6, Classic/VPC networking, and across all AWS services

Brute-forces objects within a given bucket using Hashcat mask-like syntax

Guard offers a policy-as-code domain-specific language (DSL) to write rules and validate JSON- and YAML-formatted data such as CloudFormation Templates, K8s configurations, and Terraform JSON plans/configurations against those rules. Take this survey to provide feedback about cfn-guard: https://amazonmr.au1.qualtrics.com/jfe/form/SV_bpyzpfoYGGuuUl0

ASH is an extensible, open source SAST, SCA, and IaC security scanner orchestration engine.

The AWS Workload Credentials Provider (formerly the AWS Secrets Manager Agent) is a client-side solution that helps you standardize how you consume credentials from AWS services across your compute environments.

This repository can be used to generate and evaluate findings detected by Amazon GuardDuty

A command line interface for Amazon EBS snapshots

A simple threat modeling tool to help humans to reduce time-to-value when threat modeling

📦 Produce secure packages and containers with declarative configurations

Azure Red Team tool for graphing Azure and Azure Active Directory objects

BlackCat is a PowerShell module designed to validate the security of Microsoft Azure. It provides a set of functions to identify potential security holes.

A tool to show what AWS account and identity you're using.

Automating situational awareness for cloud penetration tests.

Search exposed EBS volumes for secrets

poutine, a supply chain vulnerability scanner for build pipelines

AWS S3 Bucket/Object Finder

Least privilege AWS IAM Terraformer

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

Extensible auto-tagger for your IaC files. The ultimate way to link entities in the cloud back to the codified resource which created it.

A mostly-serverless distributed hash cracking platform

Official upstream for the cloud-init: cloud instance initialization

WeirdAAL (AWS Attack Library)

Map visualization and firewall for AWS activity, inspired by Little Snitch for macOS.

Okta Verify and Okta FastPass Abuse Tool

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

aws-security-architecture

Expand IAM Actions with Wildcards

Google Maps for AWS IAM

An IAM Simulator that outputs detailed explains of how a request was evaluated.

Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources

Data pipelines for cloud config and security data. Build cloud asset inventory, CSPM, FinOps, and vulnerability management solutions. Extract from AWS, Azure, GCP, and 70+ cloud and SaaS sources.

Cloud Security Posture Management (CSPM)

Terraform templates for CI/CD to Cloud federation and Cloud2Cloud IAM federations

The easiest way to access AWS.

Kubernetes Security Training Platform - focusing on security mitigation

FestIn - Open S3 Bucket Scanner

SkyArk helps to discover, assess and secure the most privileged entities in Azure and AWS

SkyWrapper helps to discover suspicious creation forms and uses of temporary tokens in AWS

Reads from existing public and private cloud providers (reverse Terraform) and generates your infrastructure as code on Terraform configuration

A collection of AWS penetration testing junk

Protect your data in AWS S3 with DataCop!

Generate datasets of cloud audit logs for common attacks

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages

:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud

Open Source Cloud Native Application Protection Platform (CNAPP)

AWS Auditing & Hardening Tool

AWS IAM Username Enumerator and Password Spraying Tool in Python3

A simple file-based scanner to look for potential AWS access and secret keys in files

Protect against subdomain takeover

Dow Jones Hammer : Protect the cloud with the power of the cloud(AWS)

CloudMapper helps you analyze your Amazon Web Services (AWS) environments.

CloudTracker helps you find over-privileged IAM users and roles by comparing CloudTrail logs with current IAM policies.

AWS IAM linting library

Find, verify, and analyze leaked credentials

Validate the isolation posture of your container environment.

a lightweight, security focused, BDD test framework against terraform.

Remove all the resources from an AWS account

Red Team Scripts for AWS.

Varna: Quick & Cheap AWS CloudTrail Monitoring with Event Query Language (EQL)

Simplified CloudTrail analysis for AI agents

Access Undenied parses AWS AccessDenied CloudTrail events, explains the reasons for them, and offers actionable remediation steps. Open-sourced by Ermetic.

Find interesting Amazon S3 Buckets by watching certificate transparency logs.

A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID

The TTPForge is a Cybersecurity Framework for developing, automating, and executing attacker Tactics, Techniques, and Procedures (TTPs).

Cloud Native Runtime Security

Amazon bucket brute force tool

A command-line tool to get valuable information out of AWS CloudTrail

Finders Keypers: AWS KMS Encryption Key Usage and Blast Radius Finder

YES3 Scanner: S3 Security Scanner for Access and Ransomware Protection

A graph-based tool for visualizing effective access and resource relationships in AWS environments.

Automated Attack Simulation in the Cloud, complete with detection use cases.

MetaHub is an automated contextual security findings enrichment and impact evaluation tool for vulnerability management.

TagNabIt is a tool built to enumerate Cloud Resources using tags

AHHHZURE is an automated deployment script that creates a vulnerable Azure cloud lab for offensive security practitioners and enthusiasts to brush up their cloud sec skills.

rpCheckup is an AWS resource policy security checkup tool that identifies public, external account access, intra-org account access, and private resources.

A transparent, highly scalable and cryptographically verifiable data store.

A tool for cleaning up your cloud accounts by nuking (deleting) all resources within it

Find AWS S3 buckets and test their permissions.

A PoC to Simulate Ransomware Attack on AWS Environment

Automate Checkmarx Scanning and Onboarding Plus AWS Access

AWS Attack Path Management Tool - Walking on the Moon

Generate an IAM policy from AWS, Azure, or Google Cloud (GCP) calls using client-side monitoring (CSM) or embedded proxy

A little tool to play with Azure Identity - Azure and Entra ID lab creation tool. Blog: https://medium.com/@iknowjason/sentinel-for-purple-teaming-183b7df7a2f4

Terraform module for AWS Secrets Manager secrets with owner/writer/reader IAM roles, automatic rotation support, and cross-account access policies.

Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.

Python script for AWS resources inventory (cheaper than AWS Config)

Proof of Value Terraform Scripts to utilize Amazon Web Services (AWS) Security, Identity & Compliance Services to Support your AWS Account Security Posture.

ElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting 100s of services and evaluations to harden your CSP & SaaS environments with controls mapped to over 20 industry, regulatory, and best practice controls frameworks

SyntheticSun is a defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to continuously prevent, detect and respond to threats.

Security Tool to Look For Interesting Files in S3 Buckets

Repository to archive GCP Documentation for local use

S3Insights is a platform for efficiently deriving security insights about S3 data through metadata analysis

A UNIX security auditing tool based on several security frameworks

prel(iminary) is an application that temporarily assigns Google Cloud IAM Roles and includes an approval process.

Casting light on shadow cloud deployments. Detect exposure of resources deployed in AWS or GCP.

Cartography is a Python tool that pulls infrastructure assets and their relationships into a Neo4j graph database.

Maester is a test automation framework to help you stay in control of your Microsoft security configuration.

Safer AWS SCP deployments via real-time monitoring

Recon tool to query cloud prefixes for services associated with an IP address

Template Go app repo with local test/lint/build/vulnerability check workflow, and on tag image test/build/release pipelines, with ko generative SBOM, cosign attestation, and SLSA build provenance

A GitHub Actions Supply Chain CTF / Goat

A tool for identifying misconfigured CloudFront domains

Open-source cloud-environment inspector. Supporting AWS, GCP, Azure, and more! Your cloud resources will have nowhere to hide!

Unit testing framework for test driven security of AWS, GCP, Heroku and more.

A python module for orchestrating content acquisitions and analysis via amazon ssm.

A small set of scripts to summarize AWS Security Groups, and generate visualizations of the rules.

Discover resources created in an AWS account.

A tool for quickly evaluating IAM permissions in AWS.

Whitebox evaluation of effective S3 object permissions, to identify publicly accessible files.

Multi-Cloud Security Auditing Tool

A Red Team Activity Hub

Example detection of compromise credentials in AWS

AWS Least Privilege for Distributed, High-Velocity Deployment

Pentesting framework for GCP & Google Workspace that enumerates/downloads data that feeds into a BloodHound Opengraph model. Includes credential management, workspace management, exploit scripts, etc.

A flexible threat detection platform that simplifies rule management and deployment using K8s CronJob and Helm, but can also run standalone or with other job schedulers like Nomad.

Terraform module to set up your AWS account with the secure baseline configuration based on CIS Amazon Web Services Foundations and AWS Foundational Security Best Practices.

A GitHub App that acts like a Security Token Service (STS) for the Github API

Did you contain the compromised identity? notyet

Minimal Rogue OpenID Connect (OIDC) Provider implementation in Python for AWS role assumption using OIDC authentication.

This GitHub Action sends a reverse shell from a runner via Azure Storage Account blobs

curl-like access to AWS resources with AWS Signature Version 4 request signing.

📚 The OPA Gatekeeper policy library

A Cloud Security Posture Manager or CSPM with a focus on security analysis for the modern cloud stack and a focus on the emerging threat landscape such as cloud ransomware and supply chain attacks.

Test & Compare different Kubernetes security offerings on EKS, GKE and AKS

A Golang program to rotate AWS & GCP account keys

A simple script which implements different Cognito attacks such as Account Oracle or Priviledge Escalation

Slack enumeration and exposed secrets detection tool

Azure Activity Log Axe is a continually developing tool that simplifies the transactional log format provided by Microsoft. The tool leverages the "Axe Key," a method created by Nathan Eades of the Permiso P0 Labs team. The Axe Key provides a more consistent grouping of the transactional events of an operation than the traditional built-in Ids.

Released at Black Hat Asia on April 18, 2024, Cloud Console Cartographer is a framework for condensing groupings of cloud events (e.g. CloudTrail logs) and mapping them to the original user input actions in the management console UI for simplified analysis and explainability.

CloudGrappler is a purpose-built tool designed for effortless querying of high-fidelity and single-event detections related to well-known threat actors in popular cloud environments such as AWS and Azure.

Go library for mapping IP address ranges to cloud provider regions (currently: AWS and GCP)

Open-source cloud security reconnaissance framework

Route53/CloudFront Vulnerability Assessment Utility

Scripts for managing your Security Hub across an organization

IAMFinder enumerates and finds users and IAM roles in a target AWS account.

A utility to detect various technology for a given IP address.

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

Cross cloud workload identity research and workshops

Serverless Functions for establishing Reverse Shells to Lambda, Azure Functions, and Google Cloud Functions

Lambda-Proxy creates an HTTP proxy listening on localhost port 8082. When it receives an HTTP POST request with a very specific structure , it will parse the request, extract the relevant data required for the test, and will invoke your AWS Lambda function using the AWS SDK client.invoke() method. It was created for testing AWS Lambda functions with SQLMap as described here: https://www.puresec.io/blog/automated-sql-injection-testing-of-serverless-functions-on-a-shoestring-budget-and-some-good-music

Serverless plugin for least privileges.

Cloud Container Attack Tool (CCAT) is a tool for testing security of container environments.

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

This tool analyzes a given Gitlab repository and searches for dangling or force-pushed commits containing potential secret or interesting information.

A GitHub Action that adds opinionated comments to a PR from Terraform fmt/init/plan output

The Finch CLI is an open source client for container development

Automatically compile an AWS Service Control Policy that ONLY allows AWS services that are compliant with your preferred compliance frameworks.

Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.

IAM Least Privilege Policy Generator

A simple CLI utility that makes it easier to switch between different AWS roles

Add a layer of active defense to your cloud applications.

A tool for scanning public or private AMIs for sensitive files and secrets. The tool follows the research made on AWS CloudQuarry where we scanned 20k+ public AMIs.

EC2StepShell is an AWS post-exploitation tool for getting high privileges reverse shells in public or private EC2 instances.

Resources for AWS post-exploitation scenarios where you have the permission ssm:SendCommand, but you can't use the AWS-RunPowerShellScript or AWS-RunShellScript documents.

Cloud Commotion intends to cause chaos to simulate security incidents

Remove EXIF data from all objects in an S3 bucket

The original AWS security enforcer™

The AWS Enumerator was created for service enumeration and info dumping for investigations of penetration testers during Black-Box testing. The tool is intended to speed up the process of Cloud review in case the security researcher compromised AWS Account Credentials.

Examples of various Entra ID scenarios in Terraform

Collection of Docker honeypot logs from 2021 - 2024

Library and CLI tool for analysing CloudFormation templates and check them for security compliance.

A PowerShell script that automates the security assessment of Microsoft 365 environments.

A series of PowerShell scripts to automate the assessment of Azure IaaS security

A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk

Creates needed resources for federating access between a GCP service account and AWS IAM role.

kpexec is a kubernetes cli that runs commands in a container with high privileges.

This tool implements a cloud version of the Shadow Copy attack against domain controllers running in AWS using only the EC2:CreateSnapshot permission.

Linting tool for CloudFormation templates

AWS honey token manager

CLI to prevent malicious Terraform Providers from being executed. You can define the allow list of Terraform Providers and their versions, and check if disallowed providers aren't used

A powerful tool for using AWS Identity Center for the CLI and web console.

Enumerate Microsoft Entra ID (Azure AD) fast

Documenting your Threat Models with HCL

Python installable command line utiltity for mitigation of host and key compromises.

Proof of Concept Zappa Based AWS Persistence and Attack Platform

PacBot (Policy as Code Bot)

Zero-ETL, infinite possibilities. Live query APIs, code & more with SQL. No DB required.

AWS Inventory and Compliance Framework

AWS S3 Sensitive Data Search

AWS IAM policy statement generator with fluent interface

This repo contains IOC, malware and malware analysis associated with Public cloud

DeRF (Detection Replay Framework) is an "Attacks As A Service" framework, allowing the emulation of offensive techniques and generation of repeatable detection samples in the cloud. Built on Google Workflows

Halberd : Multi-Cloud Agentic Attack Tool

AWS Extender CLI is a command-line script to test S3 buckets as well as Google Storage buckets and Azure Storage containers for common misconfiguration issues using the boto/boto3 SDK library.

barq: The AWS Cloud Post Exploitation framework!

Runs IAM policy linting and security checks against either a single AWS account or multiple member accounts of an AWS Organization.

Uses the AWS Cloud Control API to list resources that are present in a given AWS account and region(s). Discovered resources are written to a JSON result file.

Collection of example Service Control Policies (SCPs) that are useful for sandbox and training AWS accounts.

Analyzes CloudTrail data of a given AWS account and generates a summary of recently active IAM principals, API calls they made, as well as regions, IP addresses and user agents they used.

Tool to spray AWS Console IAM Logins

Gather metadata about your S3 buckets

Utilities and tools based around Amazon S3 to provide convenience APIs in a CLI

To clean up your AWS AMIs: First, include AMIs by name or tag. Second, exclude AMIs in use, younger than N days, or the newest N images. Third, manually confirm the list of AMIs for deletion.

Blazing CloudTrail since 2018

Ansible/Vagrant/Packer files to create a virtual machine with the tooling needed to perform cloud security assessments

Better AWS SSM Session manager CLI client

Github action for linting AWS IAM policy documents

Scalable integrity framework for ABAC on AWS

An enterprise friendly way of detecting and preventing secrets in code.

AWS Security Tools (AST) in a simple Docker container. :package:

Trustline: Check external access on your AWS account

Find secrets with Gitleaks 🔑