Awesome Cloud Security

Cloud Security blogs, podcasts, standards, projects, and examples.

Contents

• Public Cloud Governance
  • AWS Governance
  • MultiCloud Governance
  • AWS - Patterns
  • URL Services
• Containers
  • Docker Images
  • Kubernetes Operators
  • Container Tools
• Cloud Security Standards
• Learning
  • Blogs
  • Courses
  • Labs
  • Podcasts
  • Vulnerable by Design
• Certifications
• Projects
  • Alerting
  • Benchmarking
  • Data Loss Prevention
  • Identity and Access Management
  • Incident Response
  • Spring
• Examples
  • Automated Security Assessment
  • Identity and Access Management
  • Logging
• Misc
  • Other Awesome Lists
• Contribute
• License

Public Cloud Governance

AWS Governance

• AWS CloudFormation Guard

• AWS CodePipeline Governance

• AWS Config Rules Development Kit

• AWS Control Tower Customizations

• AWS Security Hub Automated Response and Remediation

• AWS Vault

• AWS Well Architected Labs

• AWS - Patterns

URL Services

Service	URL
s3	https://{user_provided}.s3.amazonaws.com
cloudfront	https://{random_id}.cloudfront.net
ec2	ec2-{ip-seperated}.compute-1.amazonaws.com
es	https://{user_provided}-{random_id}.{region}.es.amazonaws.com
elb	http://{user_provided}-{random_id}.{region}.elb.amazonaws.com:80/443
elbv2	https://{user_provided}-{random_id}.{region}.elb.amazonaws.com
rds	mysql://{user_provided}.{random_id}.{region}.rds.amazonaws.com:3306
rds	postgres://{user_provided}.{random_id}.{region}.rds.amazonaws.com:5432
route 53	{user_provided}
execute-api	https://{random_id}.execute-api.{region}.amazonaws.com/{user_provided}
cloudsearch	https://doc-{user_provided}-{random_id}.{region}.cloudsearch.amazonaws.com
transfer	sftp://s-{random_id}.server.transfer.{region}.amazonaws.com
iot	mqtt://{random_id}.iot.{region}.amazonaws.com:8883
iot	https://{random_id}.iot.{region}.amazonaws.com:8443
iot	https://{random_id}.iot.{region}.amazonaws.com:443
mq	https://b-{random_id}-{1,2}.mq.{region}.amazonaws.com:8162
mq	ssl://b-{random_id}-{1,2}.mq.{region}.amazonaws.com:61617
kafka	b-{1,2,3,4}.{user_provided}.{random_id}.c{1,2}.kafka.{region}.amazonaws.com
kafka	{user_provided}.{random_id}.c{1,2}.kafka.useast-1.amazonaws.com
cloud9	https://{random_id}.vfs.cloud9.{region}.amazonaws.com
mediastore	https://{random_id}.data.mediastore.{region}.amazonaws.com
kinesisvideo	https://{random_id}.kinesisvideo.{region}.amazonaws.com
mediaconvert	https://{random_id}.mediaconvert.{region}.amazonaws.com
mediapackage

MultiCloud Governance

• Cloud Custodian
• CloudQuary
• Cloudsploit
• ManageIQ by RedHat
• Mist.io
• NeuVector
• Triton by Joyent

Kubernetes Operators

• Aqua
  • Aqua Security Operator
  • Starboard Operator
• Misc
  • Anchore - Anchore Engine Operator
  • Falco Security - Falco Operator
  • Quay - Project Quay Container Security
  • Snyk - Snyk Operator
  • Splunk - Splunk Operator for Kubernetes
  • Sysdig - Sysdig Agent Operator

Container Tools

• Anchore
  • Anchore Engine
  • Grype
  • Kai
  • Syft
• Aqua
  • Cloudsploit
  • Kube-Bench
  • Kube-Hunter
  • Kubectl-who-can
  • Trivy
• Misc
  • Docker - Docker Bench for Security
  • Elias - Dagda
  • Falco Security - Falco
  • Harbor - Harbor
  • Quay - Clair
  • Snyk - Snyk
  • vchinnipilli - Kubestriker

Cloud Security Standards

• ISO/IEC 27017:2015
• ISO/IEC 27018:2019
• MTCS SS 584
• CCM
• NIST 800-53

Learning

Blogs

• AWS Security
• Azure Security
• Dark Reading

Courses

• Oracle
  • Oracle Cloud Security Administrator
• A Cloud Guru
  • Learning Paths
    • AWS Security Path
    • Azure Security Path
    • GCP Security Path

Labs

• AWS Workshops
  • AWS Identity: Using Amazon Cognito for serverless consumer apps
  • AWS Network Firewall Workshop
  • AWS Networking Workshop
  • Access Delegation
  • Amazon VPC Endpoint Workshop
  • Build a Vulnerability Management Program Using AWS for AWS
  • Data Discovery and Classification with Amazon Macie
  • Data Protection
  • DevSecOps - Integrating security into your pipeline
  • Disaster Recovery on AWS
  • Finding and addressing Network Misconfigurations on AWS
  • Firewall Manager Service - WAF Policy
  • Getting Hands on with Amazon GuardDuty
  • Hands on Network Firewall Workshop
  • Implementing DDoS Resiliency
  • Infrastructure Identity on AWS
  • Integrating security into your container pipeline
  • Integration, Prioritization, and Response with AWS Security Hub

Podcasts

• Azure DevOps Podcast
• Cloud Security Podcast by Google
• Security Now

Vulnerable By Design

• CloudGoat by Rhino Security Labs
• ServerlessGoat by OWASP
• WrongSecrets by OWASP

Certifications

• Cloud Vendors
  • AWS Certified Security Specialty
  • Azure Security Engineer Associate
  • Google Professional Cloud Security Engineer
  • Oracle Cloud Platform Identity and Security Management
• ISC2 - International Information System Security Certification Consortium
  • CCSP - Certified Cloud Security Professional
• CSA - Cloud Security Alliance
  • CCSK - Certificate of Cloud Security Knowledge
  • CCAK - Certificate of Cloud Auditing Knowledge

Projects

Alerting

• 411 by Etsy
• ElastAlert by Yelp
• StreamAlert by Airbnb

Automated Security Assessment

• Prowler
• CloudFox
• SkyArk
• [Pacu](https://github.com/RhinoSecurityLabs