Awesome AWS Security

A standard curated list of links, references, books, videos, and tutorials (Free or Paid), Exploit, CTFs, Hacking Practices, etc., are related to AWS Security. List inspired by the awesome list thing.

Table of Contents

1. AWS Whitepapers
2. Books
3. Videos
4. Online Tutorials/Blogs/Presentations
5. Online Courses (Paid/Free)
6. Tools of Trade
7. Security Practice and CTFs
8. AWS Security Bulleting Important Issues
9. AWS Security Breaches
10. Contributors

[!NOTE] You can follow the below github repo as well to excel in Cloud Security

1. Awesome Cloud Security Learning Resources
2. AWS Security Study Plan
3. AWS Security Interview Quesitons
4. Cloud Security Roadmap
5. Cloud Security Slides Primer

AWS Whitepapers

AWS has awesome lists of whitepapers related to AWS Security. We are adding few important one here. You can anytime check more for updated or new security whitepapers here

And don't forget to bookmark AWS Security bulletin for new vulnerabilities news from here

1. AWS Overview - One of the important whitepaper to understand an overview of AWS
2. Introduction to AWS Security Whitepaper
3. AWS Well-Architected Security Pillar
4. Introduction to Security By Design
5. AWS Well Architected Framework
6. AWS Risk And Compliance Whitepaper
7. AWS Security Checklist
8. AWS HIPAA Compliance Whitepaper
9. AWS Cloud Adoption Framework
10. AWS Auditing Security Checklist
11. AWS CIS Foundation benchmark
12. AWS Security Incident Response
13. Overview of AWS Lambda Security
14. AWS KMS Best Practices
15. Encrypting File Data with Amazon Elastic File System
16. Security of AWS CloudHSM backups

Books

1. Hands-On AWS Penetration Testing with Kali Linux by PackT
2. Mastering AWS Security by PackT
3. Security Best Practices on AWS by PackT
4. Cloud Security Automation
5. AWS Automation Cookbook
6. AWS Lambda Security Best Practices - pdf - It's published by Puresec and it has a good overview on AWS Lambda Security Best Practices which we should follow
7. AWS Security by Manning - Very nice book in Progress, yet to release.
8. Securing DevOps - A book which has real-world examples for Cloud Security. Must read book for any Cloud Security Professionals.
9. Serverless Security - An Apress book that discusses serverless security on AWS, Azure and Google Cloud.
10. AWS Security Cookbook
11. Practical Guide to Security in the AWS Cloud by SANS and sponsored by AWS Marketplace - pdf
12. CSA Guide to Cloud Computing by Sungress
13. Practical Cloud Security by O'reilly
14. Effective IAM for AWS
15. Amazon Bedrock in Action

Videos

1. The fundamentals of AWS Security - Youtube
2. AWS Security by Design - Youtube
3. Account Security with IAM - Youtube
4. AWS re:Inforce 2019 Security Best Practices - Youtube
5. AWS Cloud Security Playlist - Youtube
6. A cloud security architecture workshop by RSA - Youtube
7. AWS Cloud Security - Oreilly
8. Introduction to AWS Security Hub - Youtube
9. Solution for flaws.cloud AWS Security Challenge - Youtube Playlist
10. AWS Security Best Practice: Well-Architected way - Youtube
11. Hands-On With AWS Security Best Practices
12. AWS re:Invent 2020: Security at scale: How Goldman Sachs manages network and access control

Online Tutorials/Blogs/Presentations

1. AWS Security official blog
2. AWS in Plain English
3. Why the CIA trusts AWS
4. Fundamentals of AWS Security - Presentation from AWS
5. AWS Security primer - Nice overview and quick run through AWS Security resources.
6. AWS Security Blog
7. How a whitehat hacker earned $1500 in 15 minutes due to AWS S3 misconfiguration - It was fun going through the blog. You can learn from this article too.
8. A deep dive into AWS S3 access control - It will give a very good grip on how S3 buckets can be exploited. Lengthy but worth to go through.
9. How Federico hacked a whole EC2 network during a penetration test
10. A short blog on hacking AWS - Examples are based on cloudgoat.
11. S3 security is flawed by design - This article will show you why you need to be extra careful when using AWS S3.
12. 51 Tips for Security AWS(pdf) - McAfee
13. The role of API gateways in API security
14. Finding SSRF via HTML Injection inside a PDF file on AWS EC2
15. Getting shell and data access in AWS by chaining vulnerabilities