Skip to content

Instantly share code, notes, and snippets.

@markofu

markofu/Security_Tools_for_AWS.MD

Last active October 2, 2023 15:30
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save markofu/549fbd287edf08c38e869dacc740e49d to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save markofu/549fbd287edf08c38e869dacc740e49d to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. markofu revised this gist May 3, 2021. 1 changed file with 4 additions and 0 deletions.
    4 changes: 4 additions & 0 deletions Security_Tools_for_AWS.MD
    View file
    Original file line number Diff line number Diff line change
    @@ -59,6 +59,10 @@ Finding interesting S3 buckets through monitoring certificate transparency logs

    - [Bucket Stream](https://github.com/eth0izzle/bucket-stream)

    Exif Cleaner

    - [S3 Exif Cleaner](https://github.com/seisvelas/S3-Exif-Cleaner)

    ### Secrets

    Secret Keeper
  2. markofu revised this gist Mar 8, 2020. 1 changed file with 5 additions and 4 deletions.
    9 changes: 5 additions & 4 deletions Security_Tools_for_AWS.MD
    View file
    Original file line number Diff line number Diff line change
    @@ -15,18 +15,19 @@ Tools to help you _auth_ (clients) securely in AWS.
    - [Metadataproxy](https://github.com/lyft/metadataproxy)
    - [Bless - Lyft](https://github.com/lyft/bless)
    - [Bless - Netflix](https://github.com/Netflix/bless)
    - [Key Conjurer - Riot Games](https://github.com/RiotGames/key-conjurer)

    ### Best Practices & Governance

    Tools that enable you to ensure security best practices are followed across your organisation and infrastructure.

    - [Prowler](https://github.com/Alfresco/prowler)
    - [Cloud Custodian](https://github.com/capitalone/cloud-custodian)
    - [Cloud Inquisitor](https://github.com/RiotGames/cloud-inquisitor)
    - [Cloud Custodian - Capital One](https://github.com/capitalone/cloud-custodian)
    - [Cloud Inquisitor - Riot Games](https://github.com/RiotGames/cloud-inquisitor)

    ### Domain Hijacking

    - [Cloud Inquisitor](https://github.com/RiotGames/cloud-inquisitor)
    - [Cloud Inquisitor - Riot Games](https://github.com/RiotGames/cloud-inquisitor)

    ### DFIR

    @@ -48,7 +49,7 @@ AWS Least Privilege for Distributed, High-Velocity Deployment
    Tools that provide a good way monitoring your overall security posture through scraping configuration and collating it or ingesting logs.

    - [Security Monkey](https://github.com/Netflix/security_monkey)
    - [Scout](https://github.com/nccgroup/Scout2)
    - [ScoutSuite](https://github.com/nccgroup/ScoutSuite)
    - [CloudSploit](https://github.com/cloudsploit/scans)
    - [StreamAlert](https://github.com/airbnb/streamalert)

  3. markofu revised this gist Mar 8, 2020. 1 changed file with 6 additions and 0 deletions.
    6 changes: 6 additions & 0 deletions Security_Tools_for_AWS.MD
    View file
    Original file line number Diff line number Diff line change
    @@ -64,6 +64,12 @@ Secret Keeper

    - [Confidant](https://github.com/lyft/confidant)

    ## Terraform

    Checkov is a static code analysis tool for infrastructure-as-code. It scans cloud infrastructure provisioned using Terraform and detects security and compliance misconfigurations.

    - [Checkov](https://github.com/bridgecrewio/checkov)

    ## AWS

    This section focuses on tools and services provided by AWS for a nominal charge or as part of their overall service.
  4. markofu revised this gist Jun 27, 2018. 1 changed file with 36 additions and 0 deletions.
    36 changes: 36 additions & 0 deletions Security_Tools_for_AWS.MD
    View file
    Original file line number Diff line number Diff line change
    @@ -6,14 +6,20 @@ This list is not intended be something completely exhaustive, more so provide a

    ## Open Source

    This section focuses on tools and services provided by the community and released as open-source.

    ### Auth

    Tools to help you _auth_ (clients) securely in AWS.

    - [Metadataproxy](https://github.com/lyft/metadataproxy)
    - [Bless - Lyft](https://github.com/lyft/bless)
    - [Bless - Netflix](https://github.com/Netflix/bless)

    ### Best Practices & Governance

    Tools that enable you to ensure security best practices are followed across your organisation and infrastructure.

    - [Prowler](https://github.com/Alfresco/prowler)
    - [Cloud Custodian](https://github.com/capitalone/cloud-custodian)
    - [Cloud Inquisitor](https://github.com/RiotGames/cloud-inquisitor)
    @@ -24,37 +30,67 @@ This list is not intended be something completely exhaustive, more so provide a

    ### DFIR

    Tools to help perform Incident Response on AWS

    - [Diffy](https://github.com/Netflix-Skunkworks/diffy)
    - [BinaryAlert](https://github.com/airbnb/binaryalert)

    ### Least Privileges

    AWS Least Privilege for Distributed, High-Velocity Deployment

    - [RepoKid](https://github.com/Netflix/repokid)

    ### Monitoring / Auditing

    #### Holistic // General

    Tools that provide a good way monitoring your overall security posture through scraping configuration and collating it or ingesting logs.

    - [Security Monkey](https://github.com/Netflix/security_monkey)
    - [Scout](https://github.com/nccgroup/Scout2)
    - [CloudSploit](https://github.com/cloudsploit/scans)
    - [StreamAlert](https://github.com/airbnb/streamalert)

    #### S3

    Finding interesting S3 buckets through monitoring certificate transparency logs

    - [Bucket Stream](https://github.com/eth0izzle/bucket-stream)

    ### Secrets

    Secret Keeper

    - [Confidant](https://github.com/lyft/confidant)

    ## AWS

    This section focuses on tools and services provided by AWS for a nominal charge or as part of their overall service.

    ### Auth

    Services that provide authentication and authorisation to AWS services, with STS enabling that access to be through temporary credentials.

    - [IAM](https://aws.amazon.com/iam/)
    - [STS](https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html)

    ### Best Practices & Governance

    Service that helps your monitor your AWS services holistically to reduce cost, ensure best practices are being followed and improve security.

    - [AWS Trusted Advisor](https://console.aws.amazon.com/trustedadvisor/)

    ### Monitoring / Auditing

    AWS service that enable your to audit and monitor your configurations and API calls.

    - [CloudTrail](https://aws.amazon.com/cloudtrail/)
    - [AWS Config](https://aws.amazon.com/config/)


    ### Network Perimeter Visibility

    AWS Service that is essentially a managed threat detection service that continuously monitors for malicious behaviour to help you protect your AWS accounts and workloads. One of the few things to provide visibility of your external perimeter in AWS.

    - [GuardDuty](https://aws.amazon.com/guardduty/)
  5. markofu revised this gist Jun 18, 2018. 1 changed file with 5 additions and 11 deletions.
    16 changes: 5 additions & 11 deletions Security_Tools_for_AWS.MD
    View file
    Original file line number Diff line number Diff line change
    @@ -9,6 +9,8 @@ This list is not intended be something completely exhaustive, more so provide a
    ### Auth

    - [Metadataproxy](https://github.com/lyft/metadataproxy)
    - [Bless - Lyft](https://github.com/lyft/bless)
    - [Bless - Netflix](https://github.com/Netflix/bless)

    ### Best Practices & Governance

    @@ -25,7 +27,7 @@ This list is not intended be something completely exhaustive, more so provide a
    - [Diffy](https://github.com/Netflix-Skunkworks/diffy)
    - [BinaryAlert](https://github.com/airbnb/binaryalert)

    ### Laast Privileges
    ### Least Privileges

    - [RepoKid](https://github.com/Netflix/repokid)

    @@ -36,16 +38,12 @@ This list is not intended be something completely exhaustive, more so provide a
    - [CloudSploit](https://github.com/cloudsploit/scans)
    - [StreamAlert](https://github.com/airbnb/streamalert)

    ### Secrets

    - [Bless - Lyft](https://github.com/lyft/bless)
    - [Bless - Netflix](https://github.com/Netflix/bless)

    ## AWS

    ### Auth

    - [IAM](https://aws.amazon.com/iam/)
    - [STS](https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html)

    ### Best Practices & Governance

    @@ -59,8 +57,4 @@ This list is not intended be something completely exhaustive, more so provide a

    ### Network Perimeter Visibility

    - [GuardDuty](https://aws.amazon.com/guardduty/)

    ### Secrets

    - [STS](https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html)
    - [GuardDuty](https://aws.amazon.com/guardduty/)
  6. markofu revised this gist Jun 18, 2018. 1 changed file with 13 additions and 7 deletions.
    20 changes: 13 additions & 7 deletions Security_Tools_for_AWS.MD
    View file
    Original file line number Diff line number Diff line change
    @@ -27,14 +27,16 @@ This list is not intended be something completely exhaustive, more so provide a

    ### Laast Privileges

    - [RepoKid] (https://github.com/Netflix/repokid)popul
    - [RepoKid](https://github.com/Netflix/repokid)

    ### Monitoring / Auditing

    - [Security Monkey](https://github.com/Netflix/security_monkey)
    - [Scout](https://github.com/nccgroup/Scout2)
    - [CloudSploit](https://github.com/cloudsploit/scans)
    - [StreamAlert](https://github.com/airbnb/streamalert)### Secrets
    - [StreamAlert](https://github.com/airbnb/streamalert)

    ### Secrets

    - [Bless - Lyft](https://github.com/lyft/bless)
    - [Bless - Netflix](https://github.com/Netflix/bless)
    @@ -44,17 +46,21 @@ This list is not intended be something completely exhaustive, more so provide a
    ### Auth

    - [IAM](https://aws.amazon.com/iam/)
    - [STS](https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html)

    ### Network Perimeter Visibility
    ### Best Practices & Governance

    - [GuardDuty](https://aws.amazon.com/guardduty/)
    - [AWS Trusted Advisor](https://console.aws.amazon.com/trustedadvisor/)

    ### Monitoring / Auditing

    - [CloudTrail](https://aws.amazon.com/cloudtrail/)
    - [AWS Config](https://aws.amazon.com/config/)

    ### Best Practices & Governance

    - [AWS Trusted Advisor](https://console.aws.amazon.com/trustedadvisor/)
    ### Network Perimeter Visibility

    - [GuardDuty](https://aws.amazon.com/guardduty/)

    ### Secrets

    - [STS](https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html)
  7. markofu revised this gist Jun 18, 2018. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions Security_Tools_for_AWS.MD
    View file
    Original file line number Diff line number Diff line change
    @@ -13,7 +13,7 @@ This list is not intended be something completely exhaustive, more so provide a
    ### Best Practices & Governance

    - [Prowler](https://github.com/Alfresco/prowler)
    - [Cloud Custodian] (https://github.com/capitalone/cloud-custodian)
    - [Cloud Custodian](https://github.com/capitalone/cloud-custodian)
    - [Cloud Inquisitor](https://github.com/RiotGames/cloud-inquisitor)

    ### Domain Hijacking
    @@ -57,4 +57,4 @@ This list is not intended be something completely exhaustive, more so provide a

    ### Best Practices & Governance

    - [AWS Trusted Advisor](https://console.aws.amazon.com/trustedadvisor/_
    - [AWS Trusted Advisor](https://console.aws.amazon.com/trustedadvisor/)
  8. markofu revised this gist Jun 18, 2018. 1 changed file with 30 additions and 14 deletions.
    44 changes: 30 additions & 14 deletions Security_Tools_for_AWS.MD
    View file
    Original file line number Diff line number Diff line change
    @@ -2,33 +2,49 @@

    I often get asked which tools are good to use for securing your AWS infrastructure so I figured I'd write a short listof some useful Security Tools for the AWS Cloud Infrastructure.

    This list is not intended be something completely exhaustive, more so provide a good launching pad for someone as they dig into AWS and want to make it secure from the start.

    ## Open Source

    ### Auth

    - [Metadataproxy](https://github.com/lyft/metadataproxy)

    ### Best Practices & Governance

    - [Prowler](https://github.com/Alfresco/prowler)
    - [Cloud Custodian] (https://github.com/capitalone/cloud-custodian)
    - [Cloud Inquisitor](https://github.com/RiotGames/cloud-inquisitor)

    ### Domain Hijacking

    - [Cloud Inquisitor](https://github.com/RiotGames/cloud-inquisitor)

    ### DFIR

    - [Diffy](https://github.com/Netflix-Skunkworks/diffy)
    - [BinaryAlert](https://github.com/airbnb/binaryalert)

    ### Laast Privileges

    - [RepoKid] (https://github.com/Netflix/repokid)popul

    ### Monitoring / Auditing

    - [Security Monkey](https://github.com/Netflix/security_monkey)
    - [Scout](https://github.com/nccgroup/Scout2)
    - [CloudSploit](https://github.com/cloudsploit/scans)
    - [StreamAlert](https://github.com/airbnb/streamalert)### Secrets

    ### Authentication & Authorization

    - [RepoKid] (https://github.com/Netflix/repokid)popul

    ### Domain Hijacking

    - [Cloud Inquisitor](https://github.com/RiotGames/cloud-inquisitor)
    - [Bless - Lyft](https://github.com/lyft/bless)
    - [Bless - Netflix](https://github.com/Netflix/bless)

    ### Best Practices & Governance
    ## AWS

    - [Prowler](https://github.com/Alfresco/prowler)
    - [Cloud Custodian] (https://github.com/capitalone/cloud-custodian)
    - [Cloud Inquisitor](https://github.com/RiotGames/cloud-inquisitor)
    ### Auth

    ## AWS
    - [IAM](https://aws.amazon.com/iam/)
    - [STS](https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html)

    ### Network Perimeter Visibility

    @@ -37,8 +53,8 @@ I often get asked which tools are good to use for securing your AWS infrastructu
    ### Monitoring / Auditing

    - [CloudTrail](https://aws.amazon.com/cloudtrail/)
    - [AWS Config] (https://aws.amazon.com/config/)
    - [AWS Config](https://aws.amazon.com/config/)

    ### Best Practices & Governance

    - [AWS Trusted Advisor] https://console.aws.amazon.com/trustedadvisor/
    - [AWS Trusted Advisor](https://console.aws.amazon.com/trustedadvisor/_
  9. markofu created this gist Jun 18, 2018.
    44 changes: 44 additions & 0 deletions Security_Tools_for_AWS.MD
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,44 @@
    # Security Tools for AWS

    I often get asked which tools are good to use for securing your AWS infrastructure so I figured I'd write a short listof some useful Security Tools for the AWS Cloud Infrastructure.

    ## Open Source

    ### DFIR

    - [Diffy](https://github.com/Netflix-Skunkworks/diffy)

    ### Monitoring / Auditing

    - [Security Monkey](https://github.com/Netflix/security_monkey)
    - [Scout](https://github.com/nccgroup/Scout2)
    - [CloudSploit](https://github.com/cloudsploit/scans)

    ### Authentication & Authorization

    - [RepoKid] (https://github.com/Netflix/repokid)popul

    ### Domain Hijacking

    - [Cloud Inquisitor](https://github.com/RiotGames/cloud-inquisitor)

    ### Best Practices & Governance

    - [Prowler](https://github.com/Alfresco/prowler)
    - [Cloud Custodian] (https://github.com/capitalone/cloud-custodian)
    - [Cloud Inquisitor](https://github.com/RiotGames/cloud-inquisitor)

    ## AWS

    ### Network Perimeter Visibility

    - [GuardDuty](https://aws.amazon.com/guardduty/)

    ### Monitoring / Auditing

    - [CloudTrail](https://aws.amazon.com/cloudtrail/)
    - [AWS Config] (https://aws.amazon.com/config/)

    ### Best Practices & Governance

    - [AWS Trusted Advisor] https://console.aws.amazon.com/trustedadvisor/