Security Tools for AWS

Security_Tools_for_AWS.MD

Security Tools for AWS

I often get asked which tools are good to use for securing your AWS infrastructure so I figured I'd write a short listof some useful Security Tools for the AWS Cloud Infrastructure.

This list is not intended be something completely exhaustive, more so provide a good launching pad for someone as they dig into AWS and want to make it secure from the start.

Open Source

This section focuses on tools and services provided by the community and released as open-source.

Auth

Tools to help you auth (clients) securely in AWS.

• Metadataproxy
• Bless - Lyft
• Bless - Netflix
• Key Conjurer - Riot Games

Best Practices & Governance

Tools that enable you to ensure security best practices are followed across your organisation and infrastructure.

• Prowler
• Cloud Custodian - Capital One
• Cloud Inquisitor - Riot Games

Domain Hijacking

• Cloud Inquisitor - Riot Games

DFIR

Tools to help perform Incident Response on AWS

• Diffy
• BinaryAlert

Least Privileges

AWS Least Privilege for Distributed, High-Velocity Deployment

• RepoKid

Monitoring / Auditing

Holistic // General

Tools that provide a good way monitoring your overall security posture through scraping configuration and collating it or ingesting logs.

• Security Monkey
• ScoutSuite
• CloudSploit
• StreamAlert

S3

Finding interesting S3 buckets through monitoring certificate transparency logs

• Bucket Stream

Exif Cleaner

• S3 Exif Cleaner

Secrets

Secret Keeper

• Confidant

Terraform

Checkov is a static code analysis tool for infrastructure-as-code. It scans cloud infrastructure provisioned using Terraform and detects security and compliance misconfigurations.

• Checkov

AWS

This section focuses on tools and services provided by AWS for a nominal charge or as part of their overall service.

Auth

Services that provide authentication and authorisation to AWS services, with STS enabling that access to be through temporary credentials.

• IAM
• STS

Best Practices & Governance

Service that helps your monitor your AWS services holistically to reduce cost, ensure best practices are being followed and improve security.

• AWS Trusted Advisor

Monitoring / Auditing

AWS service that enable your to audit and monitor your configurations and API calls.

• CloudTrail
• AWS Config

Network Perimeter Visibility

AWS Service that is essentially a managed threat detection service that continuously monitors for malicious behaviour to help you protect your AWS accounts and workloads. One of the few things to provide visibility of your external perimeter in AWS.

• GuardDuty

Great list, Here are a few more Mark!

Cloudfront subdomain hijacking:
@disloops CloudFrunt for Subdomain hijacking works great! https://github.com/MindPointGroup/cloudfrunt
CloudJack: https://github.com/prevade/cloudjack

Visualization /governance
@0xdabbad00 and duo's Cloudmapper and CloudTracker https://github.com/duo-labs/cloudmapper and https://github.com/duo-labs/cloudtracker
training: http://flaws.cloud/

Offensive:
AWS Attack Library; https://github.com/carnal0wnage/weirdAAL/wiki
aws_pwn: https://github.com/dagrz/aws_pwn

Least Privileged
https://github.com/Netflix/repokid
Repokid-extras: https://github.com/Netflix-Skunkworks/repokid-extras

S3 hunting:
Slurp: https://github.com/random-robbie/slurp
Bucket-stream: https://github.com/eth0izzle/bucket-stream
BucketFinder: https://digi.ninja/projects/bucket_finder.php

Thanks @houey.....that's great feedback, much appreciated. 👍

Some of those tools I'd heard of but had heard mixed reports so was unsure of recommending them, while others I had not heard of so thank you, I'll update the gist and check them out.

I had Repokid there but was reluctant to put the Skunkworks project in there because they're essentially not supported by Netflix.

Loved that list!
adding 1 more to the list:

Infrastructure as code static analysis
@bridgecrewio Terraform static analysis: https://github.com/bridgecrewio/checkov

Scout2 has move to ScoutSuite https://github.com/nccgroup/ScoutSuite

Loved that list!
adding 1 more to the list:

Infrastructure as code static analysis
@bridgecrewio Terraform static analysis: https://github.com/bridgecrewio/checkov

Thx @schosterbarak I've added that 👍

Scout2 has move to ScoutSuite https://github.com/nccgroup/ScoutSuite

Thanks @robdew, it's been updated 👍

great list!

I made a tool that's been very useful for me: https://github.com/seisvelas/S3-Exif-Cleaner

It removes EXIF data from all objects in an S3 bucket - maybe it will save work for someone else as well :3

Thanks @seisvelas, added :)