Open-Source AWS Security Tools, Grouped by What They Help You Do

AWS gives you a lot of native security services, but the open-source community fills many of the gaps around them. This list groups the tools we recommend by what they help you do, from managing IAM access to simulating attacks against your own accounts.

Disclaimer: We do our best to list only reputable tools, but we can't inspect every one of them, so we can't guarantee they work as advertised. Use them at your own risk, and test them outside of production first.

IAM

IAM is challenging enough on its own. These tools make day-to-day access easier and help you find problems in your policies:

aws-sso-cli - Use AWS IAM Identity Center from the CLI and web console.
aws-vault - Securely store and access AWS credentials in development environments. This is the maintained fork; the original 99designs project is abandoned.
Granted - Simplifies access to cloud roles and lets you open multiple AWS accounts in your browser at the same time.
saml2aws - Log in and retrieve temporary AWS credentials through a SAML identity provider.
AWSume - Manages session tokens and assumed role credentials from the command line.
Leapp - A desktop app for managing and securing cloud access across many AWS accounts, on macOS, Windows, and Linux.
aws.permissions.cloud - A crowdsourced AWS IAM permissions reference.
aws-lint-iam-policies - Lints and security-checks the identity-based and resource-based policies in one account or across an AWS Organization.

For the concepts behind these tools, read What Is AWS IAM? and How to Achieve Least Privilege in AWS IAM.

Incident response

TrailScraper - A command-line tool to get valuable information out of AWS CloudTrail.
cloudgrep - grep for cloud storage.

If your access keys were exposed, start with our incident response playbook for exposed IAM credentials.

Real-world incident case studies

Public reports of AWS incidents and responses that go into a high level of detail:

Leaked Environment Variables Allow Large-Scale Extortion Operation in Cloud Environments - How the threat actor compromised access keys through leaked environment variables and then escalated privileges through iam:AttachRolePolicy.
The curious case of DangerDev@protonmail.me - An AWS incident walkthrough, including the threat actor's techniques and indicators of compromise (IoCs).
How crypto miners hijack AWS accounts - How the threat actor compromised access keys, established persistence, and started mining.
LUCR-3 (Scattered Spider) attacks against cloud environments - Attacker attributes, lifecycle, techniques, defense evasion, and IoCs.
Public Cloud Security Breaches - A catalog of public cloud breaches, documented so you don't repeat them.

Monitoring, logging, and alerting

AWS Security Survival Kit - Sets up basic proactive monitoring and alerting for common suspicious activity in your AWS account. We walk through it in this cheat sheet.
TrailDiscover - A repository of CloudTrail events with descriptions, MITRE ATT&CK mappings, real-world incidents, and security implications.

For how the AWS-native services fit together, read AWS Security Monitoring, Logging, and Alerting.

Security assessments and compliance

Prowler - Security assessments, audits, compliance checks, and hardening for AWS, Azure, Google Cloud, and Kubernetes, with frameworks like CIS, NIST, PCI-DSS, HIPAA, and SOC 2 built in. Our Prowler cheat sheet shows how to use it.

Network and application protection

AWS Firewall Factory - Deploys, updates, and stages AWS WAF rules across accounts through AWS Firewall Manager, with testing, cost estimates, reporting, and alerts for DDoS activity and rule changes.

Pentesting and red teaming

Pacu - The AWS exploitation framework from Rhino Security Labs. Get started with our intro to AWS pentesting with Pacu.
enumerate-iam - Enumerates the permissions associated with a set of AWS credentials. For doing this by hand, see our IAM enumeration CLI commands.
AWSealion - A lightweight tool to keep AWS pentests efficient, organized, and stealthy.

Threat detection

CloudGrappler - Queries for high-fidelity detections related to well-known threat actors in AWS and Azure.

Attack simulation

These tools help you test your defenses to make sure they detect common AWS attacks. For a closer look at three of them, read Simulate AWS Cloud Attacks with Real-World Techniques.

We also cover several of these in our cloud attack simulations cheat sheet.

Stratus Red Team by Datadog - Granular, actionable adversary emulation for the cloud.
Grimoire by Datadog - Generates datasets of cloud audit logs for common attacks. See AWS Detection Engineering with Grimoire.
Leonidas by Reversec - Automated attack simulation in the cloud, complete with detection use cases.
CloudGoat by Rhino Security Labs - A "vulnerable by design" AWS deployment tool.
Amazon GuardDuty Tester - Generates sample GuardDuty findings so you can confirm detection is working.
AWS CloudSaga - Simulates security events in AWS.
Atomic Red Team - Small, portable detection tests mapped to MITRE ATT&CK. Not specific to the cloud.
DeRF - The Detection Replay Framework, an "attacks as a service" framework that emulates offensive techniques and generates repeatable detection samples. It hasn't been updated since early 2024.

Threat and vulnerability databases

Communities

AWS security news

AWS Security Digest - A free newsletter covering AWS security news and changes.

More tools

Thanks to gvoden, Carl Littrell, Eric Villa, and daknhh, who contributed tools to this list when it lived on CloudSec.Cybr.

For an even longer list, Toni de la Fuente's My arsenal of AWS security tools is a great resource and was a source for several of the tools above.