--- title: "Open-Source AWS Security Tools, Grouped by What They Help You Do - Cybr" description: "A curated list of open-source AWS security tools for IAM, incident response, monitoring, security assessments, pentesting, threat detection, and attack simulation." url: https://cybr.com/cloud-security/open-source-aws-security-tools/ --- # Open-Source AWS Security Tools, Grouped by What They Help You Do A curated list of open-source AWS security tools for IAM, incident response, monitoring, security assessments, pentesting, threat detection, and attack simulation. Christophe Published February 7, 2024 · Updated October 27, 2026 AWS gives you a lot of native security services, but the open-source community fills many of the gaps around them. This list groups the tools we recommend by what they help you do, from managing IAM access to simulating attacks against your own accounts. > **Disclaimer:** We do our best to list only reputable tools, but we can't inspect every one of them, so we can't guarantee they work as advertised. Use them at your own risk, and test them outside of production first. ## IAM IAM is challenging enough on its own. These tools make day-to-day access easier and help you find problems in your policies: - [aws-sso-cli](https://github.com/synfinatic/aws-sso-cli) - Use AWS IAM Identity Center from the CLI and web console. - [aws-vault](https://github.com/ByteNess/aws-vault) - Securely store and access AWS credentials in development environments. This is the maintained fork; the original 99designs project is abandoned. - [Granted](https://granted.dev/) - Simplifies access to cloud roles and lets you open multiple AWS accounts in your browser at the same time. - [saml2aws](https://github.com/Versent/saml2aws) - Log in and retrieve temporary AWS credentials through a SAML identity provider. - [AWSume](https://awsu.me/) - Manages session tokens and assumed role credentials from the command line. - [Leapp](https://github.com/Noovolari/leapp) - A desktop app for managing and securing cloud access across many AWS accounts, on macOS, Windows, and Linux. - [aws.permissions.cloud](https://github.com/iann0036/aws.permissions.cloud) - A crowdsourced AWS IAM permissions reference. - [aws-lint-iam-policies](https://github.com/welldone-cloud/aws-lint-iam-policies) - Lints and security-checks the identity-based and resource-based policies in one account or across an AWS Organization. For the concepts behind these tools, read [What Is AWS IAM?](https://cybr.com/cloud-security/what-is-aws-iam/) and [How to Achieve Least Privilege in AWS IAM](https://cybr.com/cloud-security/aws-iam-least-privilege/). ## Incident response - [TrailScraper](https://github.com/flosell/trailscraper) - A command-line tool to get valuable information out of AWS CloudTrail. - [cloudgrep](https://github.com/cado-security/cloudgrep) - grep for cloud storage. If your access keys were exposed, start with our [incident response playbook for exposed IAM credentials](https://cybr.com/cloud-security/my-aws-iam-access-keys-were-exposed-what-should-i-do-cheat-sheet/). ## Real-world incident case studies Public reports of AWS incidents and responses that go into a high level of detail: - [Leaked Environment Variables Allow Large-Scale Extortion Operation in Cloud Environments](https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation/) - How the threat actor compromised access keys through leaked environment variables and then escalated privileges through [iam:AttachRolePolicy](https://cybr.com/cloud-security/aws-iam-privilege-escalation-techniques/#iamattachrolepolicy). - [The curious case of DangerDev@protonmail.me](https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me) - An AWS incident walkthrough, including the threat actor's techniques and indicators of compromise (IoCs). - [How crypto miners hijack AWS accounts](https://cybr.com/cloud-security/how-crypto-miners-hijack-aws-accounts-cryptojacking-gui-vil-case-study/) - How the threat actor compromised access keys, established persistence, and started mining. - [LUCR-3 (Scattered Spider) attacks against cloud environments](https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud) - Attacker attributes, lifecycle, techniques, defense evasion, and IoCs. - [Public Cloud Security Breaches](https://www.breaches.cloud/) - A catalog of public cloud breaches, documented so you don't repeat them. ## Monitoring, logging, and alerting - [AWS Security Survival Kit](https://github.com/zoph-io/aws-security-survival-kit) - Sets up basic proactive monitoring and alerting for common suspicious activity in your AWS account. We walk through it in [this cheat sheet](https://cybr.com/cloud-security/must-have-aws-security-monitoring-alerting-cheat-sheet/). - [TrailDiscover](https://traildiscover.cloud/) - A repository of CloudTrail events with descriptions, MITRE ATT&CK mappings, real-world incidents, and security implications. For how the AWS-native services fit together, read [AWS Security Monitoring, Logging, and Alerting](https://cybr.com/cloud-security/aws-security-monitoring-logging-alerting/). ## Security assessments and compliance - [Prowler](https://github.com/prowler-cloud/prowler) - Security assessments, audits, compliance checks, and hardening for AWS, Azure, Google Cloud, and Kubernetes, with frameworks like CIS, NIST, PCI-DSS, HIPAA, and SOC 2 built in. Our [Prowler cheat sheet](https://cybr.com/prowler-cheat-sheet/) shows how to use it. ## Network and application protection - [AWS Firewall Factory](https://github.com/globaldatanet/aws-firewall-factory) - Deploys, updates, and stages AWS WAF rules across accounts through AWS Firewall Manager, with testing, cost estimates, reporting, and alerts for DDoS activity and rule changes. ## Pentesting and red teaming - [Pacu](https://github.com/RhinoSecurityLabs/pacu) - The AWS exploitation framework from Rhino Security Labs. Get started with our [intro to AWS pentesting with Pacu](https://cybr.com/cloud-security/intro-to-aws-pentesting-with-pacu/). - [enumerate-iam](https://github.com/andresriancho/enumerate-iam) - Enumerates the permissions associated with a set of AWS credentials. For doing this by hand, see our [IAM enumeration CLI commands](https://cybr.com/cloud-security/aws-iam-enumeration/). - [AWSealion](https://github.com/0xd4y/AWSealion) - A lightweight tool to keep AWS pentests efficient, organized, and stealthy. ## Threat detection - [CloudGrappler](https://github.com/Permiso-io-tools/CloudGrappler) - Queries for high-fidelity detections related to well-known threat actors in AWS and Azure. ## Attack simulation These tools help you test your defenses to make sure they detect common AWS attacks. For a closer look at three of them, read [Simulate AWS Cloud Attacks with Real-World Techniques](https://cybr.com/cloud-security/simulate-aws-cloud-attacks-with-real-world-techniques/). We also cover several of these in our [cloud attack simulations cheat sheet](https://cybr.com/cheat-sheets/cloud-attack-simulations/). - [Stratus Red Team](https://github.com/DataDog/stratus-red-team) by Datadog - Granular, actionable adversary emulation for the cloud. - [Grimoire](https://github.com/DataDog/grimoire) by Datadog - Generates datasets of cloud audit logs for common attacks. See [AWS Detection Engineering with Grimoire](https://cybr.com/cloud-security/aws-detection-engineering-with-grimoire/). - [Leonidas](https://github.com/ReversecLabs/leonidas) by Reversec - Automated attack simulation in the cloud, complete with detection use cases. - [CloudGoat](https://github.com/RhinoSecurityLabs/cloudgoat) by Rhino Security Labs - A "vulnerable by design" AWS deployment tool. - [Amazon GuardDuty Tester](https://github.com/awslabs/amazon-guardduty-tester) - Generates sample GuardDuty findings so you can confirm detection is working. - [AWS CloudSaga](https://github.com/awslabs/aws-cloudsaga) - Simulates security events in AWS. - [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) - Small, portable detection tests mapped to MITRE ATT&CK. Not specific to the cloud. - [DeRF](https://github.com/vectra-ai-research/derf) - The Detection Replay Framework, an "attacks as a service" framework that emulates offensive techniques and generates repeatable detection samples. It hasn't been updated since early 2024. ## Threat and vulnerability databases - [The Open Cloud Vulnerability & Security Issue Database](https://www.cloudvulndb.org/results?tags=AWS) - [Datadog's Cloud Security Atlas](https://securitylabs.datadoghq.com/cloud-security-atlas/?platform%5B0%5D=aws) - [Wiz's Cloud Threat Landscape](https://threats.wiz.io/) ## Communities - [Cybr Discord](https://cybr.com/discord) - [Prowler Slack](https://goto.prowler.com/slack) ## AWS security news - [AWS Security Digest](https://awssecuritydigest.com/) - A free newsletter covering AWS security news and changes. ## More tools Thanks to gvoden, Carl Littrell, Eric Villa, and daknhh, who contributed tools to this list when it lived on CloudSec.Cybr. For an even longer list, Toni de la Fuente's [My arsenal of AWS security tools](https://github.com/toniblyx/my-arsenal-of-aws-security-tools) is a great resource and was a source for several of the tools above. ## Filed under - [Cloud Security](https://cybr.com/cloud-security/) - [AWS](https://cybr.com/tag/aws/) - [AWS Security](https://cybr.com/tag/aws-security/) - [Open-source](https://cybr.com/tag/open-source/) - [Tools](https://cybr.com/tag/tools/) ## Comments Loading comments… Recommended resources [![Explore the AWS Certified Security Specialty course](https://media.cybr.com/2023/12/cybr-aws-security-specialty-banner-768x432.jpg)](https://cybr.com/courses/aws-certified-security-specialty-course/) ## Build practical AWS security skills Start with the core services, then prepare for the AWS Certified Security Specialty exam with guided lessons and hands-on practice. [Introduction to AWS Security](https://cybr.com/courses/introduction-to-aws-security/) [Security Specialty course](https://cybr.com/courses/aws-certified-security-specialty-course/)