Kind of like a bookmark list of various tools and websites that I've found useful in our travels.

AWS Security Tools and References



AWS Security Lists

• https://asecure.cloud/ - Excellent place to pull SCPs from, also terraform and CloudFormation ready to go
• https://cloudsecdocs.com/ - A collection of Cloud Security resources
• https://github.com/toniblyx/my-arsenal-of-aws-security-tools
• markofu's Gists

OSS Tools

• AWS Security Incident Response Whitepaper
• mandatoryprogrammer's tarnish chrome extension
• Segmentio's AWS Okta
• Versent's saml2aws

Cloud Security, DevSecOps, and Automation Tools

• Manatee - Configuration Drift
• Refactr - DevOps Automation
• Open Policy Agent - Policy Framework
• https://slscan.io/en/latest/
• https://atomist.com/
• https://www.tines.com/
• https://nops.io/
• https://www.fugue.co/

CPSM (Cloud Security Posture Monitoring) Tools

• https://www.lacework.com/
• https://github.com/OpenCSPM/opencspm
• https://www.shujinko.io/
• https://tenacitycloud.com/
• https://www.argos-security.io/

Container Security

Open Source Tools

• https://anchore.com/
• https://github.com/quay/clair
• https://github.com/eliasgranderubio/dagda/

Infosec Reports

• https://github.com/cloud-security-labs/infosec-reports - collection of previous and current information security reports

SAST & DAST Tools

• https://www.shiftleft.io/
• https://indeni.com/

Patch Management & Hardening

• https://dev-sec.io/

Zero-Trust Access & VPN

Zero-Trust Vendors

• https://tailscale.com/
• https://www.twingate.com/
• https://www.cloudflare.com/teams/
• AWS Client VPN

Useful Zero-Trust Articles

• Cloud Security Labs: https://cloudsecuritylabs.io/blog/what-is-zero-trust/

Authorization Software

• https://www.osohq.com/
• https://www.aserto.com/
• https://www.openpolicyagent.org/

Web Application Security Training

• https://portswigger.net/web-security
• https://www.youtube.com/c/RanaKhalil101
• https://sudo.pagerduty.com/

Scanners

• https://urlscan.io/
• https://www.shodan.io/
  • See https://2000.shodan.io/#/ for live examples!

Secrets Scanners

• https://www.gitguardian.com/
• https://github.com/bridgecrewio/checkov
• https://snyk.io/



Index of Security Checklists

• https://www.goldfiglabs.com/guide/saas-cto-security-checklist/
• https://s3-eu-west-1.amazonaws.com/sqreen-assets/whitepapers/SaaS+CTO+Security+Checklist.pdf
• https://scrty.io/

Cloud Native WAFs & API Security Tools

• https://www.wallarm.com/
• https://www.traceable.ai/



GRC SaaS Tools

• https://hyperproof.io/
• http://www.6clicks.com/
• https://tugboatlogic.com/



Outsourced IT

• https://interlaced.io/
• https://www.electric.ai/
• https://www.bayport.net/
• https://www.mann.com/