#1Tools for testing and securing serverless functions (e.g., AWS Lambda, Azure Functions) and their integrations.
Kitploit recommended
serverless/serverlessCLI framework for deploying and managing serverless applications on AWS Lambda with YAML infrastructure, local development, and multi-language…
firecracker-microvm/firecrackerSecure and fast microVMs for serverless computing.
aquasecurity/trivyFind vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
prowler-cloud/prowlerProwler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.…
semgrep/semgrepLightweight static analysis for many languages. Find bug variants with patterns that look like source code.
aws/serverless-application-modelTransforms SAM templates into CloudFormation resources, generating Lambda functions, IAM roles, and policies with built-in serverless best practices.
bridgecrewio/checkovStatic analysis tool for infrastructure as code that detects cloud misconfigurations, vulnerabilities, and secrets across Terraform, Kubernetes,…
cloud-custodian/cloud-custodianRules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources
snyk/cliSnyk CLI scans and monitors your projects for security vulnerabilities.
rhinosecuritylabs/cloudgoatCloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool
nccgroup/scoutsuiteMulti-cloud security auditing tool that leverages cloud provider APIs to gather configuration data, assess security posture, and generate HTML…
checkmarx/kicsStatic analysis scanner for infrastructure-as-code that detects security vulnerabilities, compliance violations, and misconfigurations across…
rhinosecuritylabs/pacuThe AWS exploitation framework, designed for testing the security of Amazon Web Services environments.
datadog/stratus-red-team:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud
bishopfox/cloudfoxAutomating situational awareness for cloud penetration tests.
iknowjason/awesome-cloudsec-labsAwesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.
fyoorer/shadowcloneServerless task distribution framework that parallelizes CLI tools across thousands of cloud functions for rapid reconnaissance and data processing.
airbnb/binaryalertBinaryAlert: Serverless, Real-time & Retroactive Malware Detection.
