Awesome Cloud Security Labs

A list of free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.

Sorted by Technology and Category

AWS

The Ultimate Cloud Security Championship: A monthly CTF challenge, with challenges curated by a Star Wiz researcher. Challenges and leaderboard hosted by Wiz.

CloudFoxable: Create your own vulnerable by design AWS penetration testing playground.

Pwned Labs: Requires a login. Offers paid subscriptions. Free hosted labs for learning cloud security.

The Big IAM Challenge: CTF challenge to identify and exploit IAM misconfigurations.

The Cloud Hunting Games: CTF ransomware challenge designed to teach real-world cloud investation based on TTPs seen in the wild.

CloudSec Tidbits: Three web app security flaws specific to AWS cloud, self-hosted with terraform.

AWS CIRT Workshop: Build in your own AWS account and explore 5 common incident response scenarios as seen by the AWS CIRT team.

CloudGoat: Vulnerable by design AWS security labs with guided walkthrough.

Attacking and Defending Serverless Applications: Attack and defend a Lambda that you build in your own AWS account with author provided terraform and scripts. Very educational with workshop style feel.

IAM Vulnerable: Use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground with 31 privilege escalation attack pathways. Very solid documentation.

flaws.cloud: Challenge style with levels and clues.

flaws2.cloud: Challenge style with both Attacker and Defender paths.

CI/CDon't: A vulnerable CI/CD CTF challenge hosted in your aws account with terraform. Includes a walkthrough.

AWSGoat: A damn vulnerable AWS infrastructure with two attack and defense manuals.

Sadcloud: Create vulnerable AWS services without a guide showing vulnerabilities.

DVCA: Deploy a Damn Vulnerable Cloud Application in your own AWS account to practice privilege escalation.

lambhack: Deploy a very vulnerable AWS lambda serverless application in your AWS account.

AWSCloudPentest: Deploy vulnerable AWS scenarios in your account using terraform and learn how to exploit them. He has a companion YouTube [channel[(https://www.youtube.com/@punitdarji1871).

AWS Well-Architected Security Workshop: Self-deployed hands-on-labs to help you learn, measure, and improve the security of your architecture using best practices from the Security pillar of the AWS Well-Architected Framework.

Azure

EntraGoat: A deliberately vulnerable Microsoft Entra ID infrastructure. Uses Powershell Graph SDK scripts with a nice NodeJS web UI for management. Six vulnerable attack path scenarios with solutions documented.

BadZure: Powershell Graph SDK script that spins up your own Azure AD (Entra ID) lab with attack paths. Currently no walk through or guide.

Broken Azure: A vulnerable by design Azure infrastructure that you can attack.

Mandiant Azure Workshop: Vulnerable by design Azure lab with two scenarios that you build in your own Azure tenant.

AzureGoat: Build one module with terraform and walk through the provided attack and defense manuals.

XMGoat: Build 5 scenarios in your Azure tenant and walk through solution docs provided.

CONVEX: Spin up three Capture the Flag environments in your Azure tenant using powershell.

GCP

| GCP CTF Workshop: Self-hosted, lab guide. Host in your own GCP account, build with terraform using bash setup script, solution and hints provided.

GCP Goat (Josh Jebaraj): Host in your own GCP account and build with provided scripts. It has a nice guided lab workbook.

GCPGoat (ine-labs): Bring your own GCP account and build one module with terraform. Provides attack and defense manuals.

Thunder CTF: Bring your own GCP account, 6 levels, practice attacking vulnerable cloud projects on GCP.

Kubernetes

OWASP EKS Goat: An intentionally vulnerable AWS EKS environment simulating real‑world misconfigurations, IAM flaws, and pod breakout along with defense hands on lab. Includes 20+ attack‑defense labs you can deploy and practice hands‑on.

K8s Lan Party: To dive into a network full of misconfigurations and exploit vulnerabilities with the goal of conquering a Kubernetes cluster, with leaderboard and requires registration.

EKS Cluster Games: Vulnerable EKS pod with flag challenges across environment, with leaderboard and requires registration.

Bustakube: Download a vulnerable K8S cluster as VMs that you can import and run locally in VMWare.

Kubernetes Goat: Create and host in your own cloud account (GKE, EKS, AKS) or K3S and attack. Includes a guided workbook.

Kubecon NA 2019 CTF: Awesome CTF that you create in your GCP account. Has a guided workbook with two attack and defense scenarios plus bonus challenges.

Kube Security Lab: An awesome local lab to create 14 vulnerable Kubernetes clusters using Docker, Ansible, and Kind. Attack them after building, then destroy. Inludes walkthroughs.

Container

Container Security 101: A guided vulnerability workshop that is hosted in your AWS account. Author has provided a nice lab you follow on the webpage and you build a VM with CloudFormation and then create a container.

Contained.af: A container escape challenge, break out of it and email the author.

Terraform

TerraGoat: Vulnerable by design terraform repository.

Research Labs

PurpleCloud: Using python and terraform, build your own Azure security lab.

SimuLand: Using Azure RM templates, create your own Azure security lab.

CNAPPgoat: Using Pulumi, modularly provision vulnerable-by-design components in AWS, GCP, Azure. The vulnerabilities are modular scenarios with no guided walkthrough existing yet.

CI/CD

CI/CD Goat: Deliberately vulnerable CI/CD environment, hacking CI/CD pipelines with CTF. Host locally with docker.

Github Actions Goat: Deliberately vulnerable Github Actions CI/CD environment, hosted in your own Github account. Includes threat scenario descriptions mapped to vulnerabilities.

PaaS

PaaS Cloud Goat: A simulated vulnerable Salesforce application, hosted in your own SF account. Simulates a deployed custom application with security tests and documentation you can use to learn.