iknowjason/awesome-cloudsec-labsAwesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.
A list of free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.
| Name | Technology | Category | Author | Notes |
|---|---|---|---|---|
| The Ultimate Cloud Security Championship | AWS | Author-hosted CTF Challenge | Wiz | A monthly CTF challenge, with challenges curated by a Star Wiz researcher. Challenges and leaderboard hosted by Wiz. |
| CloudFoxable | AWS | Self-hosted CTF Challenge | Seth Art | Create your own vulnerable by design AWS penetration testing playground |
| Pwned Labs | AWS | Author-hosted Guided Labs, CTF | Ian Austin | Requires account registration; Commercial paid subscriptions; free hosted labs for learning cloud security |
| The Big IAM Challenge | AWS | Author-hosted CTF Challenge | Wiz | CTF challenge to identify and exploit IAM misconfigurations |
| The Cloud Hunting Games | AWS | Author-hosted CTF Challenge | Wiz | CTF ransomware challenge designed to teach real-world cloud investation based on TTPs seen in the wild |
| CloudSec Tidbits | AWS | Self-hosted Challenge | Doyensec | Three web app security flaws specific to AWS cloud, self-hosted with terraform |
| AWS Well-Architected Security Workshop | AWS | Self-hosted, guided labs | AWS Well-Architected | Several hands-on-labs to help you learn, measure, and improve the security of your architecture using best practices from the Security pillar of the AWS Well-Architected Framework. |
| AWS CIRT Workshop | AWS | Self-hosted, guided lab | AWS CIRT | Build with Cloudformation, explore 5 common incident response scenarios observed by AWS CIRT |
| CloudGoat | AWS | Self-hosted, guided vulnerability lab | Multiple, Rhino Security Labs | Python orchestration of terraform |
| Attacking and Defending Serverless Applications | AWS | Self-hosted, guided vulnerability workshop | Ryan Nicholson | Attack and defend a Lambda that you build in your own AWS account with author provided terraform |
| IAM Vulnerable | AWS | Self-hosted, guided vulnerability lab | Seth Art | IAM-focused priv esc playground with 31 pathways, create in your own AWS account using terraform, solid docs |
| flaws.cloud | AWS | Author-hosted, CTF challenge | Scott Piper | Challenge style with levels and clues |
| flaws2.cloud | AWS | Author-hosted, CTF challenge | Scott Piper | Challenge style Attacker and Defender paths |
| CI/CDon't | AWS | Self-hosted CTF walkthrough | Nick Frichette | Host with terraform in your own AWS account, vulnerable CI/CD CTF infrastructure |
| AWSGoat | AWS | Self-hosted, attack and defense manuals | Multiple, ine-labs | Bring your own aws account, Build with terraform, two modules, provides attack and defense manuals |
| Sadcloud | AWS | Self-hosted | Multiple, NCC Group | Terraform code; not guided like CloudGoat |
| DVCA | AWS | Self-hosted demo lab | Maxime Leblanc | Deploy a Damn Vulnerable Cloud Application in your own AWS account to practice privilege escalation |
| lambhack | AWS | Self-hosted lab | James Wickett | Deploy a very vulnerable AWS lambda serverless application in your AWS account |
| AWSCloudPentest | AWS | Self-hosted lab | Punit Darji | Deploy vulnerable AWS scenarios in your account using terraform and learn how to exploit them. Companion YouTube channel. |
| EntraGoat | Azure | Self-hosted lab | Semperis | A deliberately vulnerable Microsoft Entra ID infrastructure. Uses Powershell Graph SDK scripts with a nice NodeJS web UI for management. Six vulnerable attack path scenarios with solutions documented. |
| BadZure | Azure | Self-hosted lab | Mauricio Velazco | Powershell Graph SDK script that spins up your own Azure AD (Entra ID) lab with attack paths. Currently no walk through or guide. |
| Broken Azure | Azure | Author-hosted, CTF challenge | Secura | Provides hints, optionally self-host in your own Azure account using terraform |
| Mandiant Azure Workshop | Azure | Self-hosted, guided commands | Multiple | Vulnerable by design Azure lab with two scenarios; build with terraform |
| AzureGoat | Azure | Self-hosted, attack and defense manuals | Multiple, ine-labs | Bring your own Azure tenant, Build with terraform, one module, provides attack and defense manuals |
| XMGoat | Azure | Self-hosted, guided labs | Multiple | Build with terraform, 5 scenarios, solution docs provided |
| CONVEX | Azure | Self-hosted, CTF | Multiple | Spin up three Capture the Flag environments in your Azure tenant using powershell |
| GCP CTF Workshop | GCP | Self-hosted, lab guide | Marion Säckel, Marcus Hallberg | Host in your own GCP account, build with terraform using bash setup script, solution and hints provided |
| GCP Goat (Josh Jebaraj) | GCP | Self-hosted, mdbook lab guide | Josh Jebaraj | Host in your own GCP account, build with provided scripts, nice guided lab workbook |
| GCPGoat (ine-labs) | GCP | Self-hosted, attack and defense manuals | Multiple, ine-labs | Bring your own GCP account, Build with terraform, one module, provides attack and defense manuals |
| Thunder CTF | GCP | Self-hosted, CTF | Multiple | Bring your own GCP account, 6 levels, practice attacking vulnerable cloud projects on GCP |
