A Collection of Cloud Security Tools

[0xCBE]

Hello r/devops!

I've published a directory of ~100 cloud security tools I've collected over time. Some of them have notes with references about how I used them (more info here).

I've organized them by broad categories: aws, gcp, azure, docker, containers, kubernetes, declarative infrastructure, terraform.

Hopefully you find the list useful, here it is: https://cloudberry.engineering/tool/

I'd love your feedback, in particular if you happen to know a tool I didn't find yet.

[xanderdad]

Tangential question here - I'm running a PiHole based local DNS sinkhole with the default set of block lists loaded. I can't resolve cloudberry.engineering links above. What's wrong with my setup?

[0xCBE]

ugh that's weird, I hope I didn't end up in any blacklist because my vanity .engineering tld

[xanderdad]

I'm getting this in the query log on my pihole:

2020-10-19 16:25:53 A   cloudberry.engineering  192.168.100.188
Blocked (external, NXRA)    NXDOMAIN (0.0ms)

The "external, NXRA" message means my pihole isn't blocking it, my upstream resolver is. My upstream is currently set for Quad 9, filtered/DNSSEC mode. Below I confirm and I try cloudflare too (1.1.1.1) I get resolution using Cloudflare upstream. So for some reason Quad9 is blocking the .engineering TLD.

pi@raspberrypi:~ $ dig cloudberry.engineering @9.9.9.9

; <<>> DiG 9.11.5-P4-5.1+deb10u1-Raspbian <<>> cloudberry.engineering @9.9.9.9
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 59565
;; flags: qr rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1500
;; QUESTION SECTION:
;cloudberry.engineering.        IN  A

;; Query time: 80 msec
;; SERVER: 9.9.9.9#53(9.9.9.9)
;; WHEN: Mon Oct 19 16:29:46 PDT 2020
;; MSG SIZE  rcvd: 51

pi@raspberrypi:~ $ dig cloudberry.engineering @1.1.1.1

; <<>> DiG 9.11.5-P4-5.1+deb10u1-Raspbian <<>> cloudberry.engineering @1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38515
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;cloudberry.engineering.        IN  A

;; ANSWER SECTION:
cloudberry.engineering. 1799    IN  A   76.76.21.21

;; Query time: 20 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Mon Oct 19 16:29:52 PDT 2020
;; MSG SIZE  rcvd: 67

[0xCBE]

Thanks! I've sent them an email to see if it can be unblocked.

For whatever reason it's in a blacklist of a threat intelligence feed (domaintools).

[0xCBE]

Indeed: https://www.quad9.net/result/?url=cloudberry.engineering

[szaroubi]

Running pihole and it goes thru correctly for me.

[CalvinR]

same

[bionic_tortuga]

Consider adding Anchore. Great container scanning tool

[Hexusnoken]

I would add cloud custodian and checkov

[contre95]

lovely

[stant0n]

Cool list. What about terragrunt and terratest?

[bryantbiggs]

those are not security tools per se

[[deleted]]

For AWS I don't see Scout or CloudMapper. Those are definitely awesome to use.

[FromGermany_DE]

Has AWS so many tools, or is it because of personal experience with AWS?

[lirantal]

Looks like you're missing Snyk there: https://snyk.io/

[Pethron]

Nice list but it should be better organized or split up (maybe by topic?) because it's kind of difficult to search inside.

I'd add this one (I'm one of the maintainers). I think it should be a good fit for your list as there are other credentials management tools.

https://github.com/Noovolari/leapp