A 'Vulnerable by Design' cloud deployment tool for creating and completing capture-the-flag style security scenarios on AWS and Azure.
CloudGoat is a deliberately vulnerable cloud environment deployment tool designed for hands-on cybersecurity training. It allows security professionals and learners to practice penetration testing skills in realistic, isolated cloud scenarios that simulate common misconfigurations and attack vectors. The tool creates structured, capture-the-flag style environments on AWS and Azure using Terraform.
Cloud security professionals, penetration testers, red teamers, and learners seeking practical experience in identifying and exploiting cloud misconfigurations. It is specifically aimed at those who want to practice offensive security techniques in safe, isolated cloud environments.
Developers choose CloudGoat for its curated, scenario-based learning with clear goals and documentation, multi-cloud support, and modular design that allows for community contributions. Unlike generic vulnerable labs, it focuses on realistic cloud-specific attack vectors and provides automated management via a Python CLI for easy deployment and destruction.
CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Offers curated scenarios with clear goals and varying difficulties (Easy, Medium, Hard), providing focused, hands-on experience in cloud security, as documented in the README's categorized list.
Supports both AWS and Azure using Terraform and cloud provider CLIs, allowing practice across different platforms, which is highlighted in the key features.
Includes a Python CLI for creating, listing, and destroying scenarios, automating deployment and cleanup, as described in the usage guide with commands like 'create' and 'destroy'.
Designed for easy contribution of new scenarios with a template and guidelines, enabling continuous updates and diverse attack vectors, as noted in the contribution section.
Provides a Docker image for containerized usage with pre-configured tools, ensuring consistency across environments, as shown in the Docker integration section with run commands.
Officially不支持 Windows, requiring Linux or MacOS, which limits accessibility and forces Windows users to seek workarounds or alternative setups.
Requires installation of multiple tools like Python 3.9+, Terraform, AWS CLI, Azure CLI, and jq, making initial configuration time-consuming and prone to errors.
CloudGoat can only manage resources it creates; any user-created resources during scenarios must be deleted manually before destruction, as warned in the README, adding overhead.
Deploys cloud resources that can incur charges if not destroyed promptly, and some scenarios may exceed free tier limits, requiring careful monitoring to avoid unexpected bills.