AWS Security Cards: Free Offensive Security Reference for 60 AWS Services

#cloudsecurity #offensivesecurity #aws #awssecurity

AWS documentation tells you how services work. It doesn’t tell you how they break.

AWS Security Cards: fills that gap. It’s a free, open-source set of security reference cards: one per AWS service, 60 total , covering attack vectors, misconfigurations, enumeration commands, privilege escalation, persistence, detection, and defense. Available in Markdown, HTML, and PDF.

What’s in a card

Each card covers a single AWS service from an offensive and defensive security perspective:

Service overview: with attacker-relevant context
Attack vectors: concrete exploitation paths, not vague risk statements
Common misconfigurations: what actually leads to breaches
Enumeration commands: copy-paste AWS CLI for security assessments
Privilege escalation: how read access becomes admin
Persistence techniques: how access survives incident response
Detection indicators: what shows up in CloudTrail and monitoring
Policy examples: good vs. bad IAM/resource policies, side by side
Defense recommendations: hardening commands you can run today
Risk score: from 5.5 to 9.5, to help prioritize

Risk scores across the board

| Risk | Services |
|---------|--------------------------------------------------------------------------------------------------------------------------|
| 9.5 | IAM, STS, Organizations, Secrets Manager, Identity Center |
| 9.0–9.2 | Redshift, EC2, S3, EKS, RDS, CodeBuild, CloudFormation, Route 53, Backup, Glue, Directory Service |
| 8.5 | CloudTrail, API Gateway, ECR, ECS, OpenSearch, Systems Manager, SageMaker, Step Functions, Security Hub, Transit Gateway |
| 7.0–8.0 | DynamoDB, Cognito, KMS, EBS, AppSync, Athena, EventBridge, RAM, VPC, GuardDuty, and more |
| < 7.0 | App Runner, SQS, ELB, SNS, Amplify, Inspector, ACM, Network Firewall, WAF |

Some of these might surprise you. AWS Backup at 9.0, higher than Lambda. An attacker who gets into Backup can delete every recovery point in your account. Ransomware with no recovery path. CodeBuild at 9.0, one malicious buildspec exfiltrates every secret and poisons every artifact downstream.

A few things worth knowing

There are 20+ known privilege escalation paths through IAM alone. **_CreatePolicyVersion_**, **_PassRole_**, **_UpdateAssumeRolePolicy_**, **_AttachUserPolicy_**. Most AWS accounts have at least one of these unguarded.

Many persistence techniques don’t produce obvious CloudTrail signals. A Lambda layer with a backdoor, an ECR image with a modified entrypoint, a trust policy added to a role. Standard alerting won’t catch these unless you’re specifically looking.

CI/CD is the new perimeter. ECR, CodeBuild, and CodePipeline are supply chain components. Compromise one, and everything that deploys through it is tainted.

Formats

Each card ships in three formats, all generated from the same source:

Markdown : readable on GitHub, easy to search and contribute to
HTML: standalone dark-themed pages, works offline in any browser
PDF: print-ready, with embedded images and AWS service icons

Use cases

Print the PDFs for your next pentest. Use the enumeration commands during a security assessment. Hand the defense recommendations to your engineering team after an audit. Use the policy examples in a training session. Search the Markdown files when you need to quickly check a specific service.