cloud/security

A field guide to cloud security. Common misconfigurations, tools, and copy-paste-ready commands for AWS, Azure, and GCP.

Live: zhameersheraz-cloud-security.vercel.app

Why

Cloud security documentation tends to be either a 900-page vendor PDF or a twitter thread. This is the middle ground: the misconfigurations that actually show up in audits, bug bounty recon, labs and CTFs, and the exact commands for checking them.

Not exhaustive. Deliberately not. It is the subset that keeps coming up.

What's inside

Each provider page has the same three sections.

Page	Covers
index.html	Landing page and orientation
aws.html	IAM wildcards, public S3, open security groups, IMDSv1, CloudTrail gaps
azure.html	Storage account public blob access, Azure AD over-privileged apps, 0.0.0.0/0 NSG inbound, Key Vault broad access policies
gcp.html	Public GCS buckets, user-managed service account keys, broad IAM bindings (roles/owner, roles/editor)
tools.html	Curated tool directory across all three clouds

AWS

Misconfigurations such as public S3 buckets, iam:* wildcards, 0.0.0.0/0 security groups and EC2 IMDSv1, then the tools that find them (pacu, prowler, scoutsuite), then aws CLI snippets with a copy button.

Tools

A single directory of open-source scanners, offensive frameworks and cloud auditing tools, grouped by what they are for rather than by vendor.

Run locally

The whole site is static HTML, CSS and one JavaScript file. No build step, no dependencies, no framework.

git clone https://github.com/zhameersheraz/cloud-security.git
cd cloud-security
python3 -m http.server 8000

Then open http://localhost:8000.

Or with Node:

npx serve .

Deployment

Because it is pure static HTML it deploys anywhere. Two one-click options:

• Vercel (what this is currently on) - import the repo at vercel.com/new, no configuration needed.
• GitHub Pages - repo Settings -> Pages -> Source: main / root.

Every push to main redeploys.

Project structure

cloud-security/
├── index.html      # landing
├── aws.html        # AWS cheatsheet
├── azure.html      # Azure cheatsheet
├── gcp.html        # GCP cheatsheet
├── tools.html      # tool directory
├── styles.css      # shared theme
├── script.js       # mobile menu, copy-to-clipboard, scroll reveals
├── docs/           # screenshots used by this README
├── package.json    # for Vercel
└── vercel.json     # Vercel config

Contributing

Found a misconfiguration that is missing, or a tool that has moved? Edit the relevant HTML file and open a PR. There is no build step, so a change is just a refresh.

Two things worth knowing before you send one:

• Keep the three-section structure per page, it is what makes the pages scannable.
• If you change a tool link, check it still resolves. Repositories get renamed and deleted more often than cheatsheets get updated.

Disclaimer

This is a learning resource. It is not a replacement for paid CSPM tooling or hands-on labs, and it is not a substitute for reading vendor documentation. Always validate a finding manually before acting on it or reporting it.

Author

Zhameer Sheraz Tampugao - @zhameersheraz

License

MIT - see LICENSE.