{"repo":"zoph-io/aws-security-survival-kit","free":true,"listed":false,"github":"https://github.com/zoph-io/aws-security-survival-kit","clone":"git clone https://github.com/zoph-io/aws-security-survival-kit.git","description":"Bare minimum AWS Security Alerting and Secure by default Configuration","language":"Makefile","stars":522,"topics":["alerting","aws","observability","security"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"🚑 AWS Security Survival Kit The smallest possible AWS account monitoring kit. Two CloudFormation stacks, 30 EventBridge rules, an SNS topic. You get an email (or Slack / Teams via AWS Chatbot) the moment something interesting happens in your account. Free or near-free, no agents, no extra accounts, no SaaS. Why this exists AWS gives you excellent logging (CloudTrail, VPC Flow Logs, Config) but very few alerts. GuardDuty covers a narrow slice (threat intel, anomaly detection on a few services). It does not tell you when: - The root account just logged in. - Someone disabled CloudTrail, deleted a KMS key, or stopped your GuardDuty detector. - A new IAM user was created, or AdministratorAccess was attached to a role. - A security group was opened on port 22 to 0.0.0.0/0 . - A snapshot or AMI was shared with another AWS account. - A flood of AccessDenied errors is happening (enumeration, misconfigured workload, compromised credential probing). - Your own monitoring stack just got deleted. ASSK is the minimum so that \"I would notice within minutes if something obviously bad happens\" is true for your AWS account. It complements GuardDuty. It is not a SIEM, a SOAR, or a full detection engineering practice. Quick start 1. Edit the variables at the top of the Makefile ( AlarmRecipient , Project , LocalAWSRegion , CTLogGroupName ). 2. Deploy: make deploy does three things, in order: 1. Hardens the account (S3 Block Public Access, EBS encryption, public AMI / snapshot block, IMDSv2 def","default_branch":null,"files":null,"tree":[],"storefront":"/r/zoph-io","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/zoph-io/aws-security-survival-kit/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}