ine-labs/AWSGoat

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

2044 stars · 1554 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

AWSGoat is a deliberately vulnerable AWS infrastructure deployed via Terraform, featuring OWASP Top 10 web vulnerabilities and cloud misconfigurations across IAM, S3, Lambda, EC2, and ECS. It is designed as a hands-on training environment for learning cloud penetration testing, IaC auditing, secure coding, and detection/mitigation.

Use cases

• practice cloud pentesting on a realistic AWS environment
• learn IAM privilege escalation techniques
• train red teaming in cloud infrastructure
• audit infrastructure-as-code for misconfigurations
• learn to detect and mitigate cloud attacks
• practice exploiting S3 misconfigurations and SSRF
• learn secure coding against OWASP Top 10 risks

When to choose

• you want a vulnerable-by-design AWS lab for cloud security training
• you need realistic scenarios for IAM, S3, Lambda, and ECS attacks
• you want to practice black-box cloud pentesting with multiple escalation paths
• you are preparing for cloud security certifications or red team work

When to avoid

• you need a production-ready or secure infrastructure template
• you cannot or do not want to deploy resources in a real AWS account
• you are looking for an automated vulnerability scanner rather than a hands-on lab
• you need a free local environment without cloud costs

Facets

application · maturity active

security penetration-testing infrastructure-as-code web-framework security penetration-testing cloud-computing education cloud vulnerable-by-design aws cloud-security pentesting-lab owasp-top-10 terraform red-team security-training devops docker web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ine-labs/AWSGoat")