Fire drills for your AWS security
cloud-firedrill runs real attack techniques in a sandbox account and proves that GuardDuty, your alerts and your guardrails actually work. Then it keeps proving it on every run.
Prove it, don't assume it
Posture scanners tell you what is misconfigured. cloud-firedrill tells you what happens when someone actually attacks.
| Question | How cloud-firedrill answers it |
|---|---|
| Does a detection fire? | Detonates the technique, then polls GuardDuty, Security Hub or your SIEM |
| Does the alert reach a human? | Watches a canary queue on your alert topic and measures time to notify |
| Do my SCPs and RCPs really block it? | Runs the attack step and passes only when it is denied |
| Do harmless actions stay quiet? | Runs benign twins that must not alert |
| Did anything break since last week? | Compares with previous runs and fails on regressions |
Ten minutes to your first result
cloud-firedrill is in alpha and the repository goes public soon. These are the commands you'll run.
pipx install cloud-firedrill # 1. See what would run, without touching AWS firedrill plan starter # 2. Run it in your sandbox firedrill run starter \ --expected-account 111111111111 --confirm # 3. Read the results firedrill report results.json
Run it only in a dedicated sandbox account, never in production.
$ firedrill run starter --expected-account 111111111111 --confirm DETECTED aws.defense-evasion.cloudtrail-stop@us-east-1 LOGGED aws.persistence.iam-backdoor-user@us-east-1 LOGGED aws.exfiltration.ec2-share-ebs-snapshot@us-east-1 PREVENTED custom:s3-ssec-write@us-east-1
One technique plus what you expect to happen
A scenario is plain YAML. It names an attack technique, the regions to run it in, and the evidence that must appear afterwards. Three sets ship with the package and run by name: starter (no setup needed), guardduty-gaps and prevention. Pass a path to run your own file.
- name: Exfiltrate an EBS snapshot by sharing it
technique: aws.exfiltration.ec2-share-ebs-snapshot
regions: [us-east-1, eu-west-1] # attackers pick the region, not you
timeout: 20m
expect:
- type: securityhub
title: EBS snapshot shared with another account
- type: notification
contains: EBS snapshot shared | Expectation | Passes when |
|---|---|
guardduty | A GuardDuty finding of the given type appears |
securityhub | A Security Hub finding with the given title (and resource) appears |
notification | The alert reaches your alert topic's canary queue |
command | Your own script exits 0 (use it to query any SIEM) |
cloudtrail | The call was at least logged |
prevented | The attack step was denied by a guardrail |
no_alert | Nothing fires for a benign action |
It performs attacks, so it is careful by default
Named account only
Refuses to run unless the credentials belong to the account you pass in --expected-account.
Plan first
Shows exactly what it will do and does nothing without --confirm.
Production refusal
Refuses accounts whose alias looks like production.
Always cleans up
Cleanup runs even after failures, and a sweeper removes anything left behind.
Zero telemetry
Results stay on your machine or in your own S3 bucket.
Closing the gaps
A Terraform sandbox stack sets up GuardDuty with S3 Protection, Security Hub, CloudTrail, an alert path with a canary queue, results history, and custom detections for techniques GuardDuty missed in published tests: backdoor access keys, external role trust, shared snapshots, external bucket policies and Bedrock model-access probes. A second stack holds the SCP and RCP that prevention.yaml tests.
CI and plugins
GitHub Actions and GitLab CI examples use OIDC, so no long-lived AWS keys sit in your CI system. Reports come out as Markdown for people and JUnit or JSON for pipelines. Checks, techniques and providers are plugins, so you can add your own SIEM or technique. AWS is first; Kubernetes/EKS is next on the roadmap.
Where cloud-firedrill fits
| Tool | Answers | Doesn't answer |
|---|---|---|
| Prowler and other posture scanners | What is misconfigured right now | Whether a real attack would be detected, alerted or blocked |
| Stratus Red Team | A library of attack techniques to detonate | Whether anything noticed. cloud-firedrill uses Stratus techniques and adds the checks |
| Threatest | Detection tests for Datadog alerts | AWS-native detections without Datadog; not developed since December 2023 |
Found a MISSED you'd rather not fix alone?
We set up the detections, alert routing and guardrails, then prove them with a fire drill.