Security & isolation

You are running real offensive tooling on real hosts, so containment is the product, not an afterthought. Every range is built to be dangerous inside and inert outside.

Default-deny egress

Every lab security group drops allow-all egress. A box can reach DNS, HTTP/HTTPS (to pull packages and images) and other hosts in its own lab, and nothing else. That lets the range function while a compromised box cannot beacon out on arbitrary ports, no C2 client, no exfil, no mining.

Per-lab firewall & tenant isolation

Each range gets its own security group in its own VPC, so labs are isolated from each other and from everything else. You control ingress from the lab card: add a rule (TCP/UDP, port, CIDR) to expose a listener, defaulting to your own IP. Opening 0.0.0.0/0 is a deliberate, warned choice, and the gateway rule is locked.

Detection & hard limits

• GuardDuty is enabled for mining, C2, and recon detection.
• A volumetric-egress hard stop terminates a lab that pushes abnormal traffic past an idle grace, covering DDoS-relay and mass-exfil abuse.
• Ingress rules are capped, and world-open rules are tagged so they are easy to spot.

Access & audit

Every API call validates a Cognito token. Workspaces are isolated by default, an organization is opt-in, its members share nothing with anyone outside it, and roles (owner, admin, operator, viewer) gate what each member can do. Org actions, member changes, lab launches, billing comps, are written to an append-only audit log.

Buckets are fully public-access-blocked and served only through CloudFront; both surfaces carry a strict CSP, HSTS, and the usual hardening headers. The platform is pen-tested against OWASP-style access-control, injection, SSRF, and payment-integrity attacks.