PageSourceSearch

https://ekssecurity.netlify.app/basics/lab_deploy_sample_app

html ekssecurity.netlify.app collected 2026-10-03 10:41:18 UTC 21,492 bytes, 358 lines download raw bytes

1<!DOCTYPE HTML>
2<html lang="en" class="sidebar-visible no-js light">
3    <head>
4        <!-- Book generated using mdBook -->
5        <meta charset="UTF-8">
6<!-- This site is hosted on Netlify. Anyone can build and deploy a site
7     like this one for free: https://netlify.new/?utm_campaign=loops&utm_source=ai-legible&utm_medium=owned&utm_content=comment&utm_id=ecd49ac0-53d7-4a9c-9709-74d5753720c3
8     Netlify hosting facts for this site: static/SSR served via Netlify Edge. -->
9        <title>Lab: Deploying a Vulnerable AWS EKS Infra - OWASP EKS Goat: AWS EKS Security Masterclass Guide</title>
10        
11
12        <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
13        <meta name="description" content="Step-by-step AWS EKS security walkthrough using OWASP EKS Goat — from vulnerable cluster deployment to exploitation and defense with tools like Kyverno, GuardDuty, and eBPF Tetragon.">
14        <meta name="viewport" content="width=device-width, initial-scale=1">
15        <meta name="theme-color" content="#ffffff" />
16
17        <link rel="shortcut icon" href="../favicon.png">
18        <link rel="stylesheet" href="../css/variables.css">
19        <link rel="stylesheet" href="../css/general.css">
20        <link rel="stylesheet" href="../css/chrome.css">
21        <link rel="stylesheet" href="../css/print.css" media="print">
22
23        <!-- Fonts -->
24        <link rel="stylesheet" href="../FontAwesome/css/font-awesome.css">
25        <link href="https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800" rel="stylesheet" type="text/css">
26        <link href="https://fonts.googleapis.com/css?family=Source+Code+Pro:500" rel="stylesheet" type="text/css">
27
28        <!-- Highlight.js Stylesheets -->
29        <link rel="stylesheet" href="../highlight.css">
30        <link rel="stylesheet" href="../tomorrow-night.css">
31        <link rel="stylesheet" href="../ayu-highlight.css">
32
33        <!-- Custom theme stylesheets -->
34        
35        <link rel="stylesheet" href="../disable_text_selection.css">
36        
37
38        
39    </head>
40    <body>
41        <!-- Provide site root to javascript -->
42        
42<script type="text/javascript">
43            var path_to_root = "../";
44            var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "light" : "light";
45        </script>
45
46
47        <!-- Work around some values being stored in localStorage wrapped in quotes -->
48        
48<script type="text/javascript">
49            try {
50                var theme = localStorage.getItem('mdbook-theme');
51                var sidebar = localStorage.getItem('mdbook-sidebar');
52
53                if (theme.startsWith('"') && theme.endsWith('"')) {
54                    localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
55                }
56
57                if (sidebar.startsWith('"') && sidebar.endsWith('"')) {
58                    localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
59                }
60            } catch (e) { }
61        </script>
61
62
63        <!-- Set the theme before any content is loaded, prevents flash -->
64        
64<script type="text/javascript">
65            var theme;
66            try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
67            if (theme === null || theme === undefined) { theme = default_theme; }
68            var html = document.querySelector('html');
69            html.classList.remove('no-js')
70            html.classList.remove('light')
71            html.classList.add(theme);
72            html.classList.add('js');
73        </script>
73
74
75        <!-- Hide / unhide sidebar before it is displayed -->
76        
76<script type="text/javascript">
77            var html = document.querySelector('html');
78            var sidebar = 'hidden';
79            if (document.body.clientWidth >= 1080) {
80                try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
81                sidebar = sidebar || 'visible';
82            }
83            html.classList.remove('sidebar-visible');
84            html.classList.add("sidebar-" + sidebar);
85        </script>
85
86
87        <nav id="sidebar" class="sidebar" aria-label="Table of contents">
88            <div id="sidebar-scrollbox" class="sidebar-scrollbox">
89                <ol class="chapter"><li class="expanded "><a href='/welcome/'><strong aria-hidden="true">1.</strong> Welcome</a></li><li><ol class="section"><li class="expanded "><a href='/welcome/introduction'><strong aria-hidden="true">1.1.</strong> Introduction</a></li><li class="expanded "><a href='/welcome/agenda'><strong aria-hidden="true">1.2.</strong> Agenda</a></li><li class="expanded "><a href='/prerequisites/'><strong aria-hidden="true">1.3.</strong> Prerequisites</a></li></ol></li><li class="expanded "><a href='/basics/'><strong aria-hidden="true">2.</strong> Github Codespace Setup </a></li><li><ol class="section"><li class="expanded "><a href='/basics/lab_setup'><strong aria-hidden="true">2.1.</strong> Lab Environment Setup</a></li><li><ol class="section"><li class="expanded "><a href='/basics/setup_iam_user'><strong aria-hidden="true">2.1.1.</strong> Setup AWS IAM User</a></li><li class="expanded "><a href='/basics/gh_deploy'><strong aria-hidden="true">2.1.2.</strong> Setup Github Codespace</a></li></ol></li></ol></li><li class="expanded "><a href='/basics/basics_of_docker'><strong aria-hidden="true">3.</strong> Introduction to Docker</a></li><li><ol class="section"><li class="expanded "><a href='/basics/container_security'><strong aria-hidden="true">3.1.</strong> Container Security Overview</a></li><li><ol class="section"><li class="expanded "><a href='/basics/docker_working'><strong aria-hidden="true">3.1.1.</strong> Lab: Docker Working</a></li><li class="expanded "><a href='/basics/docker_namespaces_and_cgroups'><strong aria-hidden="true">3.1.2.</strong> Docker Namespaces and Control Groups (CGroups)</a></li><li class="expanded "><a href='/basics/docker_images_and_layers'><strong aria-hidden="true">3.1.3.</strong> Understanding Docker Images and Layers</a></li><li class="expanded "><a href='/basics/docker_secrets_and_inspection'><strong aria-hidden="true">3.1.4.</strong> Docker Secrets</a></li></ol></li><li class="expanded "><a href='/basics/sast_for_docker'><strong aria-hidden="true">3.2.</strong> Static Analysis of Docker Containers (SAST)</a></li><li><ol class="section"><li class="expanded "><a href='/basics/dockle_and_hadolint'><strong aria-hidden="true">3.2.1.</strong> Using Dockle and Hadolint</a></li><li class="expanded "><a href='/basics/docker_bench_security'><strong aria-hidden="true">3.2.2.</strong> Audits with AquaSecurity Docker Bench Security</a></li></ol></li></ol></li><li class="expanded "><a href='/basics/aws_ecr_overview'><strong aria-hidden="true">4.</strong> AWS Elastic Container Registry (ECR) Overview</a></li><li><ol class="section"><li class="expanded "><a href='/basics/lab_image_scanning'><strong aria-hidden="true">4.1.</strong> AWS ECR Image Scanning</a></li><li class="expanded "><a href='/basics/lab_securing_ecr'><strong aria-hidden="true">4.2.</strong> AWS ECR Immutable Image Tag</a></li></ol></li><li class="expanded "><a href='/basics/eks'><strong aria-hidden="true">5.</strong> AWS EKS Fundamentals</a></li><li><ol class="section"><li class="expanded "><a class='active' href='/basics/lab_deploy_sample_app'><strong aria-hidden="true">5.1.</strong> Lab: Deploying a Vulnerable AWS EKS Infra</a></li><li><ol class="section"><li class="expanded "><a href='/basics/k8s'><strong aria-hidden="true">5.1.1.</strong> Kubernetes Architecture</a></li><li class="expanded "><a href='/basics/eks_terminologies'><strong aria-hidden="true">5.1.2.</strong> AWS EKS Terminologies</a></li><li class="expanded "><a href='/basics/eks_access_management'><strong aria-hidden="true">5.1.3.</strong> EKS Authentication &amp; Authorisation</a></li></ol></li><li class="expanded "><a href='/basics/lab_exploit_app'><strong aria-hidden="true">5.2.</strong> Lab: Exploiting the Sample Application</a></li><li><ol class="section"><li class="expanded "><a href='/basics/lab_exploit_app_1'><strong aria-hidden="true">5.2.1.</strong> Lab: Enumerate &amp; exploit web application for vulnerablility</a></li><li class="expanded "><a href='/basics/lab_postexploit_app_1'><strong aria-hidden="true">5.2.2.</strong> Lab: Using IMDSv2 to exfiltrate Credentials</a></li><li class="expanded "><a href='/basics/lab_exploit_app_3'><strong aria-hidden="true">5.2.3.</strong> Lab: Enumerate ECR repositories using credentials</a></li><li class="expanded "><a href='/basics/lab_exploit_app_4'><strong aria-hidden="true">5.2.4.</strong> Lab: Backdooring a Docker Image</a></li><li class="expanded "><a href='/basics/lab_exploit_app_5'><strong aria-hidden="true">5.2.5.</strong> Lab: Exploiting AWS EKS Cluster</a></li><li class="expanded "><a href='/basics/labx_exploit_app_6'><strong aria-hidden="true">5.2.6.</strong> Lab: Breaking Out from Pod to Node</a></li><li class="expanded "><a href='/basics/lab_exploit_app_7'><strong aria-hidden="true">5.2.7.</strong> Lab: Privilege Escalation &amp; S3 Exploitation</a></li><li class="expanded "><a href='/basics/lab_exploit_app_8'><strong aria-hidden="true">5.2.8.</strong> Lab: Cleanup EC2 Instance</a></li></ol></li></ol></li><li class="expanded "><a href='/basics/kubernetes_security_scanning'><strong aria-hidden="true">6.</strong> Automated Scanning in EKS</a></li><li><ol class="section"><li class="expanded "><a href='/basics/kubescape'><strong aria-hidden="true">6.1.</strong> Scanning using Kubescape</a></li><li class="expanded "><a href='/basics/kubebench'><strong aria-hidden="true">6.2.</strong> Scanning using Kubebench</a></li></ol></li><li class="expanded "><a href='/basics/defensive_security_in_eks'><strong aria-hidden="true">7.</strong> Defense &amp; Hardening in EKS</a></li><li><ol class="section"><li class="expanded "><a href='/basics/aws_guardduty'><strong aria-hidden="true">7.1.</strong> AWS GuardDuty for Threat Detection</a></li></ol></li><li class="expanded "><a href='/basics/destroy'><strong aria-hidden="true">8.</strong> Lab: Destroy EKS Vulnerable Infra</a></li><li class="expanded "><a href='/closing/thank-you'><strong aria-hidden="true">9.</strong> Thank you</a></li></ol>
90            </div>
91            <div id="sidebar-resize-handle" class="sidebar-resize-handle"></div>
92        </nav>
93
94        <div id="page-wrapper" class="page-wrapper">
95
96            <div class="page">
97                
98                <div id="menu-bar" class="menu-bar">
99                    <div id="menu-bar-sticky-container">
100                        <div class="left-buttons">
101                            <button id="sidebar-toggle" class="icon-button" type="button" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar">
102                                <i class="fa fa-bars"></i>
103                            </button>
104                            <button id="theme-toggle" class="icon-button" type="button" title="Change theme" aria-label="Change theme" aria-haspopup="true" aria-expanded="false" aria-controls="theme-list">
105                                <i class="fa fa-paint-brush"></i>
106                            </button>
107                            <ul id="theme-list" class="theme-popup" aria-label="Themes" role="menu">
108                                <li role="none"><button role="menuitem" class="theme" id="light">Light (default)</button></li>
109                                <li role="none"><button role="menuitem" class="theme" id="rust">Rust</button></li>
110                                <li role="none"><button role="menuitem" class="theme" id="coal">Coal</button></li>
111                                <li role="none"><button role="menuitem" class="theme" id="navy">Navy</button></li>
112                                <li role="none"><button role="menuitem" class="theme" id="ayu">Ayu</button></li>
113                            </ul>
114                            
115                            <button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar">
116                                <i class="fa fa-search"></i>
117                            </button>
118                            
119                        </div>
120
121                        <h1 class="menu-title">OWASP EKS Goat: AWS EKS Security Masterclass Guide</h1>
122
123                        <div class="right-buttons">
124                            <a aria-label='Print this book' href='/print' title='Print this book'>
125                                <i id="print-button" class="fa fa-print"></i>
126                            </a>
127                            
128                        </div>
129                    </div>
130                </div>
131
132                
133                <div id="search-wrapper" class="hidden">
134                    <form id="searchbar-outer" class="searchbar-outer">
135                        <input type="search" name="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header">
136                    </form>
137                    <div id="searchresults-outer" class="searchresults-outer hidden">
138                        <div id="searchresults-header" class="searchresults-header"></div>
139                        <ul id="searchresults">
140                        </ul>
141                    </div>
142                </div>
143                
144
145                <!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM -->
146                
146<script type="text/javascript">
147                    document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
148                    document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
149                    Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
150                        link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
151                    });
152                </script>
152
153
154                <div id="content" class="content">
155                    <main>
156                        <h1><a class="header" href="#lab-deploying-a-vulnerable-aws-eks-infrastructure" id="lab-deploying-a-vulnerable-aws-eks-infrastructure">Lab: Deploying a Vulnerable AWS EKS Infrastructure</a></h1>
157<p>In this lab, deploy a vulnerable AWS EKS infrastructure. The following steps will guide through setting up the infrastructure using bash script.</p>
158<h2><a class="header" href="#step-by-step-guide" id="step-by-step-guide">Step-by-Step Guide</a></h2>
159<ul>
160<li>Navigate to the EKS Directory:</li>
161</ul>
162<pre><code>cd /workspaces/www-project-eks-goat/eks/
163</code></pre>
164<blockquote>
165<p>Ensure you have administrative privileges by configuring the AWS CLI using <code> aws configure</code> with your access and secret keys.</p>
166</blockquote>
167<ul>
168<li>
169<p>Input the following information:</p>
170<ul>
171<li>AWS Access Key ID</li>
172<li>AWS Secret Access Key</li>
173<li>Default region name (set to us-west-2 or us-east-1 based on your region)</li>
174<li>Default output format (choose json)</li>
175</ul>
176</li>
177<li>
178<p>Validate AWS Administrative Privileges:</p>
179<ul>
180<li>Use the AWS STS (Security Token Service) to verify your identity and ensure you have the necessary permissions.</li>
181</ul>
182<pre><code class="language-bash">aws sts get-caller-identity
183</code></pre>
184<p><img src="image-78.png" alt="alt text" /></p>
185</li>
186</ul>
187<blockquote>
188<p>Ensure that AWS CLI is properly configured and have administrative privileges to deploy EKS clusters.</p>
189</blockquote>
190<ul>
191<li>
192<p>Run the Deployment Script:</p>
193<ul>
194<li>Deploy the vulnerable EKS infrastructure by running the deploy.sh script. You can specify a region using the --region flag. If no region is specified, it will default to us-west-2.</li>
195</ul>
196<pre><code class="language-bash">bash deploy.sh --region us-west-2
197</code></pre>
198<p><img src="image-20.png" alt="alt text" /></p>
199<blockquote>
200<p>Select a different region, replace us-west-2 with the desired region like us-east-1. Currently us-east-1 &amp; us-west-2 are supported.</p>
201</blockquote>
202</li>
203<li>
204<p>Confirmation Prompt:</p>
205<ul>
206<li>Receive a confirmation prompt: </li>
207</ul>
208<pre><code class="language-bash">Do you want to continue with the deployment? (Y/N)
209</code></pre>
210<ul>
211<li>Type Y to proceed with the deployment.</li>
212</ul>
213<p><img src="image-21.png" alt="alt text" /></p>
214</li>
215<li>
216<p>Deployment Process:</p>
217<ul>
218<li>The deployment process may take up to 15 minutes as it provisions the EKS cluster and associated resources.</li>
219</ul>
220<p><img src="image-22.png" alt="alt text" /></p>
221</li>
222<li>
223<p>Final Output:</p>
224<ul>
225<li>After the deployment is complete, review the summary of the deployment, along with command  for accessing the deployed EKS cluster.</li>
226</ul>
227<p><img src="image-34.png" alt="alt text" /></p>
228</li>
229<li>
230<p>Access the Vulnerable Application:</p>
231<ul>
232<li>After the deployment, you can access the vulnerable application via the public IP of the EC2 instance:
233<pre><code class="language-bash">echo &quot;Access the application at: http://$(jq -r '.instance_public_ip.value' &lt; ec2_output.json)&quot;
234</code></pre>
235</li>
236</ul>
237</li>
238<li>
239<p>Configure the EKS Cluster.</p>
240<pre><code class="language-bash">echo &quot;Authenticate to EKS cluster via: aws eks update-kubeconfig --region $(grep 'ECR Repository URL' deployment_output.txt | awk -F'.' '{print $4}') --name $(grep 'EKS Cluster Name' deployment_output.txt | awk '{print $4}')&quot;
241
242</code></pre>
243<p><img src="image-35.png" alt="alt text" /></p>
244</li>
245</ul>
246<h4><a class="header" href="#optional" id="optional">Optional</a></h4>
247<ul>
248<li>To update the cni to v1.21.1, modify deploy.sh.</li>
249</ul>
250<pre><code class="language-bash">cat &lt;&lt;EOF &gt; eks-cluster-config.yaml
251apiVersion: eksctl.io/v1alpha5
252kind: ClusterConfig
253
254metadata:
255  name: ${EKS_CLUSTER_NAME}
256  region: ${REGION}
257
258vpc:
259  clusterEndpoints:
260    publicAccess: true
261    privateAccess: false
262
263upgradePolicy: 
264  supportType: STANDARD
265
266addons:
267  - name: vpc-cni
268    version: v1.21.1-eksbuild.1
269    configurationValues: |-
270      enableNetworkPolicy: &quot;true&quot;
271
272managedNodeGroups:
273  - name: standard-workers
274    instanceType: t3.small
275    desiredCapacity: 2
276    minSize: 2
277    maxSize: 4
278    amiFamily: AmazonLinux2
279    iam:
280      instanceRoleARN: arn:aws:iam::${AWS_ACCOUNT_ID}:role/${EKS_ROLE_NAME}
281EOF
282</code></pre>
283<h3><a class="header" href="#refer-to-this-video-for-detailed-walkthrough" id="refer-to-this-video-for-detailed-walkthrough">Refer to this video for detailed walkthrough</a></h3>
284<!-- Embed YouTube Video in mdbook Markdown -->
285<div align="center">
286  <iframe width="600" height="315" src="https://www.youtube.com/embed/SHZEgsgqWHk" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
287</div>
288
289                    </main>
290
291                    <nav class="nav-wrapper" aria-label="Page navigation">
292                        <!-- Mobile navigation buttons -->
293                        
294                            <a aria-keyshortcuts='Left' aria-label='Previous chapter' class='mobile-nav-chapters previous' href='/basics/eks' rel='prev' title='Previous chapter'>
295                                <i class="fa fa-angle-left"></i>
296                            </a>
297                        
298
299                        
300                            <a aria-keyshortcuts='Right' aria-label='Next chapter' class='mobile-nav-chapters next' href='/basics/k8s' rel='next' title='Next chapter'>
301                                <i class="fa fa-angle-right"></i>
302                            </a>
303                        
304
305                        <div style="clear: both"></div>
306                    </nav>
307                </div>
308            </div>
309
310            <nav class="nav-wide-wrapper" aria-label="Page navigation">
311                
312                    <a aria-keyshortcuts='Left' aria-label='Previous chapter' class='nav-chapters previous' href='/basics/eks' title='Previous chapter'>
313                        <i class="fa fa-angle-left"></i>
314                    </a>
315                
316
317                
318                    <a aria-keyshortcuts='Right' aria-label='Next chapter' class='nav-chapters next' href='/basics/k8s' title='Next chapter'>
319                        <i class="fa fa-angle-right"></i>
320                    </a>
321                
322            </nav>
323
324        </div>
325
326        
327
328        
329
330        
331        
332        
333        
333<script type="text/javascript">
334            window.playpen_copyable = true;
335        </script>
335
336        
337
338        
339
340        
341        
341<script src="../elasticlunr.min.js" type="text/javascript" charset="utf-8"></script>
341
342        
342<script src="../mark.min.js" type="text/javascript" charset="utf-8"></script>
342
343        
343<script src="../searcher.js" type="text/javascript" charset="utf-8"></script>
343
344        
345
346        
346<script src="../clipboard.min.js" type="text/javascript" charset="utf-8"></script>
346
347        
347<script src="../highlight.js" type="text/javascript" charset="utf-8"></script>
347
348        
348<script src="../book.js" type="text/javascript" charset="utf-8"></script>
348
349
350        <!-- Custom JS scripts -->
351        
352        
352<script type="text/javascript" src="../disable_print_snapshot.js"></script>
352
353        
354
355        
356
357    </body>
358</html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.