1<!DOCTYPE HTML> 2<html lang="en" class="sidebar-visible no-js light"> 3 <head> 4 <!-- Book generated using mdBook --> 5 <meta charset="UTF-8"> 6<!-- This site is hosted on Netlify. Anyone can build and deploy a site 7 like this one for free: https://netlify.new/?utm_campaign=loops&utm_source=ai-legible&utm_medium=owned&utm_content=comment&utm_id=ecd49ac0-53d7-4a9c-9709-74d5753720c3 8 Netlify hosting facts for this site: static/SSR served via Netlify Edge. --> 9 <title>Lab: Deploying a Vulnerable AWS EKS Infra - OWASP EKS Goat: AWS EKS Security Masterclass Guide</title> 10 11 12 <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> 13 <meta name="description" content="Step-by-step AWS EKS security walkthrough using OWASP EKS Goat â from vulnerable cluster deployment to exploitation and defense with tools like Kyverno, GuardDuty, and eBPF Tetragon."> 14 <meta name="viewport" content="width=device-width, initial-scale=1"> 15 <meta name="theme-color" content="#ffffff" /> 16 17 <link rel="shortcut icon" href="../favicon.png"> 18 <link rel="stylesheet" href="../css/variables.css"> 19 <link rel="stylesheet" href="../css/general.css"> 20 <link rel="stylesheet" href="../css/chrome.css"> 21 <link rel="stylesheet" href="../css/print.css" media="print"> 22 23 <!-- Fonts --> 24 <link rel="stylesheet" href="../FontAwesome/css/font-awesome.css"> 25 <link href="https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800" rel="stylesheet" type="text/css"> 26 <link href="https://fonts.googleapis.com/css?family=Source+Code+Pro:500" rel="stylesheet" type="text/css"> 27 28 <!-- Highlight.js Stylesheets --> 29 <link rel="stylesheet" href="../highlight.css"> 30 <link rel="stylesheet" href="../tomorrow-night.css"> 31 <link rel="stylesheet" href="../ayu-highlight.css"> 32 33 <!-- Custom theme stylesheets --> 34 35 <link rel="stylesheet" href="../disable_text_selection.css"> 36 37 38 39 </head> 40 <body> 41 <!-- Provide site root to javascript --> 42
42<script type="text/javascript"> 43 var path_to_root = "../"; 44 var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "light" : "light"; 45 </script>
45 46 47 <!-- Work around some values being stored in localStorage wrapped in quotes --> 48
48<script type="text/javascript"> 49 try { 50 var theme = localStorage.getItem('mdbook-theme'); 51 var sidebar = localStorage.getItem('mdbook-sidebar'); 52 53 if (theme.startsWith('"') && theme.endsWith('"')) { 54 localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1)); 55 } 56 57 if (sidebar.startsWith('"') && sidebar.endsWith('"')) { 58 localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1)); 59 } 60 } catch (e) { } 61 </script>
61 62 63 <!-- Set the theme before any content is loaded, prevents flash --> 64
64<script type="text/javascript"> 65 var theme; 66 try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { } 67 if (theme === null || theme === undefined) { theme = default_theme; } 68 var html = document.querySelector('html'); 69 html.classList.remove('no-js') 70 html.classList.remove('light') 71 html.classList.add(theme); 72 html.classList.add('js'); 73 </script>
73 74 75 <!-- Hide / unhide sidebar before it is displayed --> 76
76<script type="text/javascript"> 77 var html = document.querySelector('html'); 78 var sidebar = 'hidden'; 79 if (document.body.clientWidth >= 1080) { 80 try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { } 81 sidebar = sidebar || 'visible'; 82 } 83 html.classList.remove('sidebar-visible'); 84 html.classList.add("sidebar-" + sidebar); 85 </script>
85 86 87 <nav id="sidebar" class="sidebar" aria-label="Table of contents"> 88 <div id="sidebar-scrollbox" class="sidebar-scrollbox"> 89 <ol class="chapter"><li class="expanded "><a href='/welcome/'><strong aria-hidden="true">1.</strong> Welcome</a></li><li><ol class="section"><li class="expanded "><a href='/welcome/introduction'><strong aria-hidden="true">1.1.</strong> Introduction</a></li><li class="expanded "><a href='/welcome/agenda'><strong aria-hidden="true">1.2.</strong> Agenda</a></li><li class="expanded "><a href='/prerequisites/'><strong aria-hidden="true">1.3.</strong> Prerequisites</a></li></ol></li><li class="expanded "><a href='/basics/'><strong aria-hidden="true">2.</strong> Github Codespace Setup </a></li><li><ol class="section"><li class="expanded "><a href='/basics/lab_setup'><strong aria-hidden="true">2.1.</strong> Lab Environment Setup</a></li><li><ol class="section"><li class="expanded "><a href='/basics/setup_iam_user'><strong aria-hidden="true">2.1.1.</strong> Setup AWS IAM User</a></li><li class="expanded "><a href='/basics/gh_deploy'><strong aria-hidden="true">2.1.2.</strong> Setup Github Codespace</a></li></ol></li></ol></li><li class="expanded "><a href='/basics/basics_of_docker'><strong aria-hidden="true">3.</strong> Introduction to Docker</a></li><li><ol class="section"><li class="expanded "><a href='/basics/container_security'><strong aria-hidden="true">3.1.</strong> Container Security Overview</a></li><li><ol class="section"><li class="expanded "><a href='/basics/docker_working'><strong aria-hidden="true">3.1.1.</strong> Lab: Docker Working</a></li><li class="expanded "><a href='/basics/docker_namespaces_and_cgroups'><strong aria-hidden="true">3.1.2.</strong> Docker Namespaces and Control Groups (CGroups)</a></li><li class="expanded "><a href='/basics/docker_images_and_layers'><strong aria-hidden="true">3.1.3.</strong> Understanding Docker Images and Layers</a></li><li class="expanded "><a href='/basics/docker_secrets_and_inspection'><strong aria-hidden="true">3.1.4.</strong> Docker Secrets</a></li></ol></li><li class="expanded "><a href='/basics/sast_for_docker'><strong aria-hidden="true">3.2.</strong> Static Analysis of Docker Containers (SAST)</a></li><li><ol class="section"><li class="expanded "><a href='/basics/dockle_and_hadolint'><strong aria-hidden="true">3.2.1.</strong> Using Dockle and Hadolint</a></li><li class="expanded "><a href='/basics/docker_bench_security'><strong aria-hidden="true">3.2.2.</strong> Audits with AquaSecurity Docker Bench Security</a></li></ol></li></ol></li><li class="expanded "><a href='/basics/aws_ecr_overview'><strong aria-hidden="true">4.</strong> AWS Elastic Container Registry (ECR) Overview</a></li><li><ol class="section"><li class="expanded "><a href='/basics/lab_image_scanning'><strong aria-hidden="true">4.1.</strong> AWS ECR Image Scanning</a></li><li class="expanded "><a href='/basics/lab_securing_ecr'><strong aria-hidden="true">4.2.</strong> AWS ECR Immutable Image Tag</a></li></ol></li><li class="expanded "><a href='/basics/eks'><strong aria-hidden="true">5.</strong> AWS EKS Fundamentals</a></li><li><ol class="section"><li class="expanded "><a class='active' href='/basics/lab_deploy_sample_app'><strong aria-hidden="true">5.1.</strong> Lab: Deploying a Vulnerable AWS EKS Infra</a></li><li><ol class="section"><li class="expanded "><a href='/basics/k8s'><strong aria-hidden="true">5.1.1.</strong> Kubernetes Architecture</a></li><li class="expanded "><a href='/basics/eks_terminologies'><strong aria-hidden="true">5.1.2.</strong> AWS EKS Terminologies</a></li><li class="expanded "><a href='/basics/eks_access_management'><strong aria-hidden="true">5.1.3.</strong> EKS Authentication & Authorisation</a></li></ol></li><li class="expanded "><a href='/basics/lab_exploit_app'><strong aria-hidden="true">5.2.</strong> Lab: Exploiting the Sample Application</a></li><li><ol class="section"><li class="expanded "><a href='/basics/lab_exploit_app_1'><strong aria-hidden="true">5.2.1.</strong> Lab: Enumerate & exploit web application for vulnerablility</a></li><li class="expanded "><a href='/basics/lab_postexploit_app_1'><strong aria-hidden="true">5.2.2.</strong> Lab: Using IMDSv2 to exfiltrate Credentials</a></li><li class="expanded "><a href='/basics/lab_exploit_app_3'><strong aria-hidden="true">5.2.3.</strong> Lab: Enumerate ECR repositories using credentials</a></li><li class="expanded "><a href='/basics/lab_exploit_app_4'><strong aria-hidden="true">5.2.4.</strong> Lab: Backdooring a Docker Image</a></li><li class="expanded "><a href='/basics/lab_exploit_app_5'><strong aria-hidden="true">5.2.5.</strong> Lab: Exploiting AWS EKS Cluster</a></li><li class="expanded "><a href='/basics/labx_exploit_app_6'><strong aria-hidden="true">5.2.6.</strong> Lab: Breaking Out from Pod to Node</a></li><li class="expanded "><a href='/basics/lab_exploit_app_7'><strong aria-hidden="true">5.2.7.</strong> Lab: Privilege Escalation & S3 Exploitation</a></li><li class="expanded "><a href='/basics/lab_exploit_app_8'><strong aria-hidden="true">5.2.8.</strong> Lab: Cleanup EC2 Instance</a></li></ol></li></ol></li><li class="expanded "><a href='/basics/kubernetes_security_scanning'><strong aria-hidden="true">6.</strong> Automated Scanning in EKS</a></li><li><ol class="section"><li class="expanded "><a href='/basics/kubescape'><strong aria-hidden="true">6.1.</strong> Scanning using Kubescape</a></li><li class="expanded "><a href='/basics/kubebench'><strong aria-hidden="true">6.2.</strong> Scanning using Kubebench</a></li></ol></li><li class="expanded "><a href='/basics/defensive_security_in_eks'><strong aria-hidden="true">7.</strong> Defense & Hardening in EKS</a></li><li><ol class="section"><li class="expanded "><a href='/basics/aws_guardduty'><strong aria-hidden="true">7.1.</strong> AWS GuardDuty for Threat Detection</a></li></ol></li><li class="expanded "><a href='/basics/destroy'><strong aria-hidden="true">8.</strong> Lab: Destroy EKS Vulnerable Infra</a></li><li class="expanded "><a href='/closing/thank-you'><strong aria-hidden="true">9.</strong> Thank you</a></li></ol> 90 </div> 91 <div id="sidebar-resize-handle" class="sidebar-resize-handle"></div> 92 </nav> 93 94 <div id="page-wrapper" class="page-wrapper"> 95 96 <div class="page"> 97 98 <div id="menu-bar" class="menu-bar"> 99 <div id="menu-bar-sticky-container"> 100 <div class="left-buttons"> 101 <button id="sidebar-toggle" class="icon-button" type="button" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar"> 102 <i class="fa fa-bars"></i> 103 </button> 104 <button id="theme-toggle" class="icon-button" type="button" title="Change theme" aria-label="Change theme" aria-haspopup="true" aria-expanded="false" aria-controls="theme-list"> 105 <i class="fa fa-paint-brush"></i> 106 </button> 107 <ul id="theme-list" class="theme-popup" aria-label="Themes" role="menu"> 108 <li role="none"><button role="menuitem" class="theme" id="light">Light (default)</button></li> 109 <li role="none"><button role="menuitem" class="theme" id="rust">Rust</button></li> 110 <li role="none"><button role="menuitem" class="theme" id="coal">Coal</button></li> 111 <li role="none"><button role="menuitem" class="theme" id="navy">Navy</button></li> 112 <li role="none"><button role="menuitem" class="theme" id="ayu">Ayu</button></li> 113 </ul> 114 115 <button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar"> 116 <i class="fa fa-search"></i> 117 </button> 118 119 </div> 120 121 <h1 class="menu-title">OWASP EKS Goat: AWS EKS Security Masterclass Guide</h1> 122 123 <div class="right-buttons"> 124 <a aria-label='Print this book' href='/print' title='Print this book'> 125 <i id="print-button" class="fa fa-print"></i> 126 </a> 127 128 </div> 129 </div> 130 </div> 131 132 133 <div id="search-wrapper" class="hidden"> 134 <form id="searchbar-outer" class="searchbar-outer"> 135 <input type="search" name="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header"> 136 </form> 137 <div id="searchresults-outer" class="searchresults-outer hidden"> 138 <div id="searchresults-header" class="searchresults-header"></div> 139 <ul id="searchresults"> 140 </ul> 141 </div> 142 </div> 143 144 145 <!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM --> 146
146<script type="text/javascript"> 147 document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible'); 148 document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible'); 149 Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) { 150 link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1); 151 }); 152 </script>
152 153 154 <div id="content" class="content"> 155 <main> 156 <h1><a class="header" href="#lab-deploying-a-vulnerable-aws-eks-infrastructure" id="lab-deploying-a-vulnerable-aws-eks-infrastructure">Lab: Deploying a Vulnerable AWS EKS Infrastructure</a></h1> 157<p>In this lab, deploy a vulnerable AWS EKS infrastructure. The following steps will guide through setting up the infrastructure using bash script.</p> 158<h2><a class="header" href="#step-by-step-guide" id="step-by-step-guide">Step-by-Step Guide</a></h2> 159<ul> 160<li>Navigate to the EKS Directory:</li> 161</ul> 162<pre><code>cd /workspaces/www-project-eks-goat/eks/ 163</code></pre> 164<blockquote> 165<p>Ensure you have administrative privileges by configuring the AWS CLI using <code> aws configure</code> with your access and secret keys.</p> 166</blockquote> 167<ul> 168<li> 169<p>Input the following information:</p> 170<ul> 171<li>AWS Access Key ID</li> 172<li>AWS Secret Access Key</li> 173<li>Default region name (set to us-west-2 or us-east-1 based on your region)</li> 174<li>Default output format (choose json)</li> 175</ul> 176</li> 177<li> 178<p>Validate AWS Administrative Privileges:</p> 179<ul> 180<li>Use the AWS STS (Security Token Service) to verify your identity and ensure you have the necessary permissions.</li> 181</ul> 182<pre><code class="language-bash">aws sts get-caller-identity 183</code></pre> 184<p><img src="image-78.png" alt="alt text" /></p> 185</li> 186</ul> 187<blockquote> 188<p>Ensure that AWS CLI is properly configured and have administrative privileges to deploy EKS clusters.</p> 189</blockquote> 190<ul> 191<li> 192<p>Run the Deployment Script:</p> 193<ul> 194<li>Deploy the vulnerable EKS infrastructure by running the deploy.sh script. You can specify a region using the --region flag. If no region is specified, it will default to us-west-2.</li> 195</ul> 196<pre><code class="language-bash">bash deploy.sh --region us-west-2 197</code></pre> 198<p><img src="image-20.png" alt="alt text" /></p> 199<blockquote> 200<p>Select a different region, replace us-west-2 with the desired region like us-east-1. Currently us-east-1 & us-west-2 are supported.</p> 201</blockquote> 202</li> 203<li> 204<p>Confirmation Prompt:</p> 205<ul> 206<li>Receive a confirmation prompt: </li> 207</ul> 208<pre><code class="language-bash">Do you want to continue with the deployment? (Y/N) 209</code></pre> 210<ul> 211<li>Type Y to proceed with the deployment.</li> 212</ul> 213<p><img src="image-21.png" alt="alt text" /></p> 214</li> 215<li> 216<p>Deployment Process:</p> 217<ul> 218<li>The deployment process may take up to 15 minutes as it provisions the EKS cluster and associated resources.</li> 219</ul> 220<p><img src="image-22.png" alt="alt text" /></p> 221</li> 222<li> 223<p>Final Output:</p> 224<ul> 225<li>After the deployment is complete, review the summary of the deployment, along with command for accessing the deployed EKS cluster.</li> 226</ul> 227<p><img src="image-34.png" alt="alt text" /></p> 228</li> 229<li> 230<p>Access the Vulnerable Application:</p> 231<ul> 232<li>After the deployment, you can access the vulnerable application via the public IP of the EC2 instance: 233<pre><code class="language-bash">echo "Access the application at: http://$(jq -r '.instance_public_ip.value' < ec2_output.json)" 234</code></pre> 235</li> 236</ul> 237</li> 238<li> 239<p>Configure the EKS Cluster.</p> 240<pre><code class="language-bash">echo "Authenticate to EKS cluster via: aws eks update-kubeconfig --region $(grep 'ECR Repository URL' deployment_output.txt | awk -F'.' '{print $4}') --name $(grep 'EKS Cluster Name' deployment_output.txt | awk '{print $4}')" 241 242</code></pre> 243<p><img src="image-35.png" alt="alt text" /></p> 244</li> 245</ul> 246<h4><a class="header" href="#optional" id="optional">Optional</a></h4> 247<ul> 248<li>To update the cni to v1.21.1, modify deploy.sh.</li> 249</ul> 250<pre><code class="language-bash">cat <<EOF > eks-cluster-config.yaml 251apiVersion: eksctl.io/v1alpha5 252kind: ClusterConfig 253 254metadata: 255 name: ${EKS_CLUSTER_NAME} 256 region: ${REGION} 257 258vpc: 259 clusterEndpoints: 260 publicAccess: true 261 privateAccess: false 262 263upgradePolicy: 264 supportType: STANDARD 265 266addons: 267 - name: vpc-cni 268 version: v1.21.1-eksbuild.1 269 configurationValues: |- 270 enableNetworkPolicy: "true" 271 272managedNodeGroups: 273 - name: standard-workers 274 instanceType: t3.small 275 desiredCapacity: 2 276 minSize: 2 277 maxSize: 4 278 amiFamily: AmazonLinux2 279 iam:
280 instanceRoleARN: arn:aws:iam::${AWS_ACCOUNT_ID}:role/${EKS_ROLE_NAME} 281EOF 282</code></pre> 283<h3><a class="header" href="#refer-to-this-video-for-detailed-walkthrough" id="refer-to-this-video-for-detailed-walkthrough">Refer to this video for detailed walkthrough</a></h3> 284<!-- Embed YouTube Video in mdbook Markdown --> 285<div align="center"> 286 <iframe width="600" height="315" src="https://www.youtube.com/embed/SHZEgsgqWHk" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> 287</div> 288 289 </main> 290 291 <nav class="nav-wrapper" aria-label="Page navigation"> 292 <!-- Mobile navigation buttons --> 293 294 <a aria-keyshortcuts='Left' aria-label='Previous chapter' class='mobile-nav-chapters previous' href='/basics/eks' rel='prev' title='Previous chapter'> 295 <i class="fa fa-angle-left"></i> 296 </a> 297 298 299 300 <a aria-keyshortcuts='Right' aria-label='Next chapter' class='mobile-nav-chapters next' href='/basics/k8s' rel='next' title='Next chapter'> 301 <i class="fa fa-angle-right"></i> 302 </a> 303 304 305 <div style="clear: both"></div> 306 </nav> 307 </div> 308 </div> 309 310 <nav class="nav-wide-wrapper" aria-label="Page navigation"> 311 312 <a aria-keyshortcuts='Left' aria-label='Previous chapter' class='nav-chapters previous' href='/basics/eks' title='Previous chapter'> 313 <i class="fa fa-angle-left"></i> 314 </a> 315 316 317 318 <a aria-keyshortcuts='Right' aria-label='Next chapter' class='nav-chapters next' href='/basics/k8s' title='Next chapter'> 319 <i class="fa fa-angle-right"></i> 320 </a> 321 322 </nav> 323 324 </div> 325 326 327 328 329 330 331 332 333
333<script type="text/javascript"> 334 window.playpen_copyable = true; 335 </script>
335 336 337 338 339 340 341
341<script src="../elasticlunr.min.js" type="text/javascript" charset="utf-8"></script>
341 342
342<script src="../mark.min.js" type="text/javascript" charset="utf-8"></script>
342 343
343<script src="../searcher.js" type="text/javascript" charset="utf-8"></script>
343 344 345 346
346<script src="../clipboard.min.js" type="text/javascript" charset="utf-8"></script>
346 347
347<script src="../highlight.js" type="text/javascript" charset="utf-8"></script>
347 348
348<script src="../book.js" type="text/javascript" charset="utf-8"></script>
348 349 350 <!-- Custom JS scripts --> 351 352
352<script type="text/javascript" src="../disable_print_snapshot.js"></script>
352 353 354 355 356 357 </body> 358</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.