1<!DOCTYPE HTML> 2<html lang="en" class="sidebar-visible no-js light"> 3 <head> 4 <!-- Book generated using mdBook --> 5 <meta charset="UTF-8"> 6<!-- This site is hosted on Netlify. Anyone can build and deploy a site 7 like this one for free: https://netlify.new/?utm_campaign=loops&utm_source=ai-legible&utm_medium=owned&utm_content=comment&utm_id=ecd49ac0-53d7-4a9c-9709-74d5753720c3 8 Netlify hosting facts for this site: static/SSR served via Netlify Edge. --> 9 <title>Welcome - OWASP EKS Goat: AWS EKS Security Masterclass Guide</title> 10 11 12 <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> 13 <meta name="description" content="Step-by-step AWS EKS security walkthrough using OWASP EKS Goat â from vulnerable cluster deployment to exploitation and defense with tools like Kyverno, GuardDuty, and eBPF Tetragon."> 14 <meta name="viewport" content="width=device-width, initial-scale=1"> 15 <meta name="theme-color" content="#ffffff" /> 16 17 <link rel="shortcut icon" href="favicon.png"> 18 <link rel="stylesheet" href="css/variables.css"> 19 <link rel="stylesheet" href="css/general.css"> 20 <link rel="stylesheet" href="css/chrome.css"> 21 <link rel="stylesheet" href="css/print.css" media="print"> 22 23 <!-- Fonts --> 24 <link rel="stylesheet" href="FontAwesome/css/font-awesome.css"> 25 <link href="https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800" rel="stylesheet" type="text/css"> 26 <link href="https://fonts.googleapis.com/css?family=Source+Code+Pro:500" rel="stylesheet" type="text/css"> 27 28 <!-- Highlight.js Stylesheets --> 29 <link rel="stylesheet" href="highlight.css"> 30 <link rel="stylesheet" href="tomorrow-night.css"> 31 <link rel="stylesheet" href="ayu-highlight.css"> 32 33 <!-- Custom theme stylesheets --> 34 35 <link rel="stylesheet" href="disable_text_selection.css"> 36 37 38 39 </head> 40 <body> 41 <!-- Provide site root to javascript --> 42
42<script type="text/javascript"> 43 var path_to_root = ""; 44 var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "light" : "light"; 45 </script>
45 46 47 <!-- Work around some values being stored in localStorage wrapped in quotes --> 48
48<script type="text/javascript"> 49 try { 50 var theme = localStorage.getItem('mdbook-theme'); 51 var sidebar = localStorage.getItem('mdbook-sidebar'); 52 53 if (theme.startsWith('"') && theme.endsWith('"')) { 54 localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1)); 55 } 56 57 if (sidebar.startsWith('"') && sidebar.endsWith('"')) { 58 localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1)); 59 } 60 } catch (e) { } 61 </script>
61 62 63 <!-- Set the theme before any content is loaded, prevents flash --> 64
64<script type="text/javascript"> 65 var theme; 66 try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { } 67 if (theme === null || theme === undefined) { theme = default_theme; } 68 var html = document.querySelector('html'); 69 html.classList.remove('no-js') 70 html.classList.remove('light') 71 html.classList.add(theme); 72 html.classList.add('js'); 73 </script>
73 74 75 <!-- Hide / unhide sidebar before it is displayed --> 76
76<script type="text/javascript"> 77 var html = document.querySelector('html'); 78 var sidebar = 'hidden'; 79 if (document.body.clientWidth >= 1080) { 80 try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { } 81 sidebar = sidebar || 'visible'; 82 } 83 html.classList.remove('sidebar-visible'); 84 html.classList.add("sidebar-" + sidebar); 85 </script>
85 86 87 <nav id="sidebar" class="sidebar" aria-label="Table of contents"> 88 <div id="sidebar-scrollbox" class="sidebar-scrollbox"> 89 <ol class="chapter"><li class="expanded "><a href='/welcome/'><strong aria-hidden="true">1.</strong> Welcome</a></li><li><ol class="section"><li class="expanded "><a href='/welcome/introduction'><strong aria-hidden="true">1.1.</strong> Introduction</a></li><li class="expanded "><a href='/welcome/agenda'><strong aria-hidden="true">1.2.</strong> Agenda</a></li><li class="expanded "><a href='/prerequisites/'><strong aria-hidden="true">1.3.</strong> Prerequisites</a></li></ol></li><li class="expanded "><a href='/basics/'><strong aria-hidden="true">2.</strong> Github Codespace Setup </a></li><li><ol class="section"><li class="expanded "><a href='/basics/lab_setup'><strong aria-hidden="true">2.1.</strong> Lab Environment Setup</a></li><li><ol class="section"><li class="expanded "><a href='/basics/setup_iam_user'><strong aria-hidden="true">2.1.1.</strong> Setup AWS IAM User</a></li><li class="expanded "><a href='/basics/gh_deploy'><strong aria-hidden="true">2.1.2.</strong> Setup Github Codespace</a></li></ol></li></ol></li><li class="expanded "><a href='/basics/basics_of_docker'><strong aria-hidden="true">3.</strong> Introduction to Docker</a></li><li><ol class="section"><li class="expanded "><a href='/basics/container_security'><strong aria-hidden="true">3.1.</strong> Container Security Overview</a></li><li><ol class="section"><li class="expanded "><a href='/basics/docker_working'><strong aria-hidden="true">3.1.1.</strong> Lab: Docker Working</a></li><li class="expanded "><a href='/basics/docker_namespaces_and_cgroups'><strong aria-hidden="true">3.1.2.</strong> Docker Namespaces and Control Groups (CGroups)</a></li><li class="expanded "><a href='/basics/docker_images_and_layers'><strong aria-hidden="true">3.1.3.</strong> Understanding Docker Images and Layers</a></li><li class="expanded "><a href='/basics/docker_secrets_and_inspection'><strong aria-hidden="true">3.1.4.</strong> Docker Secrets</a></li></ol></li><li class="expanded "><a href='/basics/sast_for_docker'><strong aria-hidden="true">3.2.</strong> Static Analysis of Docker Containers (SAST)</a></li><li><ol class="section"><li class="expanded "><a href='/basics/dockle_and_hadolint'><strong aria-hidden="true">3.2.1.</strong> Using Dockle and Hadolint</a></li><li class="expanded "><a href='/basics/docker_bench_security'><strong aria-hidden="true">3.2.2.</strong> Audits with AquaSecurity Docker Bench Security</a></li></ol></li></ol></li><li class="expanded "><a href='/basics/aws_ecr_overview'><strong aria-hidden="true">4.</strong> AWS Elastic Container Registry (ECR) Overview</a></li><li><ol class="section"><li class="expanded "><a href='/basics/lab_image_scanning'><strong aria-hidden="true">4.1.</strong> AWS ECR Image Scanning</a></li><li class="expanded "><a href='/basics/lab_securing_ecr'><strong aria-hidden="true">4.2.</strong> AWS ECR Immutable Image Tag</a></li></ol></li><li class="expanded "><a href='/basics/eks'><strong aria-hidden="true">5.</strong> AWS EKS Fundamentals</a></li><li><ol class="section"><li class="expanded "><a href='/basics/lab_deploy_sample_app'><strong aria-hidden="true">5.1.</strong> Lab: Deploying a Vulnerable AWS EKS Infra</a></li><li><ol class="section"><li class="expanded "><a href='/basics/k8s'><strong aria-hidden="true">5.1.1.</strong> Kubernetes Architecture</a></li><li class="expanded "><a href='/basics/eks_terminologies'><strong aria-hidden="true">5.1.2.</strong> AWS EKS Terminologies</a></li><li class="expanded "><a href='/basics/eks_access_management'><strong aria-hidden="true">5.1.3.</strong> EKS Authentication & Authorisation</a></li></ol></li><li class="expanded "><a href='/basics/lab_exploit_app'><strong aria-hidden="true">5.2.</strong> Lab: Exploiting the Sample Application</a></li><li><ol class="section"><li class="expanded "><a href='/basics/lab_exploit_app_1'><strong aria-hidden="true">5.2.1.</strong> Lab: Enumerate & exploit web application for vulnerablility</a></li><li class="expanded "><a href='/basics/lab_postexploit_app_1'><strong aria-hidden="true">5.2.2.</strong> Lab: Using IMDSv2 to exfiltrate Credentials</a></li><li class="expanded "><a href='/basics/lab_exploit_app_3'><strong aria-hidden="true">5.2.3.</strong> Lab: Enumerate ECR repositories using credentials</a></li><li class="expanded "><a href='/basics/lab_exploit_app_4'><strong aria-hidden="true">5.2.4.</strong> Lab: Backdooring a Docker Image</a></li><li class="expanded "><a href='/basics/lab_exploit_app_5'><strong aria-hidden="true">5.2.5.</strong> Lab: Exploiting AWS EKS Cluster</a></li><li class="expanded "><a href='/basics/labx_exploit_app_6'><strong aria-hidden="true">5.2.6.</strong> Lab: Breaking Out from Pod to Node</a></li><li class="expanded "><a href='/basics/lab_exploit_app_7'><strong aria-hidden="true">5.2.7.</strong> Lab: Privilege Escalation & S3 Exploitation</a></li><li class="expanded "><a href='/basics/lab_exploit_app_8'><strong aria-hidden="true">5.2.8.</strong> Lab: Cleanup EC2 Instance</a></li></ol></li></ol></li><li class="expanded "><a href='/basics/kubernetes_security_scanning'><strong aria-hidden="true">6.</strong> Automated Scanning in EKS</a></li><li><ol class="section"><li class="expanded "><a href='/basics/kubescape'><strong aria-hidden="true">6.1.</strong> Scanning using Kubescape</a></li><li class="expanded "><a href='/basics/kubebench'><strong aria-hidden="true">6.2.</strong> Scanning using Kubebench</a></li></ol></li><li class="expanded "><a href='/basics/defensive_security_in_eks'><strong aria-hidden="true">7.</strong> Defense & Hardening in EKS</a></li><li><ol class="section"><li class="expanded "><a href='/basics/aws_guardduty'><strong aria-hidden="true">7.1.</strong> AWS GuardDuty for Threat Detection</a></li></ol></li><li class="expanded "><a href='/basics/destroy'><strong aria-hidden="true">8.</strong> Lab: Destroy EKS Vulnerable Infra</a></li><li class="expanded "><a href='/closing/thank-you'><strong aria-hidden="true">9.</strong> Thank you</a></li></ol> 90 </div> 91 <div id="sidebar-resize-handle" class="sidebar-resize-handle"></div> 92 </nav> 93 94 <div id="page-wrapper" class="page-wrapper"> 95 96 <div class="page"> 97 98 <div id="menu-bar" class="menu-bar"> 99 <div id="menu-bar-sticky-container"> 100 <div class="left-buttons"> 101 <button id="sidebar-toggle" class="icon-button" type="button" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar"> 102 <i class="fa fa-bars"></i> 103 </button> 104 <button id="theme-toggle" class="icon-button" type="button" title="Change theme" aria-label="Change theme" aria-haspopup="true" aria-expanded="false" aria-controls="theme-list"> 105 <i class="fa fa-paint-brush"></i> 106 </button> 107 <ul id="theme-list" class="theme-popup" aria-label="Themes" role="menu"> 108 <li role="none"><button role="menuitem" class="theme" id="light">Light (default)</button></li> 109 <li role="none"><button role="menuitem" class="theme" id="rust">Rust</button></li> 110 <li role="none"><button role="menuitem" class="theme" id="coal">Coal</button></li> 111 <li role="none"><button role="menuitem" class="theme" id="navy">Navy</button></li> 112 <li role="none"><button role="menuitem" class="theme" id="ayu">Ayu</button></li> 113 </ul> 114 115 <button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar"> 116 <i class="fa fa-search"></i> 117 </button> 118 119 </div> 120 121 <h1 class="menu-title">OWASP EKS Goat: AWS EKS Security Masterclass Guide</h1> 122 123 <div class="right-buttons"> 124 <a aria-label='Print this book' href='/print' title='Print this book'> 125 <i id="print-button" class="fa fa-print"></i> 126 </a> 127 128 </div> 129 </div> 130 </div> 131 132 133 <div id="search-wrapper" class="hidden"> 134 <form id="searchbar-outer" class="searchbar-outer"> 135 <input type="search" name="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header"> 136 </form> 137 <div id="searchresults-outer" class="searchresults-outer hidden"> 138 <div id="searchresults-header" class="searchresults-header"></div> 139 <ul id="searchresults"> 140 </ul> 141 </div> 142 </div> 143 144 145 <!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM --> 146
146<script type="text/javascript"> 147 document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible'); 148 document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible'); 149 Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) { 150 link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1); 151 }); 152 </script>
152 153 154 <div id="content" class="content"> 155 <main> 156 <h1 align="center">Welcome to OWASP EKS Goat Documentation</h1> 157<p align="center"> 158 <img src="../static/logo.png" alt="Logo" width="240"/> 159</p> 160<p align="center"> 161 <b>OWASP EKS Goat</b><br/> 162 An intentionally vulnerable AWS EKS security lab by <b><a href="https://www.youtube.com/@peachycloudsecurity">peachycloudsecurity</a></b> <a href="https://eksgoat.peachycloudsecurity.com/">ð eksgoat.peachycloudsecurity.com</a> | Made with <img src="https://cloud.githubusercontent.com/assets/4301109/16754758/82e3a63c-4813-11e6-9430-6015d98aeaab.png" width="20" alt="Love"> in India 163</p> 164<p align="center"> 165 <a href="https://app.netlify.com/sites/ekssecurity/deploys"> 166 <img alt="Netlify Status" src="https://api.netlify.com/api/v1/badges/ecd49ac0-53d7-4a9c-9709-74d5753720c3/deploy-status" /> 167 </a> 168 <a href="https://github.com/OWASP/www-project-eks-goat/blob/main/LICENSE.md"> 169 <img alt="License: GPL" src="https://img.shields.io/badge/License-GPL-blue.svg" /> 170 </a> 171 <a href="https://github.com/OWASP/www-project-eks-goat/releases/latest"> 172 <img alt="GitHub release" src="https://img.shields.io/github/release/OWASP/www-project-eks-goat.svg" /> 173 </a> 174 <a href="https://github.com/OWASP/www-project-eks-goat/stargazers"> 175 <img alt="GitHub Stars" src="https://img.shields.io/github/stars/OWASP/www-project-eks-goat" /> 176 </a> 177 <a href="https://github.com/OWASP/www-project-eks-goat/pulls"> 178 <img alt="PRs Welcome" src="https://img.shields.io/badge/PRs-welcome-brightgreen.svg" /> 179 </a> 180 <a href="https://twitter.com/intent/tweet?text=Check%20out%20OWASP%20EKS%20Goat%20-%20an%20intentionally%20vulnerable%20EKS%20cluster%20for%20learning%20AWS%EKS%20security%20by%20@owasp.&url=https://github.com/OWASP/www-project-eks-goat"> 181 <img alt="Twitter" src="https://img.shields.io/twitter/url?url=https://github.com/OWASP/www-project-eks-goat" /> 182 </a> 183 <a href="https://www.linkedin.com/feed/?shareActive=true&text=What%20an%20amazing%20day!%20%F0%9F%8E%89%20We%20just%20wrapped%20up%20the%20AWS%20ECR%20%26%20EKS%20Security%20Masterclass%20-%20From%20Exploitation%20to%20Defense%20at%20Bsides%20Ahmedabad,%20authored%20by%20Anjali%20(peachycloudsecurity)%20%26%20Divyanshu!%20%F0%9F%9A%80%20The%20hands-on%20labs,%20attacks,%20and%20defenses%20were%20incredibly%20exciting!%20Big%20thanks%20to%20all%20who%20participated.%20%F0%9F%8C%9F%20Stay%20tuned%20for%20more%20such%20sessions%20from%20Kubernetes%20Village!%20%23CloudSecurity%20%23EKS%20%23KubernetesSecurity%20%23kubernetesvillage%20%23securitymasterclass%20!%20https://linktr.ee/theshukladuo"> 184 <img alt="LinkedIn Share" src="https://img.shields.io/badge/LinkedIn-Share-blue?logo=linkedin" /> 185 </a> 186 <a href="https://owasp.org/www-project-eks-goat/"> 187 <img alt="OWASP Project" src="https://img.shields.io/badge/OWASP-Official%20Project-orange.svg" /> 188 </a> 189</p> 190<p align="center"> 191 <a href="https://seasides.net/"> 192 <img alt="Seasides Goa 2026" src="https://img.shields.io/badge/Seasides-Goa%202026-5F86C9.svg" /> 193 </a> 194 <a href="https://www.blackhat.com/us-26/"> 195 <img alt="Black Hat USA 2026" src="https://img.shields.io/badge/BlackHat-USA%202026-black.svg" /> 196 </a> 197 <a href="https://www.blackhat.com/eu-25/arsenal/schedule/index.html"> 198 <img alt="Black Hat Arsenal Europe 2025" src="https://img.shields.io/badge/BlackHat%20Arsenal-Europe%202025-black.svg" /> 199 </a> 200 <a href="https://owasp.org/events/"> 201 <img alt="OWASP AppSec Day Singapore 2025" src="https://img.shields.io/badge/OWASP_AppsecDay_Singapore-2025-7e57c2.svg" /> 202 </a> 203 <a href="https://bsidesbangalore.in/"> 204 <img alt="BSides Bangalore 2025" src="https://img.shields.io/badge/BSides-Bangalore%202025-00acc1.svg" /> 205 </a> 206 <a href="https://seasides.net/"> 207 <img alt="Seasides Goa 2025" src="https://img.shields.io/badge/Seasides-Goa%202025-fb8c00.svg" /> 208 </a> 209 <a href="https://advent.cloudsecuritypodcast.tv/"> 210 <img alt="Cloud Security Podcast Advent Calendar 2024" src="https://img.shields.io/badge/CloudSecurityPodcast-Advent%20Calendar%202024-ff3c3c.svg" /> 211 </a> 212 <a href="https://www.bsidesahmedabad.in/"> 213 <img alt="BSides Ahmedabad 2024" src="https://img.shields.io/badge/BSides-Ahmedabad%202024-b00000.svg" /> 214 </a> 215<a href="https://www.csabangalorechapter.com/"> 216 <img alt="CSA Bangalore 2024" src="https://img.shields.io/badge/CSA-Bangalore%202024-0052cc.svg" /> 217 </a> 218</p> 219<h2 style="margin-top:10px;">Stay Connected</h2> 220<style> 221.pcs-cta-row { display:flex; flex-wrap:nowrap; justify-content:center; gap:8px; margin:16px auto; max-width:680px; } 222.pcs-cta-btn { flex:1 1 0; min-width:0; display:flex; align-items:center; justify-content:center; gap:6px; text-decoration:none; padding:12px 6px; border-radius:9px; color:#fff; font-weight:700; font-size:14px; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; } 223.pcs-cta-icon { font-size:17px; line-height:1; flex-shrink:0; } 224@media (max-width: 520px) { 225 .pcs-cta-btn { font-size:11px; padding:10px 4px; gap:4px; } 226 .pcs-cta-icon { font-size:15px; } 227} 228@media (max-width: 400px) { 229 .pcs-cta-icon { display:none; } 230} 231</style> 232<div class="pcs-cta-row"> 233 <a href="https://peachycloudsecurity.com/training/live-bootcamp#all-trainings" class="pcs-cta-btn" style="background:#f0663d; color:#fff;"> 234 <span class="pcs-cta-icon">ð</span>Trainings 235 </a> 236 <a href="https://www.youtube.com/@peachycloudsecurity" class="pcs-cta-btn" style="background:#FF0000; color:#fff;">
237 <svg class="pcs-cta-icon" viewBox="0 0 24 24" width="17" height="17" fill="#fff"><path d="M23.498 6.186a3.016 3.016 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.017 3.017 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.016 3.016 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.015 3.015 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814zM9.545 15.568V8.432L15.818 12l-6.273 3.568z"/></svg>YouTube 238 </a> 239 <a href="https://instagram.com/peachycloudsecurity" class="pcs-cta-btn" style="background:linear-gradient(45deg, #F56040, #E1306C, #833AB4, #405DE6); color:#fff;"> 240 <svg class="pcs-cta-icon" viewBox="0 0 24 24" width="17" height="17" fill="#fff"><path d="M7.0301.084c-1.2768.0602-2.1487.264-2.911.5634-.7888.3075-1.4575.72-2.1228 1.3877-.6652.6677-1.075 1.3368-1.3802 2.127-.2954.7638-.4956 1.6365-.552 2.914-.0564 1.2775-.0689 1.6882-.0626 4.947.0062 3.2586.0206 3.6671.0825 4.9473.061 1.2765.264 2.1482.5635 2.9107.308.7889.72 1.4573 1.388 2.1228.6679.6655 1.3365 1.0743 2.1285 1.38.7632.295 1.6361.4961 2.9134.552 1.2773.056 1.6884.069 4.9462.0627 3.2578-.0062 3.668-.0207 4.9478-.0814 1.28-.0607 2.147-.2652 2.9098-.5633.7889-.3086 1.4578-.72 2.1228-1.3881.665-.6682 1.0745-1.3378 1.3795-2.1284.2957-.7632.4966-1.636.552-2.9124.056-1.2809.0692-1.6898.063-4.948-.0063-3.2583-.021-3.6668-.0817-4.9465-.0607-1.2797-.264-2.1487-.5633-2.9117-.3084-.7889-.72-1.4568-1.3876-2.1228C21.2982 1.33 20.628.9208 19.8378.6165 19.074.321 18.2017.1197 16.9244.0645 15.6471.0093 15.236-.005 11.977.0014 8.718.0076 8.31.0215 7.0301.0839m.1402 21.6932c-1.17-.0509-1.8053-.2453-2.2287-.408-.5606-.216-.96-.4771-1.3819-.895-.422-.4178-.6811-.8186-.9-1.378-.1644-.4234-.3624-1.058-.4171-2.228-.0595-1.2645-.072-1.6442-.079-4.848-.007-3.2037.0053-3.583.0607-4.848.05-1.169.2456-1.805.408-2.2282.216-.5613.4762-.96.895-1.3816.4188-.4217.8184-.6814 1.3783-.9003.423-.1651 1.0575-.3614 2.227-.4171 1.2655-.06 1.6447-.072 4.848-.079 3.2033-.007 3.5835.005 4.8495.0608 1.169.0508 1.8053.2445 2.228.408.5608.216.96.4754 1.3816.895.4217.4194.6816.8176.9005 1.3787.1653.4217.3617 1.056.4169 2.2263.0602 1.2655.0739 1.645.0796 4.848.0058 3.203-.0055 3.5834-.061 4.848-.051 1.17-.245 1.8055-.408 2.2294-.216.5604-.4763.96-.8954 1.3814-.419.4215-.8181.6811-1.3783.9-.4224.1649-1.0577.3617-2.2262.4174-1.2656.0595-1.6448.072-4.8493.079-3.2045.007-3.5825-.006-4.848-.0608M16.953 5.5864A1.44 1.44 0 1 0 18.39 4.144a1.44 1.44 0 0 0-1.437 1.4424M5.8385 12.012c.0067 3.4032 2.7706 6.1557 6.173 6.1493 3.4026-.0065 6.157-2.7701 6.1506-6.1733-.0065-3.4032-2.771-6.1565-6.174-6.1498-3.403.0067-6.156 2.771-6.1496 6.1738M8 12.0077a4 4 0 1 1 4.008 3.9921A3.9996 3.9996 0 0 1 8 12.0077"/></svg>Instagram 241 </a> 242 <a href="https://topmate.io/peachycloudsecurity" class="pcs-cta-btn" style="background:#E44332; color:#fff;"> 243 <span class="pcs-cta-icon">ð¤</span>Topmate 244 </a> 245</div> 246<div style="border:1px solid #e5e7eb; border-radius:12px; padding:20px 24px; margin:20px 0; background:#fafafa;"> 247<h3><a class="header" href="#workshop-overview" id="workshop-overview">Workshop Overview</a></h3> 248<p>The OWASP EKS Goat Security Lab includes AWS EKS security and simulates real-world security misconfigurations and attacks on AWS EKS, followed by guided defensive remediations. Designed for practitioners. This includes immersive security workshop designed to take participants through real-world scenarios of attacking and defending Kubernetes clusters hosted on AWS EKS.</p> 249<p>This document provides a comprehensive approach, from understanding the anatomy of attacks on EKS clusters to deploying robust defense mechanisms. Participants will learn how to exploit misconfigurations and vulnerabilities within AWS EKS, followed by the implementation of best security practices to safeguard the environment.</p> 250<h3><a class="header" href="#key-takeaways" id="key-takeaways">Key Takeaways</a></h3> 251<ul> 252<li>Hands-on labs focused on exploiting AWS EKS misconfigs: IRSA, RBAC, ECR, and metadata services.</li> 253<li>Techniques for lateral movement, credential abuse, privilege escalation, and post-exploitation in AWS EKS.</li> 254<li>Deep dive into securing AWS EKS clusters by leveraging IAM roles and runtime tools (Kyverno, Tetragon) for mitigation</li> 255<li>Cloud-native supply chain and detection strategy examples.</li> 256</ul> 257<p>This document is tailored for security professionals, cloud engineers, and DevOps teams looking to enhance their understanding of offensive and defensive Kubernetes security strategies.</p> 258<h3><a class="header" href="#prerequisites" id="prerequisites">Prerequisites</a></h3> 259<ul> 260<li>GitHub Codespace</li> 261<li>Individual AWS account per participant with admin access and billing enabled (one EKS cluster per AWS account)</li> 262<li>Laptop with an updated browser (Administrative privileges may be required).</li> 263</ul> 264</div> 265<h2><a class="header" href="#about-us" id="about-us">About Us:</a></h2> 266<blockquote> 267<p><b>Authored by Anjali & Divyanshu</b></p> 268</blockquote> 269<ul> 270<li> 271<p>Anjali is a senior cloud security engineer & founder of Container Security Village. She is having great experience in cloud security ( GCP, AWS & Azure )and DevSecOps (CI/CD), Kubernetes (EKS & GKE), and IAC security. She was a member of the Infosec Girls mentorship program and regularly publishes research on various cloud security via youtube channel @peachycloudsecurity. She was a volunteer at Defcon Cloud Village and currently leads the Bangalore chapter for W3-CS. Additionally, she is an AWS Community Builder. She has delivered training and talks at conferences like OWASP AppsecDays Singapore'25, Blackhat Springâ24, Blackhat Europeâ23, Bsides Bangalore 2023/2024, CSA Bangalore Annual Summit, C0c0n 2023, Null Community Meetup Bangalore, Google Cloud IAP Security at the Cloud Security Podcast, and Nullcon 2023.</p> 272</li> 273<li> 274<p>Divyanshu is a senior security engineer, highly skilled in Security architecture reviews of Cloud, Web & Cloud Pentesting, DevSecops, Automation, and Secure Code Review. He has reported multiple vulnerabilities to companies like Airbnb, Google, Microsoft, AWS, Apple, Amazon, Samsung, Zomato, Xiaomi, Alibaba, Opera, Protonmail, Mobikwik, etc, and received CVE-2019-8727 CVE-2019-16918, CVE-2019-12278, CVE-2019-14962 for reporting issues. Author Burp-o-mation and a very-vulnerable-serverless application. Also part of AWS Community Builder for security and was a Defcon Cloud Village crew member 2020/2021/2022. He has also given training and talks in events like OWASP AppsecDays Singapore'25, Nullcon Hyderabad'24, Brucon'24, Blackchat'23, C0c0n'24, Nullcon Goa'24, Bsides Bangalore'23, Parsec IIT Dharwad and Null community. Awarded title of Cloudsecurity Champion CSA Bangalore'23 & Cybersecurity Samurai at the Bsides Bangalore'23.</p> 275</li> 276</ul> 277<h2><a class="header" href="#a-hrefhttpspeachycloudsecuritycomcontact-us
277a" id="a-hrefhttpspeachycloudsecuritycomcontact-usa"><a href="https://peachycloudsecurity.com">Contact Us</a></a></h2> 278<ul> 279<li><a href="https://peachycloudsecurity.com">Find Us Here</a> ËËË â¡ ËËË 280<ul> 281<li><a href="https://www.linkedin.com/company/containersecurityvillage/">Container Security Village</a> â â¹</li> 282<li><a href="https://www.linkedin.com/in/peachycloudsecurity/">Anjali</a> ð©ð»</li> 283<li><a href="https://www.linkedin.com/in/iamdivyanshu/">Divyanshu</a> ðð»ââï¸</li> 284</ul> 285</li> 286</ul> 287<h2><a class="header" href="#excited-about-the-class" id="excited-about-the-class">Excited About the Class:</a></h2> 288<ul> 289<li><a href="https://www.linkedin.com/feed/?shareActive=true&text=Excited%20to%20kick%20off%20the%20%22AWS%20ECR%20%26%20EKS%20Security%20Masterclass%20-%20From%20Exploitation%20to%20Defense%22%20workshop,%20authored%20by%20Anjali%20(peachycloudsecurity)%20%26%20Divyanshu!%20%F0%9F%9A%80%20We%20are%20diving%20into%20real-world%20Kubernetes%20security%20scenarios%20today.%20Follow%20along%20and%20join%20the%20journey!%20%23EKS%20%23CloudSecurity%20%23KubernetesSecurity%20%23kubernetesvillage!%20https://linktr.ee/theshukladuo">Share on Linkedin</a></li> 290</ul> 291<p>ð¨ð¨</p> 292<p><span style="color: red; font-size: 20px; font-weight: bold;">â ï¸ IMPORTANT NOTICE: Please use a new or dedicated AWS account per participant for running EKS Cluster. Some commands may delete data or resources within the AWS environment. The author assumes no responsibility for any data loss or unintended consequences resulting from the use of these commands. Running this lab on AWS EKS will incur costs, for a typical session (~16 hours), the estimated cost is around $5â8 USD.</span></p> 293<blockquote> 294<p>â ï¸ <strong>Note:</strong> EKS Goat does not exploit any vulnerability in Amazon Web Services (AWS) or Amazon EKS. All scenarios are based on insecure configurations, IAM misuse, or overly permissive setups created by users within the shared responsibility model. The lab is intended to help security teams detect and mitigate such real-world misconfigurations.</p> 295</blockquote> 296<h3><a class="header" href="#learn--grow" id="learn--grow">Learn & Grow</a></h3> 297<p>Created by The Shukla Duo (Anjali & Divyanshu), part of our mission to make cloud security accessible through practical, hands-on learning covering AWS, GCP, Kubernetes security, and DevSecOps.</p> 298<p><a href="https://www.youtube.com/@peachycloudsecurity">YouTube Channel</a> | <a href="https://peachycloudsecurity.com">Website</a> | <a href="https://topmate.io/peachycloudsecurity">1:1 Consultations</a></p> 299<h3><a class="header" href="#support-our-work" id="support-our-work">Support Our Work</a></h3> 300<p>If this tool helps you secure your infrastructure, consider supporting our educational mission:</p> 301<p><a href="https://github.com/sponsors/peachycloudsecurity">Sponsor on GitHub</a></p> 302<p>Your support helps us create more free educational content and security tools for the community.</p> 303<p style="text-align: center;"> 304 âââââ 305</p> 306 307 </main> 308 309 <nav class="nav-wrapper" aria-label="Page navigation"> 310 <!-- Mobile navigation buttons --> 311 312 313 314 <a aria-keyshortcuts='Right' aria-label='Next chapter' class='mobile-nav-chapters next' href='/welcome/introduction' rel='next' title='Next chapter'> 315 <i class="fa fa-angle-right"></i> 316 </a> 317 318 319 <div style="clear: both"></div> 320 </nav> 321 </div> 322 </div> 323 324 <nav class="nav-wide-wrapper" aria-label="Page navigation"> 325 326 327 328 <a aria-keyshortcuts='Right' aria-label='Next chapter' class='nav-chapters next' href='/welcome/introduction' title='Next chapter'> 329 <i class="fa fa-angle-right"></i> 330 </a> 331 332 </nav> 333 334 </div> 335 336 337 338 339 340 341 342 343
343<script type="text/javascript"> 344 window.playpen_copyable = true; 345 </script>
345 346 347 348 349 350 351
351<script src="elasticlunr.min.js" type="text/javascript" charset="utf-8"></script>
351 352
352<script src="mark.min.js" type="text/javascript" charset="utf-8"></script>
352 353
353<script src="searcher.js" type="text/javascript" charset="utf-8"></script>
353 354 355 356
356<script src="clipboard.min.js" type="text/javascript" charset="utf-8"></script>
356 357
357<script src="highlight.js" type="text/javascript" charset="utf-8"></script>
357 358
358<script src="book.js" type="text/javascript" charset="utf-8"></script>
358 359 360 <!-- Custom JS scripts --> 361 362
362<script type="text/javascript" src="disable_print_snapshot.js"></script>
362 363 364 365 366 367 </body> 368</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.