Cloud / Container / Kubernetes Security

ACTION REQUIRED (Execute immediately after reading)

1. NOW

   : Read

   ../field-journal/precedent-pentest.md

   — Written authorization is mandatory for cloud/K8s testing

2. NOW

   : case-init + scope; Clarify account boundaries and prohibit destructive operations

3. NOW

   : Confirm whether it involves cloud metadata/container/K8s/IAM, rather than regular web scanning (use

   pentest-tools/

   for the latter)

4. NEXT

   : tool-index; kubectl/aws/gcloud etc. are mostly installed manually

5. ACT

   : Start with "Identity and Exposure Surface", prohibit default full-network scanning

Applicable Scenarios

• Cloud metadata SSRF (169.254.169.254 / IMDS)
• IAM over-permissions, public storage buckets, incorrect security groups
• Docker/containerd escape path assessment
• Kubernetes RBAC, Secrets, Admission, supply chain images
• Container image vulnerabilities (can link with

  supply-chain-security/

  )

Workflow

Phase 1 — Identity and Boundary

□ Current identity: Cloud AK/SK, K8s SA, node SSH?
□ Scope: Single account / Single cluster / Single namespace
□ Network policy: authorized_target_only

Phase 2 — Cloud Control Plane

# Example (replace by vendor; MUST operate within authorized accounts)
aws sts get-caller-identity
aws s3 ls
# Corresponding identity commands for Azure / GCP

□ Public buckets / Incorrect ACLs
□ Metadata: IMDSv1 vs v2; SSRF chains
□ Roles that can be assumed (PassRole) and lateral movement

Phase 3 — Containers

□ Whether privileged / hostPath / hostNetwork is enabled
□ Capabilities (such as SYS_ADMIN)
□ Writable host paths → Escape candidates
□ Image history and known CVEs → Trivy

Phase 4 — Kubernetes

kubectl auth can-i --list
kubectl get pods,secrets,svc -A
kubectl get clusterrolebindings

□ SA token mounting and permissions
□ Missing dangerous admission webhooks
□ etcd / dashboard exposure
□ Whether network policies allow traffic by default

Toolchain

trivy

References

• references/k8s-cloud-checklist.md

• CTF reference:

  ../../CTF-Sandbox-Orchestrator/competition-agent-cloud/

• ../supply-chain-security/

  ../pentest-tools/

Routing Context

attack-chain

windows-ad

Task Completion Self-Check

• Is it limited to authorized accounts/clusters?
• Do findings include reproduction steps and impacts?
• Have destructive operations been avoided?
• Report / journal completed?