Kubernetes to Cloud Attack Vectors: Demos Inside
summary
Managed Kubernetes defaults create real attack paths: demos show IMDSv1 enabled by default on EKS allowing pods to assume node IAM and the default EKS node role can modify security groups to expose or DDoS VMs; a demo extracts private ECR images and pivots to a Jenkins server. GKE instance templates leak kubelet certs and static tokens enabling node impersonation and CNI-killing label patches. AKS exposes admin client certs and a RunCommand API that spawns cluster-admin pods; mitigations shown: IRSA / disable IMDSv1 or use Fargate, shielded nodes or limit instance-template access, enable AAD and disable RunCommand.
AI-written summary · about
chapters (11)
- 0:00Cloud and Kubernetes security intro
- 3:33EKS instance metadata risks
- 10:20EKS attack flow demo
- 15:43GKE node bootstrap vulnerabilities
- 21:21GKE shielded nodes and tokens
- 25:38Mitigating GKE node impersonation
- 26:00AKS authentication and APIs
- 29:28AKS run command API abuse
- 31:53AKS service cluster role dangers
- 32:54AKS add-ons excessive permissions
- 36:08Security summary and recommendations
related talks
36mFrom the Cluster to the Cloud: Lateral Movements in Kubernetes
45mKubernetes Runtime Security
45mKubernetes Security: Tackling Attacks & Best Practices
33mSecuring Kubernetes in the Cloud
33mKubernetes Security: Horror Stories to Help Secure Your Cluster
42mCloud Agnostic or Devout? How Cloud Native Security Varies in EKS/AKS/GKE
43mKubernetes Security: Attacking and Defending Modern Infrastructure
01h 37mLines of Defence – Securing Your Kubernetes Clusters