AWS EKS Security Masterclass with OWASP EKS Goat
Attack a deliberately vulnerable EKS cluster with OWASP EKS Goat, then apply the RBAC and network policy fixes that would have stopped you.
OWASP EKS Goat is an official OWASP project, delivered as a training and presented at:
What you'll do
19 labs and 8 theory sessions across 8 sections. Theory appears where it is needed for the next lab, not as a lecture block.
Built on OWASP EKS Goat, an intentionally vulnerable EKS cluster. You deploy it, break it the way an attacker would, and then put the controls back.
The path runs end to end: exploit the sample application, use IMDSv2 to lift credentials, enumerate ECR with them, backdoor an image, move into the cluster, break out from pod to node, escalate into S3, and then clean up. The defensive half covers automated scanning and threat detection.
1.Setup
- LabSet up an AWS IAM user
- LabSet up a GitHub Codespace
2.Introduction to Docker
- LabDocker working
- TheoryDocker namespaces and control groups
- TheoryDocker images and layers
- TheoryDocker secrets
- TheoryStatic analysis of Docker containers (SAST)
- LabUsing Dockle and Hadolint
- LabAudits with Aqua Security Docker Bench
3.AWS Elastic Container Registry
- LabECR image scanning
- TheoryECR immutable image tags
4.AWS EKS fundamentals
- LabDeploying a vulnerable AWS EKS infrastructure
- TheoryKubernetes architecture
- TheoryAWS EKS terminologies
- TheoryEKS authentication and authorisation
5.Exploiting the sample application
- LabEnumerate and exploit the web application
- LabUsing IMDSv2 to exfiltrate credentials
- LabEnumerate ECR repositories with those credentials
- LabBackdooring a Docker image
- LabExploiting the AWS EKS cluster
- LabBreaking out from pod to node
- LabPrivilege escalation and S3 exploitation
- LabCleanup of the EC2 instance
6.Automated scanning in EKS
- LabScanning with Kubescape
- LabScanning with kube-bench
7.Defense and hardening in EKS
- LabAWS GuardDuty for threat detection
8.Teardown
- LabDestroy the vulnerable EKS infrastructure
Work through it yourself
The complete walkthrough is public, and OWASP EKS Goat is an official OWASP project. Work through it at your own pace, or use it to revisit the labs afterwards.
eksgoat.peachycloudsecurity.com →How our trainings run
- Live and instructor-led, with the trainers in the room rather than a recording.
- Labs run in the browser. Nothing to install, and no fight with a corporate laptop.
- Attack first, then fix. Every exploited flaw is followed by the control that stops it.
- You keep the material, the recording, and a certificate of completion.
Who runs it
Anjali Shukla
Senior Security Engineer · Black Hat and Nullcon trainer
Founder, Container Security Village. OWASP EKS Goat lead. AWS Community Builder. Women Influencer in Cloud Security, CSA Bangalore 2023. Leads the W3-CS Bengaluru chapter.
Want a customised cloud native security course for your team? Contact us.
Support Our Work
Subscribe, like, and share our videos.
No Spam. Only updates.