Labs / Capstone investigations
From a thumbnail service to the order exports
A pod that fetches image URLs was used to read the node’s cloud credentials. Follow it from kubectl logs into CloudTrail and measure what the stolen role reached from outside.
Briefing
GuardDuty raised an alert: credentials for the EKS node role were used from an IP outside AWS. The shop namespace runs a thumbnailer that downloads any image URL a user submits.
Pods on a node can often reach the instance metadata service at 169.254.169.254, which hands out the node role’s temporary credentials. You have read-only kubectl access and a CloudTrail export.
ir-ws · Capstone investigations
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.