tabassumfathima28/aws-cloudgoat

Purpose

This repository documents hands-on AWS CloudGoat security labs. Each scenario models an intentionally vulnerable AWS environment, then records reconnaissance, exploitation, impact verification, and remediation. It is a lab/documentation repository rather than a deployable application.

Entry Points

• Root overview and scenario index: README.md

• IAM rollback escalation scenario documentation: iam-privesc-by-rollback/README.md

• A vulnerable-Lambda scenario directory is present under iam-privesc-by-rollback/vulnerable-lambda; its implementation or documentation files are not visible in the supplied tree.

Scenario 1: IAM Privilege Escalation by Rollback

The primary documented scenario concerns IAM policy-version sprawl: an attacker with suitable IAM permissions identifies an unused or forgotten policy version, sets it as default, and thereby regains broader privileges. The scenario boundary is AWS IAM control-plane configuration rather than an application runtime.

• Scenario root: iam-privesc-by-rollback

• Scenario guide: iam-privesc-by-rollback/README.md

Scenario 2: Vulnerable Lambda Attack Chain

The repository’s root documentation identifies a second scenario: SQL injection in an AWS Lambda function leading to IAM privilege escalation. This establishes an application-to-cloud-control-plane chain: request/input handling → SQL injection → Lambda execution identity or accessible credentials → IAM escalation. The visible tree only exposes its directory location as iam-privesc-by-rollback/vulnerable-lambda, so its code, database, API trigger, and infrastructure definitions cannot be confirmed.

Primary Flow and Security Boundaries

1. CloudGoat deploys intentionally vulnerable resources into an isolated AWS account.

2. A Kali-based operator uses AWS reconnaissance techniques and AWS CLI access to enumerate identities, permissions, policy versions, Lambda behavior, or reachable data stores.

3. The exploit crosses an IAM authorization boundary—either directly through policy rollback or indirectly through a compromised Lambda execution context.

4. The operator verifies resulting privilege impact.

5. The lab is remediated and destroyed, keeping the test account isolated from production.

Runtime, Infrastructure, and External Services

Material dependencies are AWS IAM, AWS Lambda, AWS CLI v2, Terraform, and CloudGoat (installed through pipx). Kali Linux is the operator environment. AWS is the only identified external platform; no persistent production service or application deployment is represented by the visible files.