S Skillteca
Receber por email
Explorar Categorias Coleções Newsletter
← Voltar para o catálogo

Cloud-Native Security

DevOps e Infra Autor: allsmog

This skill should be used when the user asks about "cloud security", "AWS security", "GCP security", "Azure security", "Kubernetes security", "IMDS", "instance metadata", "S3 bucket policy", "IAM", "serverless security", "Lambda security", "container security", "cloud misconfiguration", "SSRF to cloud metadata", or needs to identify cloud-native security issues during whitebox security review.

22estrelas
Atualizado há 4 meses
Ver no GitHub ↗ Licença: MIT

Como adicionar

/plugin marketplace add allsmog/vuln-scout

O comando exato pode variar conforme o repositório. Confira o README no GitHub.

Para o autor da skill

Cole no README do seu repo

Mostra que sua skill está catalogada na Skillteca, gera backlink e tráfego rastreável.

[![Skillteca](https://www.skillteca.com.br/api/badge/cloud-native-security/svg)](https://www.skillteca.com.br/skills/cloud-native-security)
#ai #test

Skills relacionadas

Ver todas de DevOps e Infra →

internal-comms

153.1k

Recursos para auxiliar na redação de comunicações internas em diversos formatos preferidos pela empresa. Claude deve usar esta habilidade para criar relatórios de status, atualizações de liderança, newsletters, FAQs e outros documentos internos.

DevOps e Infra por anthropics

smart-explore

83.4k

Busca estrutural de código otimizada por tokens usando parsing AST do tree-sitter. Utilize para entender a estrutura do código, encontrar funções ou explorar uma base de código de forma eficiente, sem a necessidade de ler arquivos completos.

DevOps e Infra #ai por thedotmack

babysit

83.4k

Monitora um pull request ou ciclo de revisão até que esteja pronto para ser mesclado. Ideal para acompanhar comentários, revisões e CI de PRs até a resolução de todos os problemas.

DevOps e Infra #ai por thedotmack

do

83.4k

Execute um plano de implementação faseado usando subagentes. Use quando solicitado a executar, rodar ou levar a cabo um plano — especialmente um criado por make-plan.

DevOps e Infra #ai por thedotmack

Alerta por categoria

Receba novas skills de DevOps e Infra toda segunda

1 email curto, só com as skills novas de DevOps e Infra. 4 minutos de leitura, sem spam, cancela com 1 clique.

Você confirma o email no primeiro envio. Sem spam. Cancela com 1 clique.

Ler descrição completa

Cloud-Native Security Patterns Reference

Purpose

Identify security vulnerabilities specific to cloud-native environments, including IMDS exploitation, cloud provider misconfigurations, Kubernetes security issues, and serverless attack vectors. Cloud-native applications have unique trust boundaries and implicit assumptions that create vulnerability classes not present in traditional deployments.

When to Use

Activate this skill when:

  • Reviewing code that interacts with AWS, GCP, or Azure APIs
  • Auditing Kubernetes manifests and Helm charts
  • Assessing serverless functions (Lambda, Cloud Functions, Azure Functions)
  • Evaluating SSRF findings for cloud metadata exploitation
  • Reviewing Infrastructure as Code (Terraform, CloudFormation, Pulumi)
  • Checking for hardcoded cloud credentials

Instance Metadata Service (IMDS)

Overview

Cloud instances expose a metadata service at a well-known IP address. SSRF vulnerabilities in cloud-hosted applications can be exploited to access this metadata, potentially leaking IAM credentials, instance identity tokens, and configuration data.

IMDS Endpoints

| Provider | IPv4 Endpoint | IPv6 Endpoint | Protocol | |----------|--------------|---------------|----------| | AWS EC2 | 169.254.169.254 | fd00:ec2::254 | HTTP | | GCP | metadata.google.internal (169.254.169.254) | N/A | HTTP | | Azure | 169.254.169.254 | N/A | HTTP | | DigitalOcean | 169.254.169.254 | N/A | HTTP | | Oracle Cloud | 169.254.169.254 | N/A | HTTP |

AWS IMDSv1 vs IMDSv2

| Feature | IMDSv1 | IMDSv2 | |---------|--------|--------| | Request method | Simple GET | PUT to get token, then GET with token header | | SSRF exploitable | Yes (single GET request) | Harder (requires PUT + custom header) | | Mitigation | Disable or upgrade | Enforce IMDSv2-only via HttpTokens: required |

IMDSv1 Exploitation (simple GET):

GET http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>

IMDSv2 Exploitation (requires PUT + header):

PUT http://169.254.169.254/latest/api/token
X-aws-ec2-metadata-token-ttl-seconds: 21600

GET http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>
X-aws-ec2-metadata-token: <token>

Detection Patterns:

# References to IMDS IP addresses
grep -rniE "169\.254\.169\.254|fd00:ec2::254" --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.java" --include="*.rb" --include="*.php" --include="*.yaml" --include="*.yml" --include="*.tf" --include="*.json"

# GCP metadata endpoint
grep -rniE "metadata\.google\.internal|metadata-flavor.*Google" --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.java"

# Azure metadata
grep -rniE "169\.254\.169\.254.*Metadata.*true|Metadata.*169\.254\.169\.254" --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.java"

# URL fetch libraries that could be SSRF vectors to IMDS
grep -rniE "(requests\.get|urllib|http\.Get|axios|fetch)\s*\(" --include="*.py" --include="*.js" --include="*.ts" --include="*.go"

AWS-Specific Patterns

S3 Bucket Policy Misconfigurations

Pattern: S3 bucket policies with overly permissive Principal or Action statements.

# S3 bucket policy with wildcard principal
grep -rniE '"Principal"\s*:\s*"\*"|"Principal"\s*:\s*\{"AWS"\s*:\s*"\*"' --include="*.json" --include="*.tf" --include="*.yaml" --include="*.yml"

# Public ACL settings
grep -rniE "(PublicRead|public-read|public-read-write|authenticated-read)" --include="*.json" --include="*.tf" --include="*.yaml" --include="*.yml"

# S3 bucket creation without encryption
grep -rniE "aws_s3_bucket\b" --include="*.tf" -A 20 | grep -viE "(encryption|sse|kms)"

# Block public access disabled
grep -rniE "(block_public_acls|block_public_policy|ignore_public_acls|restrict_public_buckets)\s*=\s*false" --include="*.tf"

IAM Role Assumption Chains

Pattern: Overly permissive sts:AssumeRole policies that allow lateral movement or privilege escalation.

# IAM assume role policies
grep -rniE "sts:AssumeRole|sts:AssumeRoleWithWebIdentity|sts:AssumeRoleWithSAML" --include="*.json" --include="*.tf" --include="*.yaml" --include="*.yml"

# Wildcard IAM actions
grep -rniE '"Action"\s*:\s*"\*"|"Action"\s*:\s*\[.*"\*"' --include="*.json" --include="*.tf"

# Overly broad resource patterns
grep -rniE '"Resource"\s*:\s*"\*"' --include="*.json" --include="*.tf"

STS Tokens and Access Keys

# Hardcoded AWS access keys
grep -rniE "AKIA[0-9A-Z]{16}" --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.java" --include="*.env" --include="*.yaml" --include="*.yml" --include="*.tf"

# AWS secret keys (near AWS context)
grep -rniE "(aws_secret_access_key|AWS_SECRET_ACCESS_KEY|SecretAccessKey)\s*[:=]\s*[\"'][0-9a-zA-Z/+]{40}" --include="*.py" --include="*.js" --include="*.ts" --include="*.env" --include="*.yaml"

# STS tokens in environment variables or code
grep -rniE "(AWS_SESSION_TOKEN|aws_session_token|SessionToken)\s*[:=]" --include="*.py" --include="*.js" --include="*.ts" --include="*.env" --include="*.yaml"

# AWS credentials in code (boto3)
grep -rniE "boto3\.(client|resource|Session)\s*\(" --include="*.py" -A 5 | grep -iE "(aws_access_key_id|aws_secret_access_key|aws_session_token)"

AWS SDK Usage Patterns

# Detect AWS SDK usage
grep -rniE "^(import|from)\s+boto3|require\([\"']aws-sdk|@aws-sdk/" --include="*.py" --include="*.js" --include="*.ts"

# S3 operations
grep -rniE "\.(get_object|put_object|upload_file|download_file|list_objects)" --include="*.py"

# Dangerous AWS operations in code
grep -rniE "\.(create_user|attach_user_policy|put_role_policy|create_access_key)" --include="*.py"

GCP-Specific Patterns

Metadata Server Access

# GCP metadata endpoint usage
grep -rniE "metadata\.google\.internal" --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.java"

# GCP metadata headers
grep -rniE "Metadata-Flavor.*Google" --include="*.py" --include="*.js" --include="*.ts" --include="*.go"

# Service account key files
find . \( -name "*service-account*.json" -o -name "*credentials*.json" -o -name "*keyfile*.json" \) -not -path "*node_modules*" -not -path "*/.git/*" 2>/dev/null

# Hardcoded service account key content
grep -rniE '"type"\s*:\s*"service_account"' --include="*.json"

# GCP SDK usage
grep -rniE "from google\.cloud|google-cloud-|@google-cloud/" --include="*.py" --include="*.js" --include="*.ts"

Default Compute Service Account

Risk: Applications running on GCP Compute Engine, GKE, or Cloud Functions may use the default service account, which often has the Editor role (overly broad permissions).

# Check for default service account references
grep -rniE "compute@developer\.gserviceaccount\.com|-compute@developer" --include="*.tf" --include="*.yaml" --include="*.yml" --include="*.json"

# GCP IAM bindings
grep -rniE "google_project_iam|google_service_account_iam" --include="*.tf" -A 10 | grep -iE "(roles/editor|roles/owner)"

Azure-Specific Patterns

Managed Identity Endpoint

# Azure IMDS endpoint
grep -rniE "169\.254\.169\.254.*metadata.*identity|IDENTITY_ENDPOINT|MSI_ENDPOINT" --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.java" --include="*.cs"

# Azure SDK managed identity
grep -rniE "(DefaultAzureCredential|ManagedIdentityCredential|ChainedTokenCredential)" --include="*.py" --include="*.js" --include="*.ts" --include="*.cs"

# Azure Key Vault references in config
grep -rniE "(vault\.azure\.net|KeyVault|keyvault)" --include="*.py" --include="*.js" --include="*.ts" --include="*.cs" --include="*.yaml" --include="*.yml" --include="*.json"

# Hardcoded Azure credentials
grep -rniE "(AZURE_CLIENT_SECRET|AZURE_TENANT_ID|AZURE_CLIENT_ID)\s*[:=]\s*[\"']" --include="*.py" --include="*.js" --include="*.ts" --include="*.env" --include="*.yaml"
Compartilhar X LinkedIn