Audit Cloud & Kubernetes Security Posture

The skill is restricted to authorized use: it states explicitly that it is for educational purposes or authorized security assessments only, requires explicit written permission from the system owner, and treats misuse as illegal and strictly prohibited. Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target, it requires the user to state the exact target, confirm written authorization and scope, and explicitly confirm the shown commands - without that confirmation it stays read-only and offers defensive guidance only, preferring a sandbox or disposable VM.

Within that gate, it covers cloud metadata SSRF (169.254.169.254/IMDS), over-permissioned IAM, exposed storage buckets, misconfigured security groups, Docker/containerd escape-path assessment, and Kubernetes RBAC, Secrets, admission control, and supply-chain image risk (linkable to supply-chain-security/). The workflow runs four phases. Identity and boundary establishes the current identity (cloud AK/SK, Kubernetes service account, or node SSH), confines scope to a single account, cluster, or namespace, and restricts network reach to the authorized target only. Cloud control-plane review runs vendor identity commands within the authorized account only (aws sts get-caller-identity, aws s3 ls, and their Azure/GCP equivalents) to check for public buckets or bad ACLs, IMDSv1-versus-v2 metadata exposure and SSRF chains, and role-assumption (PassRole) paths that enable lateral movement. Container review checks for privileged mode, hostPath, or hostNetwork usage, dangerous capabilities like SYS_ADMIN, writable host paths as escape candidates, and known CVEs in image history via Trivy. Kubernetes review runs cluster-level checks, quoted verbatim from the source:

kubectl auth can-i --list
kubectl get pods,secrets,svc -A
kubectl get clusterrolebindings

looking at service-account token mounts and their permissions, missing dangerous admission webhooks, exposed etcd or dashboard endpoints, and default-allow network policies.

The toolchain pairs kubectl for cluster interaction, Trivy for image/IaC scanning, kube-bench/kubeaudit for CIS benchmark and configuration checks, Pacu/ScoutSuite for authorized cloud audits, and Nuclei for known cloud-vulnerability templates. Findings that yield a node shell route downstream to attack-chain or Windows AD analysis, and image vulnerabilities route to supply-chain security - but scanning other cloud tenants without authorization is explicitly out of scope.

Use it for assessing cloud workload or Kubernetes cluster security within an approved scope, or reviewing IAM/RBAC configurations for privilege-escalation paths. Do not run any probing, exploitation, or data-extraction command without the explicit written-authorization confirmation the gate requires, and never scan cloud tenants or accounts outside the authorized scope.

Input is the authorized cloud account, cluster, or namespace scope and confirmed authorization. Output is findings on IAM/RBAC misconfiguration, container or cluster escape paths, and image vulnerabilities, each with reproduction steps and impact, with cloud API calls coordinated with the owner since they may incur cost or trigger alerts.

Security assessors conducting an authorized cloud, container, or Kubernetes security review who need a structured, scope-bounded workflow across identity, cloud control plane, container, and cluster layers.