brief

# Lab: `ec2_imds_credential_exfil`

b2b_saas / medium / `web-portal` · prod

## Your job

A public-facing web server is accessible from the internet. Can an attacker leverage server-side requests to steal credentials and access internal data?

For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database.

## Resources

- `n22_571e/acct-main`: **Account** prod-account-571e
- `n08_571e/ec2-web-frontend`: **EC2Instance** WebFrontendServer-571e
- `n09_571e/role-web-app`: **IAMRole** WebAppInstanceRole-571e
- `n10_571e/pol-app-data`: **IAMPolicy** WebAppCustomerDataPolicy-571e
- `n33_571e/s3-customer-pii`: **S3Bucket** customer-pii-records-000000000000-571e
- `n05_571e/data-customer-pii`: **DataSet** customer-identity-and-pii-571e
- `n29_571e/role-scheduler`: **IAMRole** SchedulerRole-571e
- `n26_571e/role-report-builder`: **IAMRole** ReportBuilderRole-571e
- `n27_571e/lambda-order-notifier`: **LambdaFunction** order-notifier-571e
- `n19_571e/role-order-notifier`: **IAMRole** OrderNotifierRole-571e
- `n30_571e/role-migration-helper`: **IAMRole** MigrationHelperRole-571e
- `n12_571e/pol-migration-helper-read`: **IAMPolicy** MigrationHelperReadPolicy-571e
- `n11_571e/role-reporting-read`: **IAMRole** ReportingReadRole-571e
- `n06_571e/pol-reporting-read-read`: **IAMPolicy** ReportingReadPolicy-571e
- `n31_571e/s3-static-site`: **S3Bucket** static-site-assets-571e
- `n14_571e/s3-static-site`: **S3Bucket** static-site-assets-2-571e
- `n20_571e/s3-audit-evidence`: **S3Bucket** audit-evidence-571e
- `n24_571e/trail-audit-evidence`: **LogTrail** trail-audit-evidence-571e
- `n36_571e/data-audit-evidence`: **DataSet** audit-evidence-files-571e
- `n28_571e/s3-billing-exports`: **S3Bucket** billing-exports-archive-571e
- `n18_571e/trail-billing-exports`: **LogTrail** trail-billing-exports-571e
- `n23_571e/data-billing-exports`: **DataSet** billing-statements-571e
- `n00_571e/kms-storage-general`: **KmsKey** kms-storage-general-571e
- `n16_571e/sqs-jobs-dispatch`: **SqsQueue** jobs-dispatch-571e
- `n17_571e/data-telemetry-sink`: **DataSet** data-telemetry-sink-571e
- `n07_571e/sqs-ingest-pipeline`: **SqsQueue** ingest-pipeline-571e
- `n13_571e/kms-internal-telemetry`: **KmsKey** kms-internal-telemetry-571e
- `n37_571e/role-cloud-watch-agent`: **IAMRole** CloudWatchAgentRole-571e
- `n02_571e/s3-media-cache`: **S3Bucket** media-cache-571e
- `n40_571e/sqs-ingest-pipeline`: **SqsQueue** ingest-pipeline-2-571e
- `n38_571e/ecr-collector-agent`: **EcrRepository** repo-collector-agent-571e
- `n15_571e/role-backup-runner`: **IAMRole** BackupRunnerRole-571e
- `n34_571e/s3-exports-staging`: **S3Bucket** exports-staging-571e
- `n32_571e/s3-telemetry-logs`: **S3Bucket** telemetry-logs-571e
- `n21_571e/s3-backup-vault`: **S3Bucket** backup-vault-571e
- `n01_571e/data-operational-metrics`: **DataSet** data-operational-metrics-571e
- `n35_571e/role-metrics-collector`: **IAMRole** MetricsCollectorRole-571e
- `n25_571e/role-metrics-collector`: **IAMRole** MetricsCollectorRole-2-571e
- `n03_571e/s3-backup-vault`: **S3Bucket** backup-vault-2-571e
- `n04_571e/ecr-utility-image`: **EcrRepository** repo-utility-image-571e
- `n39_571e/data-reporting-store`: **DataSet** data-reporting-store-571e

## Relationships

- `n22_571e/acct-main` --exposed_to_internet--> `n08_571e/ec2-web-frontend`
- `n08_571e/ec2-web-frontend` --assumes--> `n09_571e/role-web-app`
- `n09_571e/role-web-app` --assumes--> `n29_571e/role-scheduler`
- `n29_571e/role-scheduler` --assumes--> `n26_571e/role-report-builder`
- `n26_571e/role-report-builder` --attached_policy--> `n10_571e/pol-app-data`
- `n26_571e/role-report-builder` --can_read--> `n33_571e/s3-customer-pii`
- `n33_571e/s3-customer-pii` --stores_sensitive_data--> `n05_571e/data-customer-pii`
- `n08_571e/ec2-web-frontend` --can_invoke--> `n27_571e/lambda-order-notifier`
- `n27_571e/lambda-order-notifier` --assumes--> `n19_571e/role-order-notifier`
- `n30_571e/role-migration-helper` --attached_policy--> `n12_571e/pol-migration-helper-read`
- `n11_571e/role-reporting-read` --attached_policy--> `n06_571e/pol-reporting-read-read`
- `n20_571e/s3-audit-evidence` --logs_to--> `n24_571e/trail-audit-evidence`
- `n20_571e/s3-audit-evidence` --stores_sensitive_data--> `n36_571e/data-audit-evidence`
- `n28_571e/s3-billing-exports` --logs_to--> `n18_571e/trail-billing-exports`
- `n28_571e/s3-billing-exports` --stores_sensitive_data--> `n23_571e/data-billing-exports`

how this works

This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.

The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.

cloudforge on GitHub