brief

# Lab: `ec2_imds_credential_exfil`

b2b_saas / medium / `web-portal` · prod

## Your job

A public-facing web server is accessible from the internet. Can an attacker leverage server-side requests to steal credentials and access internal data?

For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database.

## Resources

- `n02_7994/acct-main`: **Account** prod-account-7994
- `n16_7994/ec2-web-frontend`: **EC2Instance** WebFrontendServer-7994
- `n20_7994/role-web-app`: **IAMRole** WebAppInstanceRole-7994
- `n07_7994/pol-app-data`: **IAMPolicy** WebAppCustomerDataPolicy-7994
- `n24_7994/s3-customer-pii`: **S3Bucket** customer-pii-records-000000000000-7994
- `n04_7994/data-customer-pii`: **DataSet** customer-identity-and-pii-7994
- `n23_7994/lambda-order-notifier`: **LambdaFunction** order-notifier-7994
- `n00_7994/role-order-notifier`: **IAMRole** OrderNotifierRole-7994
- `n10_7994/role-reporting-read`: **IAMRole** ReportingReadRole-7994
- `n17_7994/pol-reporting-read-read`: **IAMPolicy** ReportingReadPolicy-7994
- `n18_7994/role-partner-sync`: **IAMRole** PartnerSyncRole-7994
- `n25_7994/pol-partner-sync-read`: **IAMPolicy** PartnerSyncReadPolicy-7994
- `n21_7994/s3-release-downloads`: **S3Bucket** release-downloads-7994
- `n11_7994/s3-ops-runbooks`: **S3Bucket** ops-runbooks-7994
- `n05_7994/trail-ops-runbooks`: **LogTrail** trail-ops-runbooks-7994
- `n12_7994/data-ops-runbooks`: **DataSet** runbook-library-7994
- `n22_7994/s3-audit-evidence`: **S3Bucket** audit-evidence-7994
- `n09_7994/trail-audit-evidence`: **LogTrail** trail-audit-evidence-7994
- `n01_7994/data-audit-evidence`: **DataSet** audit-evidence-files-7994
- `n19_7994/s3-app-config`: **S3Bucket** app-config-store-7994
- `n06_7994/trail-app-config`: **LogTrail** trail-app-config-7994
- `n15_7994/data-app-config`: **DataSet** app-config-values-7994
- `n14_7994/sqs-audit-events`: **SqsQueue** audit-events-7994
- `n08_7994/s3-telemetry-logs`: **S3Bucket** telemetry-logs-7994
- `n13_7994/ecr-analytics-worker`: **EcrRepository** repo-analytics-worker-7994
- `n03_7994/sqs-metrics-queue`: **SqsQueue** metrics-queue-7994

## Relationships

- `n02_7994/acct-main` --exposed_to_internet--> `n16_7994/ec2-web-frontend`
- `n16_7994/ec2-web-frontend` --assumes--> `n20_7994/role-web-app`
- `n20_7994/role-web-app` --attached_policy--> `n07_7994/pol-app-data`
- `n20_7994/role-web-app` --can_read--> `n24_7994/s3-customer-pii`
- `n24_7994/s3-customer-pii` --stores_sensitive_data--> `n04_7994/data-customer-pii`
- `n16_7994/ec2-web-frontend` --can_invoke--> `n23_7994/lambda-order-notifier`
- `n23_7994/lambda-order-notifier` --assumes--> `n00_7994/role-order-notifier`
- `n10_7994/role-reporting-read` --attached_policy--> `n17_7994/pol-reporting-read-read`
- `n18_7994/role-partner-sync` --attached_policy--> `n25_7994/pol-partner-sync-read`
- `n11_7994/s3-ops-runbooks` --logs_to--> `n05_7994/trail-ops-runbooks`
- `n11_7994/s3-ops-runbooks` --stores_sensitive_data--> `n12_7994/data-ops-runbooks`
- `n22_7994/s3-audit-evidence` --logs_to--> `n09_7994/trail-audit-evidence`
- `n22_7994/s3-audit-evidence` --stores_sensitive_data--> `n01_7994/data-audit-evidence`
- `n19_7994/s3-app-config` --logs_to--> `n06_7994/trail-app-config`
- `n19_7994/s3-app-config` --stores_sensitive_data--> `n15_7994/data-app-config`

how this works

This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.

The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.

cloudforge on GitHub