brief

# Lab: `k8s_pod_irsa_exfil`

b2b_saas / medium / `k8s-banking-api` · prod

## Your job

A pod in this cluster can talk to cloud IAM. Can that workload identity reach sensitive data, and is the hop obvious from the estate?

For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database.

## Resources

- `n35_4185/eks-prod-cluster`: **K8sCluster** eks-prod-cluster-4185
- `n05_4185/workloads`: **K8sNamespace** workloads-4185
- `n46_4185/app-service-account`: **K8sServiceAccount** app-service-account-4185
- `n02_4185/backend-api-pod`: **K8sPod** backend-api-pod-4185
- `n17_4185/EksWorkloadRole`: **IAMRole** EksWorkloadRole-4185
- `n12_4185/corporate-vault-data`: **S3Bucket** corporate-vault-data-4185
- `n34_4185/customer-banking-records`: **DataSet** customer-banking-records-4185
- `n40_4185/metrics-exporter`: **K8sServiceAccount** metrics-exporter-4185
- `n09_4185/MetricsExportRole`: **IAMRole** MetricsExportRole-4185
- `n15_4185/role-legacy-support`: **IAMRole** LegacySupportRole-4185
- `n01_4185/pol-legacy-support-read`: **IAMPolicy** LegacySupportReadPolicy-4185
- `n39_4185/role-migration-helper`: **IAMRole** MigrationHelperRole-4185
- `n30_4185/pol-migration-helper-read`: **IAMPolicy** MigrationHelperReadPolicy-4185
- `n36_4185/s3-static-site`: **S3Bucket** static-site-assets-4185
- `n37_4185/s3-open-data`: **S3Bucket** open-data-exports-4185
- `n07_4185/s3-open-data`: **S3Bucket** open-data-exports-2-4185
- `n22_4185/s3-ml-features`: **S3Bucket** ml-feature-store-4185
- `n29_4185/trail-ml-features`: **LogTrail** trail-ml-features-4185
- `n32_4185/data-ml-features`: **DataSet** feature-vectors-4185
- `n11_4185/data-operational-metrics`: **DataSet** data-operational-metrics-4185
- `n19_4185/postgres-primary`: **K8sPod** postgres-primary-4185
- `n00_4185/orders-db`: **DataSet** orders-db-4185
- `n08_4185/kafka-broker`: **K8sPod** kafka-broker-4185
- `n03_4185/event-log`: **DataSet** event-log-4185
- `n44_4185/metrics-reader`: **K8sServiceAccount** metrics-reader-4185
- `n41_4185/sqs-jobs-dispatch`: **SqsQueue** jobs-dispatch-4185
- `n13_4185/kms-app-configs`: **KmsKey** kms-app-configs-4185
- `n47_4185/log-shipper`: **K8sServiceAccount** log-shipper-4185
- `n04_4185/cache`: **K8sNamespace** cache-4185
- `n31_4185/cache-proxy`: **K8sPod** cache-proxy-4185
- `n28_4185/postgres-primary`: **K8sPod** postgres-primary-2-4185
- `n23_4185/orders-db`: **DataSet** orders-db-2-4185
- `n10_4185/sqs-jobs-dispatch`: **SqsQueue** jobs-dispatch-2-4185
- `n14_4185/kafka-broker`: **K8sPod** kafka-broker-2-4185
- `n26_4185/event-log`: **DataSet** event-log-2-4185
- `n42_4185/role-cloud-watch-agent`: **IAMRole** CloudWatchAgentRole-4185
- `n21_4185/dev-sandbox`: **K8sNamespace** dev-sandbox-4185
- `n16_4185/s3-media-cache`: **S3Bucket** media-cache-4185
- `n27_4185/data-analytics-cache`: **DataSet** data-analytics-cache-4185
- `n25_4185/trail-audit-operations`: **LogTrail** trail-audit-operations-4185
- `n45_4185/sqs-jobs-dispatch`: **SqsQueue** jobs-dispatch-3-4185
- `n20_4185/ecr-collector-agent`: **EcrRepository** repo-collector-agent-4185
- `n38_4185/ecr-collector-agent`: **EcrRepository** repo-collector-agent-2-4185
- `n33_4185/s3-backup-vault`: **S3Bucket** backup-vault-4185
- `n43_4185/data-telemetry-sink`: **DataSet** data-telemetry-sink-4185
- `n18_4185/trail-infra-events`: **LogTrail** trail-infra-events-4185
- `n06_4185/ecr-base-runner`: **EcrRepository** repo-base-runner-4185
- `n48_4185/monitoring`: **K8sNamespace** monitoring-4185
- `n24_4185/metrics-agent`: **K8sPod** metrics-agent-4185

## Relationships

- `n02_4185/backend-api-pod` --in_namespace--> `n05_4185/workloads`
- `n02_4185/backend-api-pod` --binds_service_account--> `n46_4185/app-service-account`
- `n46_4185/app-service-account` --federates_to--> `n17_4185/EksWorkloadRole`
- `n17_4185/EksWorkloadRole` --can_read--> `n12_4185/corporate-vault-data`
- `n12_4185/corporate-vault-data` --stores_sensitive_data--> `n34_4185/customer-banking-records`
- `n40_4185/metrics-exporter` --federates_to--> `n09_4185/MetricsExportRole`
- `n15_4185/role-legacy-support` --attached_policy--> `n01_4185/pol-legacy-support-read`
- `n39_4185/role-migration-helper` --attached_policy--> `n30_4185/pol-migration-helper-read`
- `n22_4185/s3-ml-features` --logs_to--> `n29_4185/trail-ml-features`
- `n22_4185/s3-ml-features` --stores_sensitive_data--> `n32_4185/data-ml-features`
- `n19_4185/postgres-primary` --stores_sensitive_data--> `n00_4185/orders-db`
- `n08_4185/kafka-broker` --stores_sensitive_data--> `n03_4185/event-log`
- `n31_4185/cache-proxy` --in_namespace--> `n04_4185/cache`
- `n28_4185/postgres-primary` --stores_sensitive_data--> `n23_4185/orders-db`
- `n14_4185/kafka-broker` --stores_sensitive_data--> `n26_4185/event-log`
- `n24_4185/metrics-agent` --in_namespace--> `n48_4185/monitoring`

how this works

This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.

The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.

cloudforge on GitHub