ATK — Attacker mission
Turn a single foothold into account-wide control: abuse the instance metadata service, harvest credentials, walk IAM trust relationships, and reach the data store.
Cloud & Zero Trust Cyber Range Training
In the cloud, the perimeter is identity — and one over-permissioned role is all the foothold an attacker needs.
DEF — Defender mission
Enforce least privilege and zero-trust segmentation, detect anomalous API calls, cut the abused role, and keep the blast radius to one account.
AI — What the Coach reviews
How fast you spotted the metadata call, whether you scoped the over-permissioned role, and the lateral-movement path you did — and didn’t — see.
MITRE ATT&CK techniques covered
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1078.004 Valid Accounts: Cloud Accounts
- T1098 Account Manipulation
- T1530 Data from Cloud Storage
- T1537 Transfer Data to Cloud Account
Technique IDs are indicative of the kill chains modelled in this domain; each match draws a unique path through them.
Why this matters
- Capital One (2019) — an SSRF reached the instance metadata service, stole a role, and exfiltrated 100M records from S3.
- Code Spaces (2014) — an attacker took the AWS console and deleted the business in hours.
- Recurring IAM mis-configuration and over-broad roles as the cloud lateral-movement highway.
Attack. Defend. Repeat.