Cloud Agnostic or Devout? How Cloud Native Security Varies in EKS/AKS/GKE
summary
Claim: Kubernetes does not make security cloud-agnostic. Using CIS benchmarks and a hands-on demo the presenter spins a GKE cluster, deploys DVWA, exploits a command-injection to query the instance metadata at 169.254.169.254, steals a temporary token and lists storage buckets—proving the GKE default Google Compute service account carries the dangerous editor role (permissions count rising from ~2,000 to 6,438). Notes that EKS maps creators to system:masters and EKS-only Fargate changes attack surface, so protections and inventories are required.
AI-written summary · about
chapters (9)
- 0:00The myth of multi-cloud
- 2:50Defining cloud agnosticism
- 6:45Why agnosticism fails
- 14:00Kubernetes and CIS benchmarks
- 16:21GKE security vulnerabilities
- 24:50Identity and access risks
- 29:49Deployment mode variations
- 31:53Demonstration of GKE exploit
- 37:06Recommendations and conclusion
related talks
37mKubernetes to Cloud Attack Vectors: Demos Inside
33mSecuring Kubernetes in the Cloud
45mKubernetes Security: Tackling Attacks & Best Practices
36mFrom the Cluster to the Cloud: Lateral Movements in Kubernetes
53mFlying Above the Clouds: Securing Kubernetes
19mHow to Secure Your Kubernetes Clusters
22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native Era
43mKubernetes Security: Attacking and Defending Modern Infrastructure