Map a cloud attack path and write the least-privilege fix

applied · 85 min · Objective 4.5

Task

Chain a cloud foothold into a full attack path across your own tenant — a workload reaching the metadata service, a credential leading to an over-broad role, a role reaching data — then write the least-privilege remediation for each link. Objective 4.5 is cloud-based attacks, scoped entirely to resources you own.

Steps

  1. In your own tenant or a simulation you built, set up a chain: a workload that can reach the metadata service, a credential there that maps to an over-broad role, and a data store that role can read.
  2. Walk the chain and record each link in /tmp/path.md: link:, what it granted, and how you moved to the next.
  3. For each link, write the least-privilege change that breaks it: a session-bound metadata request, a scoped role, a resource policy denying the over-broad access.
  4. Apply the changes one at a time and confirm each breaks the chain at that link.
  5. Write the attack narrative: from the initial foothold to the data, so a single low finding's real impact lands.
  6. Confirm the whole chain is broken after remediation.

Verify

grep -cE "^link:" /tmp/path.md
grep -ciE "session-bound|scoped role|resource policy|least privilege" /tmp/fix.md
grep -ciE "narrative|from.*foothold|to the data|chain" /tmp/narrative.md

The first count must be at least 3 — you mapped a multi-link path. The second must be non-zero: you wrote the least-privilege fix for the links, which is what makes the finding actionable. The third must be non-zero: you wrote the attack narrative, which is how a chain of individually-minor findings shows its real combined impact.

Notes

Container escape, metadata services and IAM chains combine into the cloud attack path, and the narrative is what makes a chain of low findings land as one serious one. Least privilege that survives a real deployment is the fix — scoped roles, session-bound metadata, resource policies. Everything here is your own tenant or a simulation you built; enumerating an account you do not own is the line this course does not cross.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.