# How to Perform Cloud and Kubernetes Security Assessment with the cloud-k8s Module

> Learn how to perform cloud and Kubernetes security assessments with the cloud k8s module. This guide details a structured workflow using popular tools for comprehensive audits.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-07

---

**The cloud-k8s module in the reverse-skill repository provides a structured four-phase workflow for authorized security assessments of cloud platforms and Kubernetes clusters, utilizing tools like kubectl, Trivy, kube-bench, and Pacu to audit identities, control planes, container runtimes, and cluster configurations.**

The reverse-skill repository offers a comprehensive security assessment framework through its cloud-k8s skill module. Located in [`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md), this module guides security analysts through a methodical approach to evaluate AWS, Azure, and GCP environments alongside Kubernetes workloads. By following the documented workflow and leveraging the integrated toolset, teams can conduct thorough cloud and Kubernetes security assessments while maintaining strict scope boundaries.

## Four-Phase Assessment Workflow

The cloud-k8s module implements an action-oriented workflow defined in [`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md) that progresses through distinct security domains. Each phase concludes with self-check validations to ensure findings remain reproducible and non-destructive.

### Phase 1: Identity and Boundary Definition

This initial phase establishes credential validity and assessment scope to prevent out-of-scope scanning. Analysts verify cloud provider identities and confirm Kubernetes context before proceeding.

**Key actions include:**
- Validating AWS STS, Azure AD, or GCP IAM credentials
- Recording target account identifiers and cluster contexts
- Confirming `authorized_target_only` network policies are active

```bash

# Verify cloud credentials

aws sts get-caller-identity   # AWS

az account show                 # Azure

gcloud auth list                # GCP

# Record target identifiers

export CLOUD_ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
export KUBE_CTX=$(kubectl config current-context)

```

### Phase 2: Cloud Control Plane Audit

This phase enumerates cloud-level assets and misconfigurations, focusing on public storage buckets, IAM role configurations, and Instance Metadata Service (IMDS) exposure risks.

**Critical checks include:**
- Listing S3 buckets and Blob containers
- Identifying open ACLs and public access configurations
- Probing IMDS endpoints at `169.254.169.254`

```bash

# List S3 buckets and inspect ACLs

aws s3api list-buckets --query "Buckets[].Name" | while read B; do
  aws s3api get-bucket-acl --bucket "$B" --output json
done

# AWS IAM audit with Pacu

pacu account enum

# Check GCP metadata endpoint

curl -H "Metadata-Flavor: Google" http://169.254.169.254/computeMetadata/v1/

```

### Phase 3: Container Runtime Inspection

Analysts assess the container environment for privilege escalations, vulnerable images, and dangerous security contexts. This phase utilizes Trivy for CVE scanning and manual inspection for high-risk configurations.

**Inspection targets:**
- Privileged pods and `hostPath`/`hostNetwork` usage
- Linux capabilities assignments (e.g., `SYS_ADMIN`)
- Known vulnerabilities in running images

```bash

# Detect privileged pods and host mounts

kubectl get pods -A -o yaml | grep -E 'privileged|hostPath|hostNetwork'

# Scan unique images for vulnerabilities

kubectl get pods -A -o jsonpath="{..image}" | tr ' ' '\n' | sort -u | while read IMG; do
  trivy image "$IMG"
done

```

### Phase 4: Kubernetes Cluster Security

The final phase examines in-cluster configurations including RBAC permissions, secrets management, and admission controller policies using CIS benchmark tools.

**Essential commands:**
- `kubectl auth can-i --list` for RBAC enumeration
- `kube-bench run` for CIS compliance checking
- `kubeaudit all` for automated misconfiguration detection

```bash

# Comprehensive RBAC review

kubectl auth can-i --list

# Export all secrets (requires appropriate permissions)

kubectl get secrets -A -o yaml > all-secrets.yaml

# Run CIS benchmark assessment

kube-bench run

# Automated audit with kubeaudit

kubeaudit all

```

## Integrated Toolchain and Routing Infrastructure

The cloud-k8s module is embedded within the reverse-skill framework's routing system, registered as route identifier **R23** in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md). The routing coherence is maintained through `skills/scripts/master-route.ps1` and verified by `skills/scripts/verify-routing-coherence.ps1`.

**Key reference files:**
- [`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md) – Master documentation containing the complete workflow, toolset specifications (kubectl, Trivy, kube-bench, Pacu), and self-check checklists
- [`skills/references/domain-coverage-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/references/domain-coverage-map.md) – High-level domain mapping showing the cloud-k8s entry point within the broader assessment framework
- [`skills/pentest-tools/src-hunter/references/payloader/raw/web.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/src-hunter/references/payloader/raw/web.json) – Contains payload identifiers `cloud-k8s-escape` and `cloud-k8s-escape-nav` used by automated hunting scripts

## Self-Check Checklist Implementation

Following the workflow in [`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md), conclude assessments with this validation checklist:

```markdown
- [ ] Scope limited to authorized account / cluster?
- [ ] Any public storage bucket discovered?
- [ ] Privileged containers or host mounts present?
- [ ] Excessive RBAC permissions identified?
- [ ] No destructive actions executed without approval?

```

## Summary

- The cloud-k8s module provides a **four-phase workflow** covering Identity/Boundaries, Cloud Control Plane, Container Runtime, and Kubernetes Cluster security.
- Assessment tools include **Trivy** for vulnerability scanning, **kube-bench** for CIS benchmarks, **Pacu** for AWS enumeration, and **kubeaudit** for configuration review.
- The module is route **R23** in the reverse-skill framework, coordinated through `skills/scripts/master-route.ps1` and documented in [`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md).
- Each phase requires explicit **self-check validation** to ensure authorized, reproducible, and non-destructive testing.
- Built-in safeguards like `authorized_target_only` policies help prevent out-of-scope scanning during cloud and Kubernetes security assessments.

## Frequently Asked Questions

### What cloud providers does the cloud-k8s module support?

The module supports **AWS**, **Azure**, and **GCP** environments. The [`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md) file provides specific command examples for each platform, including `aws sts get-caller-identity` for AWS, `az account show` for Azure, and `gcloud auth list` for GCP identity verification.

### How does the module prevent unauthorized scope creep?

The workflow enforces **Identity & Boundary** validation as Phase 1, requiring analysts to verify credentials and explicitly define target accounts and clusters. The documentation references `authorized_target_only` network policies and requires confirmation that only authorized resources are accessed before proceeding to invasive checks.

### Which tools are automatically available within the cloud-k8s skill?

The module ships with a curated toolset including **kubectl** for cluster interaction, **Trivy** for container image scanning, **kube-bench** and **kubeaudit** for Kubernetes security auditing, and **Pacu** for AWS-specific penetration testing. These are referenced in the toolchain section of [`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md).

### Where is the cloud-k8s skill registered in the reverse-skill framework?

According to [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) and `skills/scripts/master-route.ps1`, the cloud-k8s skill is assigned identifier **R23**. The routing coherence is verified by `skills/scripts/verify-routing-coherence.ps1`, and payload identifiers like `cloud-k8s-escape` are defined in [`skills/pentest-tools/src-hunter/references/payloader/raw/web.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/src-hunter/references/payloader/raw/web.json).