How to Perform Cloud and Kubernetes Security Assessment with the cloud-k8s Module

The cloud-k8s module in the reverse-skill repository provides a structured four-phase workflow for authorized security assessments of cloud platforms and Kubernetes clusters, utilizing tools like kubectl, Trivy, kube-bench, and Pacu to audit identities, control planes, container runtimes, and cluster configurations.

The reverse-skill repository offers a comprehensive security assessment framework through its cloud-k8s skill module. Located in skills/cloud-k8s/SKILL.md, this module guides security analysts through a methodical approach to evaluate AWS, Azure, and GCP environments alongside Kubernetes workloads. By following the documented workflow and leveraging the integrated toolset, teams can conduct thorough cloud and Kubernetes security assessments while maintaining strict scope boundaries.

Four-Phase Assessment Workflow

The cloud-k8s module implements an action-oriented workflow defined in skills/cloud-k8s/SKILL.md that progresses through distinct security domains. Each phase concludes with self-check validations to ensure findings remain reproducible and non-destructive.

Phase 1: Identity and Boundary Definition

This initial phase establishes credential validity and assessment scope to prevent out-of-scope scanning. Analysts verify cloud provider identities and confirm Kubernetes context before proceeding.

Key actions include:

• Validating AWS STS, Azure AD, or GCP IAM credentials
• Recording target account identifiers and cluster contexts
• Confirming authorized_target_only network policies are active

# Verify cloud credentials

aws sts get-caller-identity   # AWS

az account show                 # Azure

gcloud auth list                # GCP

# Record target identifiers

export CLOUD_ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
export KUBE_CTX=$(kubectl config current-context)

Phase 2: Cloud Control Plane Audit

This phase enumerates cloud-level assets and misconfigurations, focusing on public storage buckets, IAM role configurations, and Instance Metadata Service (IMDS) exposure risks.

Critical checks include:

• Listing S3 buckets and Blob containers
• Identifying open ACLs and public access configurations
• Probing IMDS endpoints at 169.254.169.254

# List S3 buckets and inspect ACLs

aws s3api list-buckets --query "Buckets[].Name" | while read B; do
  aws s3api get-bucket-acl --bucket "$B" --output json
done

# AWS IAM audit with Pacu

pacu account enum

# Check GCP metadata endpoint

curl -H "Metadata-Flavor: Google" http://169.254.169.254/computeMetadata/v1/

Phase 3: Container Runtime Inspection

Analysts assess the container environment for privilege escalations, vulnerable images, and dangerous security contexts. This phase utilizes Trivy for CVE scanning and manual inspection for high-risk configurations.

Inspection targets:

• Privileged pods and hostPath/hostNetwork usage
• Linux capabilities assignments (e.g., SYS_ADMIN)
• Known vulnerabilities in running images

# Detect privileged pods and host mounts

kubectl get pods -A -o yaml | grep -E 'privileged|hostPath|hostNetwork'

# Scan unique images for vulnerabilities

kubectl get pods -A -o jsonpath="{..image}" | tr ' ' '\n' | sort -u | while read IMG; do
  trivy image "$IMG"
done

Phase 4: Kubernetes Cluster Security

The final phase examines in-cluster configurations including RBAC permissions, secrets management, and admission controller policies using CIS benchmark tools.

Essential commands:

• kubectl auth can-i --list for RBAC enumeration
• kube-bench run for CIS compliance checking
• kubeaudit all for automated misconfiguration detection

# Comprehensive RBAC review

kubectl auth can-i --list

# Export all secrets (requires appropriate permissions)

kubectl get secrets -A -o yaml > all-secrets.yaml

# Run CIS benchmark assessment

kube-bench run

# Automated audit with kubeaudit

kubeaudit all

Integrated Toolchain and Routing Infrastructure

The cloud-k8s module is embedded within the reverse-skill framework's routing system, registered as route identifier R23 in skills/MASTER-ROUTING.md. The routing coherence is maintained through skills/scripts/master-route.ps1 and verified by skills/scripts/verify-routing-coherence.ps1.

Key reference files:

• skills/cloud-k8s/SKILL.md – Master documentation containing the complete workflow, toolset specifications (kubectl, Trivy, kube-bench, Pacu), and self-check checklists
• skills/references/domain-coverage-map.md – High-level domain mapping showing the cloud-k8s entry point within the broader assessment framework
• skills/pentest-tools/src-hunter/references/payloader/raw/web.json – Contains payload identifiers cloud-k8s-escape and cloud-k8s-escape-nav used by automated hunting scripts

Self-Check Checklist Implementation

Following the workflow in skills/cloud-k8s/SKILL.md, conclude assessments with this validation checklist:

- [ ] Scope limited to authorized account / cluster?
- [ ] Any public storage bucket discovered?
- [ ] Privileged containers or host mounts present?
- [ ] Excessive RBAC permissions identified?
- [ ] No destructive actions executed without approval?

Summary

• The cloud-k8s module provides a four-phase workflow covering Identity/Boundaries, Cloud Control Plane, Container Runtime, and Kubernetes Cluster security.
• Assessment tools include Trivy for vulnerability scanning, kube-bench for CIS benchmarks, Pacu for AWS enumeration, and kubeaudit for configuration review.
• The module is route R23 in the reverse-skill framework, coordinated through skills/scripts/master-route.ps1 and documented in skills/cloud-k8s/SKILL.md.
• Each phase requires explicit self-check validation to ensure authorized, reproducible, and non-destructive testing.
• Built-in safeguards like authorized_target_only policies help prevent out-of-scope scanning during cloud and Kubernetes security assessments.

Frequently Asked Questions

What cloud providers does the cloud-k8s module support?

The module supports AWS, Azure, and GCP environments. The skills/cloud-k8s/SKILL.md file provides specific command examples for each platform, including aws sts get-caller-identity for AWS, az account show for Azure, and gcloud auth list for GCP identity verification.

How does the module prevent unauthorized scope creep?

The workflow enforces Identity & Boundary validation as Phase 1, requiring analysts to verify credentials and explicitly define target accounts and clusters. The documentation references authorized_target_only network policies and requires confirmation that only authorized resources are accessed before proceeding to invasive checks.

Which tools are automatically available within the cloud-k8s skill?

The module ships with a curated toolset including kubectl for cluster interaction, Trivy for container image scanning, kube-bench and kubeaudit for Kubernetes security auditing, and Pacu for AWS-specific penetration testing. These are referenced in the toolchain section of skills/cloud-k8s/SKILL.md.

Where is the cloud-k8s skill registered in the reverse-skill framework?

According to skills/MASTER-ROUTING.md and skills/scripts/master-route.ps1, the cloud-k8s skill is assigned identifier R23. The routing coherence is verified by skills/scripts/verify-routing-coherence.ps1, and payload identifiers like cloud-k8s-escape are defined in skills/pentest-tools/src-hunter/references/payloader/raw/web.json.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}