Tales From a Cloud CSIRT- Let’s Deep Dive into a Kubernetes (k8s) Infection

Incident Trigger

An Argentina-based responder describes a client whose public S3 static website suddenly showed access denied because objects were encrypted with a KMS key the tenant could no longer use. The case illustrates how fast-moving startups often skip logging and security prep.

CloudTrail Forensics

With no exported logs available, the team retrieved CloudTrail event history programmatically and built tooling to grep and analyze API activity. They traced suspicious get-authorization-token calls to ECR from an internal AWS address—unexpected for a user who should not touch the container registry.

Kubernetes and IAM Risk

The talk explains how Kubernetes service accounts mapped to IAM roles can give containers cluster-level cloud permissions without segmentation. Attackers who reach that trust boundary may push images, encrypt data, and abuse infrastructure-as-code patterns that provision users automatically.

Logging Gaps

AWS logs API calls via CloudTrail, but object-level S3 events are costly and usually off. Kubernetes adds API server, audit, authenticator, and controller logs that rarely get correlated with CloudTrail—leaving blind spots during cloud-native incidents.