The Big IAM Challenge

Fri, 02 Oct 2026 00:00:00 +0000

The Big IAM Challenge

Buckets of Fun

We all know that public buckets are risky. But can you find the flag?

IAM策略

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": "*",
 "Action": "s3:GetObject",
 "Resource": "arn:aws:s3:::thebigiamchallenge-storage-9979f4b/*"
 },
 {
 "Effect": "Allow",
 "Principal": "*",
 "Action": "s3:ListBucket",
 "Resource": "arn:aws:s3:::thebigiamchallenge-storage-9979f4b",
 "Condition": {
 "StringLike": {
 "s3:prefix": "files/*"
 }
 }
 }
 ]
}

可以看到策略：

Wiz EKS Cluster Games

Tue, 29 Sep 2026 00:00:00 +0000

Wiz EKS Cluster Games

参考：从EKS CLUSTER GAMES看云原生安全-先知社区

Secret Seeker

Jumpstart your quest by listing all the secrets in the cluster. Can you spot the flag among them?

给出的权限：
1
2
3
4
5
6
{
 "secrets": [
 "get",
 "list"
 ]
}

Secrets是Kubernetes中用于存储敏感数据的一种资源对象，它可以用于存储密码、API密钥、证书等敏感信息，这些信息在应用程序中需要使用。

Wiz云靶场 on 美咕噜的小站

The Big IAM Challenge

The Big IAM Challenge

Buckets of Fun

Wiz EKS Cluster Games

Wiz EKS Cluster Games

Secret Seeker