Lateral movement risks in the cloud and how to prevent them – Part 3: from compromised cloud resource to Kubernetes cluster takeover

This research post analyzes cloud-to-Kubernetes lateral movement techniques across AWS EKS, GCP GKE, and Azure AKS, focusing on abuse of IAM/AAD credentials, exposed kubeconfig files, and container registry image tampering, with nuanced differences by cloud provider (e.g., AKS local accounts granting cluster-admin by default, GKE/IAM integration, and EKS RBAC via aws-auth). It presents three best practices to reduce risk: avoid long-term keys in workloads (use roles/managed identities), remove and tightly secure kubeconfig files and API access (e.g., private endpoints and strict network controls), and restrict/lock down container registries with least privilege, immutability, and no public access.