Thread by @wiz_io

3 cloud-to-K8s best practices to mitigate the risk of a lateral movement attack 🛡

1️⃣ Avoid storing long-term #cloud keys in workloads
2️⃣ Remove kubeconfig files from publicly exposed workloads
3️⃣ Restrict access to container registries

Details in thread 🧵👇 #kubernetes

1️⃣ Avoid storing long-term #cloud keys in workloads

✅ Attach IAM roles/service accounts/managed identities to workloads and define minimum permissions.

✅ Generate and rotate temporary credentials using the IMDS for improved #cloudsecurity.

🧵 2/5

2️⃣ Remove kubeconfig files from publicly exposed workloads

✅ Remove kubeconfig files from exposed workloads, configure #K8s API server endpoint as private.

✅ Restrict access to specific IP addresses using a strictly configured #security group.

🧵 3/5

3️⃣ Restrict access to container registries

✅ Restrict access by applying strict policies, limiting network access and refraining from enabling public access.

✅ Enable “Tag immutability” and block public access using storage.publicAccessPrevention policy.

🧵 4/5

Want to learn more?

Check out our series on Lateral movement risks in the #cloud and how to prevent them 👇

wiz.io/blog/lateral-m…