{"schemaVersion":"1.0","type":"Article","types":["Article"],"slug":"terraformgoat-training-jlvg1","url":"https://zyvop.com/terraformgoat-training-jlvg1","title":"TerraformGoat Training","subtitle":null,"tldr":"Alibaba Cloud Interesting content can be added Alibaba Cloud OSS Bucket HTTP transmission startup scenario: provider \"alicloud\" { profile = \"default\" region = \"...","keywords":[],"entities":["I0veD","cyber security researcher","ZyVOP"],"keyTakeaways":["Alibaba Cloud Interesting content can be added Alibaba Cloud OSS Bucket HTTP transmission startup scenario: provider \"alicloud\" { profile = \"default\" region = \"cn-beijing\" } resource \"alicloud_oss_bucket\" \"huoxian_terraformgoat_bucket\" { force_destroy = true bucket = \"huoxian-terraformgoat-bucket-${random_string.random_suffix.result}\" policy = <<POLICY { \"Version\": \"1\", \"Statement\": [{ \"Effect\": \"Allow\", \"Action\": [ \"\" ], \"Principal\": [ \"\" ], \"Resource\": [ \"acs:oss:::*\" ], \"Condition\": { \"Bool\": { \"acs:SecureTransport\": [ \"false\" ] } } }] } POLICY } resource \"random_string\" \"random_suffix\" { length = 5 special = false upper = false • Insecure transmission：Strategy condition requirementsacs:SecureTransport for false, which means that the request cannot use HTTPS and must use HTTP.","Bucket special policy scenarios: provider \"alicloud\" { profile = \"default\" region = \"cn-beijing\" } resource \"alicloud_oss_bucket\" \"Create_Bucket\" { bucket = \"hx-cloud-security-${random_string.random_suffix.result}\" acl = \"public-read-write\" force_destroy = true policy = <<POLICY { \"Version\": \"1\", \"Statement\": [{ \"Effect\": \"Allow\", \"Action\": [ \"oss:GetObject\", \"oss:GetObjectAcl\", \"oss:ListObjects\", \"oss:RestoreObject\", \"oss:GetVodPlaylist\", \"oss:ListObjectVersions\", \"oss:GetObjectVersion\", \"oss:GetObjectVersionAcl\", \"oss:RestoreObjectVersion\" ], \"Principal\": [ \"\" ], \"Resource\": [ \"acs:oss:::/\" ], \"Condition\": { \"StringEquals\": { \"acs:UserAgent\": [ \"test\" ] } } }, { \"Effect\": \"Allow\", \"Action\": [ \"oss:ListObjects\", \"oss:GetObject\" ], \"Principal\": [ \"\" ], \"Resource\": [ \"acs:oss:::*\" ], \"Condition\": { \"StringEquals\": { \"acs:UserAgent\": [ \"HxSecurityLab\" ] } } }] } POLICY } resource \"random_string\" \"random_suffix\" { length = 5 special = false upper = false } ACL permissions: The bucket's access control list (ACL) is set topublic-read-write, which means anyone can read and write objects in the bucket.","Strategy conditions: Two conditions are defined in the strategy, respectively based onacs:UserAgentField: Alibaba Cloud OSS Bucket server-side encryption without KMS scenario provider \"alicloud\" { profile = \"default\" region = \"cn-beijing\" } resource \"alicloud_oss_bucket\" \"huoxian_terraformgoat_bucket\" { acl = \"private\" force_destroy = true bucket = \"huoxian-terraformgoat-bucket-${random_string.random_suffix.result}\" server_side_encryption_rule { sse_algorithm = \"AES256\" } } resource \"random_string\" \"random_suffix\" { length = 5 special = false upper = false } Generally used for private algorithms and reverse engineering after detection Alibaba Cloud OSS Bucket server-side KMS encryption does not use BYOK provider \"alicloud\" { profile = \"default\" region = \"cn-beijing\" } resource \"alicloud_oss_bucket\" \"huoxian_terraformgoat_bucket\" { acl = \"private\" force_destroy = true bucket = \"huoxian-terraformgoat-bucket-${random_string.random_suffix.result}\" server_side_encryption_rule { sse_algorithm = \"KMS\" } } resource \"random_string\" \"random_suffix\" { length = 5 special = false upper = false } server_side_encryption_rule { sse_algorithm = \"KMS\" } • No private key is specified."],"headings":["Alibaba Cloud","What is an EBS volume?","What are unused EBS volumes?","Impact of unused EBS volumes"],"outboundLinks":[],"contentText":"Alibaba Cloud Interesting content can be added Alibaba Cloud OSS Bucket HTTP transmission startup scenario: provider \"alicloud\" { profile = \"default\" region = \"cn-beijing\" } resource \"alicloud_oss_bucket\" \"huoxian_terraformgoat_bucket\" { force_destroy = true bucket = \"huoxian-terraformgoat-bucket-${random_string.random_suffix.result}\" policy = <<POLICY { \"Version\": \"1\", \"Statement\": [{ \"Effect\": \"Allow\", \"Action\": [ \"\" ], \"Principal\": [ \"\" ], \"Resource\": [ \"acs:oss:::*\" ], \"Condition\": { \"Bool\": { \"acs:SecureTransport\": [ \"false\" ] } } }] } POLICY } resource \"random_string\" \"random_suffix\" { length = 5 special = false upper = false • Insecure transmission：Strategy condition requirementsacs:SecureTransport for false, which means that the request cannot use HTTPS and must use HTTP. Bucket special policy scenarios: provider \"alicloud\" { profile = \"default\" region = \"cn-beijing\" } resource \"alicloud_oss_bucket\" \"Create_Bucket\" { bucket = \"hx-cloud-security-${random_string.random_suffix.result}\" acl = \"public-read-write\" force_destroy = true policy = <<POLICY { \"Version\": \"1\", \"Statement\": [{ \"Effect\": \"Allow\", \"Action\": [ \"oss:GetObject\", \"oss:GetObjectAcl\", \"oss:ListObjects\", \"oss:RestoreObject\", \"oss:GetVodPlaylist\", \"oss:ListObjectVersions\", \"oss:GetObjectVersion\", \"oss:GetObjectVersionAcl\", \"oss:RestoreObjectVersion\" ], \"Principal\": [ \"\" ], \"Resource\": [ \"acs:oss:::/\" ], \"Condition\": { \"StringEquals\": { \"acs:UserAgent\": [ \"test\" ] } } }, { \"Effect\": \"Allow\", \"Action\": [ \"oss:ListObjects\", \"oss:GetObject\" ], \"Principal\": [ \"\" ], \"Resource\": [ \"acs:oss:::*\" ], \"Condition\": { \"StringEquals\": { \"acs:UserAgent\": [ \"HxSecurityLab\" ] } } }] } POLICY } resource \"random_string\" \"random_suffix\" { length = 5 special = false upper = false } ACL permissions: The bucket's access control list (ACL) is set topublic-read-write, which means anyone can read and write objects in the bucket. Strategy conditions: Two conditions are defined in the strategy, respectively based onacs:UserAgentField: Alibaba Cloud OSS Bucket server-side encryption without KMS scenario provider \"alicloud\" { profile = \"default\" region = \"cn-beijing\" } resource \"alicloud_oss_bucket\" \"huoxian_terraformgoat_bucket\" { acl = \"private\" force_destroy = true bucket = \"huoxian-terraformgoat-bucket-${random_string.random_suffix.result}\" server_side_encryption_rule { sse_algorithm = \"AES256\" } } resource \"random_string\" \"random_suffix\" { length = 5 special = false upper = false } Generally used for private algorithms and reverse engineering after detection Alibaba Cloud OSS Bucket server-side KMS encryption does not use BYOK provider \"alicloud\" { profile = \"default\" region = \"cn-beijing\" } resource \"alicloud_oss_bucket\" \"huoxian_terraformgoat_bucket\" { acl = \"private\" force_destroy = true bucket = \"huoxian-terraformgoat-bucket-${random_string.random_suffix.result}\" server_side_encryption_rule { sse_algorithm = \"KMS\" } } resource \"random_string\" \"random_suffix\" { length = 5 special = false upper = false } server_side_encryption_rule { sse_algorithm = \"KMS\" } • No private key is specified. Use the key managed by Alibaba Cloud. If Alibaba Cloud's key management system is attacked, the bucket will be affected. • Certain compliance requirements (such as financial, medical, etc. industries) may require the use of BYOK Alibaba Cloud ECS SSRF vulnerability environment resource \"alicloud_instance\" \"instance\" { security_groups = alicloud_security_group.group.*.id instance_type = data.alicloud_instance_types.types_ds.instance_types.0.id image_id = \"ubuntu_18_04_64_20G_alibase_20190624.vhd\" instance_name = \"huocorp_terraform_goat_instance\" vswitch_id = alicloud_vswitch.vswitch.id system_disk_size = 20 internet_max_bandwidth_out = 100 user_data = <<EOF #!/bin/bash sudo apt-get -y update sudo apt-get -y install apache2 sudo apt-get -y install php sudo apt-get -y install php-curl sudo sed -i 's/Listen 80/Listen 8080/' /etc/apache2/ports.conf sudo /etc/init.d/apache2 restart cd /var/www/html sudo apt-get -y install wget sudo wget https://huocorp-oss.oss-cn-beijing.aliyuncs.com/terraform-goat-dependency-files/ssrf-lab.zip sudo apt-get -y install unzip sudo unzip ssrf-lab.zip sudo mv ./ssrf-lab/static/flag69152201.txt / EOF depends_on = [ alicloud_security_group.group, alicloud_vswitch.vswitch, ] } resource \"alicloud_security_group\" \"group\" { name = \"huocorp_terraform_goat_security_group\" vpc_id = alicloud_vpc.vpc.id depends_on = [ alicloud_vpc.vpc ] } resource \"alicloud_security_group_rule\" \"allow_all_tcp\" { type = \"ingress\" ip_protocol = \"tcp\" nic_type = \"intranet\" policy = \"accept\" port_range = \"8080/8080\" priority = 1 security_group_id = alicloud_security_group.group.id cidr_ip = \"0.0.0.0/0\" depends_on = [ alicloud_security_group.group ] } resource \"alicloud_vpc\" \"vpc\" { vpc_name = \"huocorp_terraform_goat_vpc\" cidr_block = \"172.16.0.0/16\" } resource \"alicloud_vswitch\" \"vswitch\" { vpc_id = alicloud_vpc.vpc.id cidr_block = \"172.16.0.0/24\" zone_id = \"cn-beijing-h\" vswitch_name = \"huocorp_terraform_goat_vswitch\" depends_on = [ alicloud_vpc.vpc ] } resource \"alicloud_ram_role\" \"role\" { name = \"huocorp-terraform-goat-role\" force = true document = <<EOF { \"Statement\": [ { \"Action\": \"sts:AssumeRole\", \"Effect\": \"Allow\", \"Principal\": { \"Service\": [ \"ecs.aliyuncs.com\" ] } } ], \"Version\": \"1\" } EOF } resource \"alicloud_ram_policy\" \"policy\" { policy_name = \"AdministratorAccess\" force = true policy_document = <<EOF { \"Statement\": [ { \"Action\": \"\", \"Effect\": \"Allow\", \"Resource\": \"\" } ], \"Version\": \"1\" } EOF } resource \"alicloud_ram_role_attachment\" \"attach\" { role_name = alicloud_ram_role.role.name instance_ids = alicloud_instance.instance.*.id depends_on = [ alicloud_instance.instance ] } resource \"alicloud_ram_role_policy_attachment\" \"attach\" { policy_name = alicloud_ram_policy.policy.name policy_type = alicloud_ram_policy.policy.type role_name = alicloud_ram_role.role.name depends_on = [ alicloud_ram_policy.policy, alicloud_ram_role.role ] } data \"alicloud_instance_types\" \"types_ds\" { cpu_core_count = 1 memory_size = 1 } Conveniently build a security verification platform Alibaba Cloud ECS virtual machine disk encryption is not enabled It is also a post-utilization, which facilitates the establishment of a secure verification platform. The attack scenarios for other clouds are similar. Here are some special ones: awsDelete feature without MFA scenario enabled AWS EBS volume not in use Amazon Elastic Block Store (EBS) is a high-performance block storage service designed for use with Amazon EC2 instances. EBS volumes can serve as primary storage devices (such as operating system disks) or additional storage devices (such as data disks) for EC2 instances. What is an EBS volume? EBS volumes are persistent block-level storage devices that can be attached to EC2 instances. Each EBS volume is automatically replicated within an Availability Zone to protect against hardware failures and provide high availability and durability. Key features of EBS volumes include: persistence: Even if the EC2 instance is terminated, the data in the EBS volume still exists. flexibility: Can be expanded or contracted as needed. high performance: Offers different performance options such as General Purpose (GP2/GP3), Provisioned IOPS (IO1/IO2), Throughput Optimized (ST1), and Cold HDD (SC1). What are unused EBS volumes? Unused EBS volumes are those that are not attached to any EC2 instances. They may be unused for the following reasons: The EC2 instance was terminated, but the EBS volume was not deleted. The EBS volume is not deleted after the data migration or backup is completed. Forgot to delete after temporary use. Impact of unused EBS volumes cost： Resource waste and leakage AWS IAM privilege escalation vulnerability environment provider \"aws\" { region = \"us-east-1\" } resource \"aws_iam_user\" \"huoxian_terraform_user\" { name = \"huoxian_terraform_test\" } resource \"aws_iam_access_key\" \"huoxian_terraform_access_key\" { user = aws_iam_user.huoxian_terraform_user.name depends_on = [aws_iam_user.huoxian_terraform_user] } resource \"aws_iam_user_policy\" \"huoxian_terraform_policy\" { name = \"IAMFullAccess\" user = aws_iam_user.huoxian_terraform_user.name depends_on = [aws_iam_user.huoxian_terraform_user] policy = <<EOF { \"Version\": \"2012-10-17\", \"Statement\": [ { \"Action\": [ \"iam:\", \"organizations:DescribeAccount\", \"organizations:DescribeOrganization\", \"organizations:DescribeOrganizationalUnit\", \"organizations:DescribePolicy\", \"organizations:ListChildren\", \"organizations:ListParents\", \"organizations:ListPoliciesForTarget\", \"organizations:ListRoots\", \"organizations:ListPolicies\", \"organizations:ListTargetsForPolicy\" ], \"Effect\": \"Allow\", \"Resource\": \"\" } ] } EOF } data \"template_file\" \"secret\" { template = aws_iam_access_key.huoxian_terraform_access_key.encrypted_secret } Azure VM command execution vulnerability environment provider \"aws\" { region = \"us-east-1\" } resource \"aws_iam_user\" \"huoxian_terraform_user\" { name = \"huoxian_terraform_test\" } resource \"aws_iam_access_key\" \"huoxian_terraform_access_key\" { user = aws_iam_user.huoxian_terraform_user.name depends_on = [aws_iam_user.huoxian_terraform_user] } resource \"aws_iam_user_policy\" \"huoxian_terraform_policy\" { name = \"IAMFullAccess\" user = aws_iam_user.huoxian_terraform_user.name depends_on = [aws_iam_user.huoxian_terraform_user] policy = <<EOF { \"Version\": \"2012-10-17\", \"Statement\": [ { \"Action\": [ \"iam:\", \"organizations:DescribeAccount\", \"organizations:DescribeOrganization\", \"organizations:DescribeOrganizationalUnit\", \"organizations:DescribePolicy\", \"organizations:ListChildren\", \"organizations:ListParents\", \"organizations:ListPoliciesForTarget\", \"organizations:ListRoots\", \"organizations:ListPolicies\", \"organizations:ListTargetsForPolicy\" ], \"Effect\": \"Allow\", \"Resource\": \"\" } ] } EOF } data \"template_file\" \"secret\" { template = aws_iam_access_key.huoxian_terraform_access_key.encrypted_secret }root@5c2e680829bc:/TerraformGoat/aws/iam/privilege_escalation# \\cd /TerraformGoat/azure/vm/vm_command_execution root@5c2e680829bc:/TerraformGoat/azure/vm/vm_command_execution# cd /TerraformGoat/azure/vm/vm_command_execution root@5c2e680829bc:/TerraformGoat/azure/vm/vm_command_execution# cat main.tf provider \"azurerm\" { features {} } resource \"azurerm_resource_group\" \"terraformgoat\" { name = \"huoxian-terraform-goat-resources\" location = \"West Europe\" } resource \"azurerm_public_ip\" \"terraformgoat\" { name = \"huoxian-terraform-goat-publicip\" resource_group_name = azurerm_resource_group.terraformgoat.name location = azurerm_resource_group.terraformgoat.location allocation_method = \"Static\" } resource \"azurerm_network_security_group\" \"terraformgoat\" { name = \"huoxian-terraform-goat-security-group\" location = azurerm_resource_group.terraformgoat.location resource_group_name = azurerm_resource_group.terraformgoat.name depends_on = [ azurerm_resource_group.terraformgoat, ] security_rule { name = \"huoxian-terraform-goat-security-group-rule\" priority = 100 direction = \"Inbound\" access = \"Allow\" protocol = \"Tcp\" source_port_range = \"8080\" destination_port_range = \"\" source_address_prefix = \"\" destination_address_prefix = \"*\" } } resource \"azurerm_virtual_network\" \"terraformgoat\" { name = \"huoxian-terraform-goat-network\" address_space = [\"10.0.0.0/16\"] location = azurerm_resource_group.terraformgoat.location resource_group_name = azurerm_resource_group.terraformgoat.name depends_on = [ azurerm_resource_group.terraformgoat, ] } resource \"azurerm_subnet\" \"terraformgoat\" { name = \"huoxian-terraform-goat-internal\" resource_group_name = azurerm_resource_group.terraformgoat.name virtual_network_name = azurerm_virtual_network.terraformgoat.name address_prefixes = [\"10.0.2.0/24\"] depends_on = [ azurerm_resource_group.terraformgoat, azurerm_virtual_network.terraformgoat ] } resource \"azurerm_network_interface\" \"terraformgoat\" { name = \"huoxian-terraform-goat-nic\" location = azurerm_resource_group.terraformgoat.location resource_group_name = azurerm_resource_group.terraformgoat.name depends_on = [ azurerm_resource_group.terraformgoat, azurerm_public_ip.terraformgoat, azurerm_subnet.terraformgoat ] ip_configuration { name = \"huoxian-terraform-goat-internal\" subnet_id = azurerm_subnet.terraformgoat.id private_ip_address_allocation = \"Dynamic\" public_ip_address_id = azurerm_public_ip.terraformgoat.id } } resource \"azurerm_linux_virtual_machine\" \"terraformgoat\" { name = \"huoxian-terraform-goat-machine\" resource_group_name = azurerm_resource_group.terraformgoat.name location = azurerm_resource_group.terraformgoat.location size = \"Standard_B1ls\" admin_username = \"huoxian\" admin_password = \"HuoXian@${random_string.random_suffix.result}\" disable_password_authentication = false user_data = \"IyEvYmluL2Jhc2gKc3VkbyBhcHQtZ2V0IC15IHVwZGF0ZQpzdWRvIGFwdC1nZXQgLXkgaW5zdGFsbCBhcGFjaGUyCnN1ZG8gYXB0LWdldCAteSBpbnN0YWxsIHBocApzdWRvIGFwdC1nZXQgLXkgaW5zdGFsbCBwaHAtY3VybApzdWRvIHNlZCAtaSAncy9MaXN0ZW4gODAvTGlzdGVuIDgwODAvJyAvZXRjL2FwYWNoZTIvcG9ydHMuY29uZgpzdWRvIC9ldGMvaW5pdC5kL2FwYWNoZTIgcmVzdGFydApjZCAvdmFyL3d3dy9odG1sCnN1ZG8gYXB0LWdldCAteSBpbnN0YWxsIHdnZXQKc3VkbyB3Z2V0IGh0dHBzOi8vaHVvY29ycC1vc3Mub3NzLWNuLWJlaWppbmcuYWxpeXVuY3MuY29tL3RlcnJhZm9ybS1nb2F0LWRlcGVuZGVuY3ktZmlsZXMvY29tbWFuZC1leGVjdXRpb24tbGFiLnppcApzdWRvIGFwdC1nZXQgLXkgaW5zdGFsbCB1bnppcApzdWRvIHVuemlwIGNvbW1hbmQtZXhlY3V0aW9uLWxhYi56aXAKc3VkbyBtdiAuL2NvbW1hbmQtZXhlY3V0aW9uLWxhYi9zdGF0aWMvZmxhZzY5MTUyMjAxLnR4dCAv\" network_interface_ids = [ azurerm_network_interface.terraformgoat.id, ] depends_on = [ azurerm_resource_group.terraformgoat, azurerm_network_interface.terraformgoat ] os_disk { caching = \"ReadWrite\" storage_account_type = \"Standard_LRS\" } source_image_reference { publisher = \"Canonical\" offer = \"UbuntuServer\" sku = \"18.04-LTS\" version = \"latest\" } } resource \"random_string\" \"random_suffix\" { length = 6 special = false upper = false } Conveniently create security verification scenarios","contentHash":"sha256:12ecfde3071d7832772497c22db34f4b9e6957a6aa6dc51e467f3e471a818476","authorName":"I0veD","authorUrl":"https://zyvop.com/author/i0ved","authorSameAs":["https://www.cdxiaodong.life/","https://github.com/cdxiaodong","https://www.linkedin.com/in/%E6%A0%8B-%E7%A8%8B-167b89391/"],"category":null,"tags":[],"audience":"Software engineers and developers building applications with software development","tone":"Professional, cyber security researcher perspective","readingTimeMinutes":4,"wordCount":1027,"faqs":null,"primaryTopic":null,"publishedAt":"2026-08-12T05:30:47.602Z","updatedAt":"2026-09-01T22:15:00.266Z","canonicalUrl":"https://www.cdxiaodong.life/article/terroform_goat_translate"}