Date of Award
2026
Document Type
Thesis
Degree Name
Master of Science (MS)
Department
Computer Science
Committee Chair
Tathagata Mukherjee
Committee Member
Letha Etzkorn
Committee Member
Jingshu Chen
Research Advisor
Tathagata Mukherjee
Subject(s)
Cloud computing--Security measures, Software container technologies
Abstract
Kubernetes pod security misconfigurations are well documented, but existing research treats them as platform-independent. No previous work measures how the same misconfiguration behaves differently across cloud providers. This thesis deploys three identical pod configurations (default, hostNetwork, and hostPath) on AWS EKS and Azure AKS and tests them against a four-phase attack model covering node access, lateral movement, cluster access, and cloud resource access. Results show that the cloud provider’s authentication architecture is very important in determining the blast radius. On EKS, a default pod can authenticate to the Kubernetes API as node through IMDS credentials alone, while on AKS this path does not exist. Conversely, the hostPath path exposes a kubelet client certificate on AKS that does not have an equivalent on EKS. While the instance metadata service (IMDS) restriction reduces the attack surface for pods on both platforms, it can be bypassed via either of the misconfiguration flags.
Recommended Citation
Dawadi, Kiran, "Pod security misconfigurations in the cloud : a comparative study of exploitability in EKS and AKS" (2026). Theses. 841.
https://louis.uah.edu/uah-theses/841