CdkGoat is Bridgecrew's "Vulnerable by Design" AWS CDK repository. CdkGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.

It also shows how Bridgecrew can be used with the AWS CDK to provide CloudFormation template vulnerability scanning at build time, even though no CloudFormation templates exist in the source repository.

CdkGoat was built to enable DevSecOps design and implement a sustainable misconfiguration prevention strategy. It can be used to test a policy-as-code framework like Bridgecrew & Checkov, inline-linters, or other code scanning methods executed at build / deploy time.

CdkGoat follows the tradition of existing *Goat projects that provide a baseline training ground to practice implementing secure development best practices for cloud infrastructure.

• Where to get help: the Bridgecrew Community Slack

Before you proceed please take a not of these warning:

⚠️ CdkGoat creates intentionally vulnerable AWS resources into your account. DO NOT deploy CdkGoat in a production environment or alongside any sensitive AWS resources.

This project uses the following software versions, but older versions should generally work.

• Python 3.8.4 with virtualenv
• Node 14.5.0
• NPM 6.14.5
• AWS CLI v2, configured with credentials

To prevent vulnerable infrastructure from arriving to production see: checkov, the open source static analysis tool for infrastructure as code.

Clone this repository. Then run the following commands:

npm install -g aws-cdk
python -m venv .env
source .env/bin/activate
pip install -r requirements.txt

Run the following commands to generate a CloudFormation template and scan it with the Bridgecrew CLI:

cdk synth
bridgecrew -f cdk.out/cdkgoat.template.json

Run the following command to deploy the infrastructure into your AWS account. Warning: This will create vulnerable resources. Deploy with care into a non-prod account, and consider deleting the stack each time you finish your work. The best use of this capability is to compare these results to a runtime scanner.

cdk deploy

Note that you will probably need to change some resource names, especially S3 bucket names, to be unique.

Run the following command to destroy the stack and its resources. You can also delete the stack from the AWS Console.

cdk destroy

• CfnGoat - Vulnerable by design Cloudformation template
• TerraGoat - Vulnerable by design Terraform stack
• CDKGoat - Vulnerable by design CDK application

Contribution is welcomed!

We would love to hear about more ideas on how to find vulnerable infrastructure-as-code design patterns.

Bridgecrew builds and maintains CdkGoat to encourage the adoption of policy-as-code.

If you need direct support you can contact us at [email protected].