CloudGoat

CloudGoat is Rhino Security Labs' 'Vulnerable by Design' AWS deployment tool. It provisions intentionally misconfigured AWS environments (scenarios) using Terraform, creating realistic attack paths for practicing cloud penetration testing. Scenarios include IAM privilege escalation, Lambda function exploitation, EC2 SSRF to metadata service, S3 bucket misconfigurations, and cross-account access abuse. Each scenario has documented start and end conditions with multiple solution paths. CloudGoat provisions and destroys environments on demand in your own AWS account, providing hands-on practice with real AWS services rather than simulations.